Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow existing app registration for Open OnDemand deployments #207

Merged
merged 13 commits into from
Mar 17, 2025
Merged

Allow existing app registration for Open OnDemand deployments #207

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
af70fef
Enable BYO Entra ID app registrations in UI
abatallas Mar 10, 2025
0fbf315
Align UI outputs and Bicep type check
abatallas Mar 10, 2025
b6fc5de
Update bicep to allow for BYO registration; preempt unneeded resource…
abatallas Mar 10, 2025
a547d3f
Simplify OOD registration flag logic in ccw.bicep
abatallas Mar 11, 2025
c6f7f05
Use resource selector dropdown for OOD MI ID
abatallas Mar 12, 2025
01e12a2
Remove tenant ID input and output in UI
abatallas Mar 12, 2025
f9e822e
Revert tenant ID output in ccw.bicep
abatallas Mar 12, 2025
aa3c7e1
Add regex validation to client ID input and make MI selection mandato…
abatallas Mar 12, 2025
292db1c
Fix logic issue in OOD outputs in ccw.bicep
abatallas Mar 12, 2025
ab31306
Invert order of app ID and MI in BYO registration menu
abatallas Mar 12, 2025
de4cd9e
Merge branch 'main' into abatallas/byo_entra_registration_ood
xpillons Mar 13, 2025
1ab49d2
fix wrong merge conflict
xpillons Mar 13, 2025
a9253de
don't filter UMI on the subscription
xpillons Mar 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions bicep/ccw.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,7 @@ module ccwANF 'anf.bicep' = [
]

var deployOOD = ood.type != 'disabled'
var registerOODApp = ood.?registerEntraIDApp ?? false

module oodNIC 'ood-NIC.bicep' = if (deployOOD) {
name: 'oodNIC'
Expand All @@ -264,12 +265,12 @@ module oodNIC 'ood-NIC.bicep' = if (deployOOD) {
}

// create a user assigned managed identity to be assigned to the OOD VM
resource oodNewManagedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = if (deployOOD) {
resource oodNewManagedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = if (registerOODApp) {
name: 'ood-${uniqueString(az.resourceGroup().id)}-mi'
location: location
}

module oodApp 'oodEntraApp.bicep' = if (deployOOD) {
module oodApp 'oodEntraApp.bicep' = if (registerOODApp) {
name: 'oodApp'
params: {
umiName: 'ood-${uniqueString(az.resourceGroup().id)}-mi'
Expand Down Expand Up @@ -392,7 +393,7 @@ output acceptMarketplaceTerms bool = acceptMarketplaceTerms
output ood object = union(ood, {
version: '1.0.0'
nic: deployOOD ? oodNIC.outputs.NICId : ''
managedIdentity: deployOOD ? oodApp.outputs.oodMiId : ''
clientId: deployOOD ? oodApp.outputs.oodClientAppId : ''
managedIdentity: deployOOD ? registerOODApp ? oodApp.outputs.oodMiId : ood.?appManagedIdentityId : ''
clientId: deployOOD ? registerOODApp ? oodApp.outputs.oodClientAppId : ood.?appId : ''
tenantId: deployOOD ? subscription().tenantId : ''
})
5 changes: 4 additions & 1 deletion bicep/types.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -251,8 +251,11 @@ type ood_enabled_t = {
sku: string
osImage: string
userDomain: string
registerEntraIDApp: bool
fqdn: string?
registerEntraIDApp: bool
appId: string?
appTenantId: string?
appManagedIdentityId: string?
}

@export()
Expand Down
60 changes: 53 additions & 7 deletions uidefinitions/createUiDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1897,14 +1897,58 @@
},
{
"name": "registerEntraIDApp",
"type": "Microsoft.Common.CheckBox",
"label": "Register an Entra ID Application",
"toolTip": "Register an Entra ID Application for Open OnDemand authentication using OpenID Connect",
"defaultValue": true,
"type": "Microsoft.Common.OptionsGroup",
"label": "Microsoft Entra ID Application Registration",
"defaultValue": "Automatically register an Entra ID Application",
"toolTip": "Register a Microsoft Entra ID Application for Open OnDemand authentication using OpenID Connect",
"constraints": {
"required": false
"allowedValues": [
{
"label": "Automatically register an Entra ID Application",
"value": "autoregister"
},
{
"label": "Use existing Entra ID Application registration",
"value": "existing"
},
{
"label": "None",
"value": "no"
}
],
"required": true
},
"visible": "[steps('ood').OODSection.deployOOD]"
},
{
"name": "clientId",
"type": "Microsoft.Common.TextBox",
"label": "Application (client) ID",
"defaultValue": "",
"toolTip": "Application or client ID of the Entra ID Application in the Azure AD tenant",
"constraints": {
"required": true,
"regex": "^(\\w{8}(-\\w{4}){3}-\\w{12}?)$",
"validationMessage": "Enter a valid application (client) ID"
},
"visible": "[equals(steps('ood').OODSection.registerEntraIDApp,'existing')]"
},
{
"name": "managedIdentity",
"type": "Microsoft.Solutions.ResourceSelector",
"label": "Managed Identity",
"toolTip": "Select the user-assigned managed identity created for the federated credentials",
"resourceType": "Microsoft.ManagedIdentity/userAssignedIdentities",
"constraints": {
"required": true,
"validationMessage": "Please select a managed identity."
},
"options": {
"filter": {
"subscription": "onBasics"
}
},
"visible": "[equals(steps('ood').OODSection.registerEntraIDApp,'existing')]"
}
],
"visible": true
Expand Down Expand Up @@ -2025,8 +2069,10 @@
"sku": "[if(steps('ood').OODSection.deployOOD,steps('ood').OODSection.vmsize,basics('nullValue'))]",
"osImage": "[if(steps('ood').OODSection.deployOOD,if(equals(steps('ood').OODSection.ImageName,'custom'),steps('ood').OODSection.customImageName,steps('ood').OODSection.ImageName),basics('nullValue'))]",
"userDomain": "[if(steps('ood').OODSection.deployOOD,steps('ood').OODSection.userDomain,basics('nullValue'))]",
"registerEntraIDApp": "[if(steps('ood').OODSection.deployOOD,steps('ood').OODSection.registerEntraIDApp,basics('nullValue'))]",
"fqdn": "[if(not(equals(steps('ood').OODSection.fqdn,'')),steps('ood').OODSection.fqdn,basics('nullValue'))]"
"fqdn": "[if(not(equals(steps('ood').OODSection.fqdn,'')),steps('ood').OODSection.fqdn,basics('nullValue'))]",
"registerEntraIDApp": "[if(steps('ood').OODSection.deployOOD,equals(steps('ood').OODSection.registerEntraIDApp,'autoregister'),basics('nullValue'))]",
"appId": "[if(equals(steps('ood').OODSection.registerEntraIDApp,'existing'),steps('ood').OODSection.clientId,basics('nullValue'))]",
"appManagedIdentityId": "[if(equals(steps('ood').OODSection.registerEntraIDApp,'existing'),steps('ood').OODSection.managedIdentity.id,basics('nullValue'))]"
},
"clusterInitSpecs": [],
"tags": "[steps('tags').tagsByResource]"
Expand Down
Loading