Add azuread_service_principal_token_signing_certificate to simplify certificate management #732

dhohengassner · 2022-02-08T16:16:39Z

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Azure API provides a method (addTokenSigningCertificate) to create a self signed certificate for a service principal: https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#create-a-signing-certificate

This option avoids managing a certificate by yourself and is currently not supported via terraform.

New or Affected Resource(s)

azuread_service_principal_token_signing_certificate

References

https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#step-4-configure-a-signing-certificate

This is a different request than #410 because I do not want to manage the certificate myself.

Thanks for your feedback!

manicminer · 2022-02-09T01:18:54Z

Hi @dhohengassner, thanks for requesting this feature! Looking through the linked walkthrough, it looks like a few additional pieces are needed here?

New resource for token signing certificates
New resource for claims mapping policies (a community member is already working on this)
Support for the preferredTokenSigningKeyThumbprint field for service principals

Does this look right to you?

dhohengassner · 2022-02-09T07:45:54Z

@manicminer that is exactly what I had in mind 👍

I will try to come up with PRs for that.

Thanks for the fast feedback!

This commit adds support to create the certificiate for Azure AD signed certs. Issue: hashicorp/terraform-provider-azuread#732

…erredTokenSigningKeyThumbprint This commit adds support to create the certificiate for Azure AD signed certs and set the preferred token thumbprint on the service principal. This will allow to follow the steps described in https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#create-a-signing-certificate using hamilton SDK. Issue: hashicorp/terraform-provider-azuread#732

…erredTokenSigningKeyThumbprint This commit adds support to create the certificiate for Azure AD signed certs and set the preferred token thumbprint on the service principal. This will allow to follow the steps described in https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#create-a-signing-certificate using hamilton SDK. Currently Microsoft does not support a method to remove the created certificate key from the service principal. https://docs.microsoft.com/en-us/graph/api/serviceprincipal-addtokensigningcertificate Also manual removal via `removePassword` and `removekey` API calls are not supported and fail with an internal server error. This SDK extension is the base to extend the `terraform-provider-azuread`. Issue: hashicorp/terraform-provider-azuread#732

dhohengassner · 2022-02-15T19:01:01Z

created a PR to add support for the preferredTokenSigningKeyThumbprint field for service principals

manicminer/hamilton#151

dhohengassner · 2022-02-16T16:17:26Z

@manicminer Experimented today with certification creation on service principal.

It seems the Graph API supports adding a certificate but there is no option to remove them. I can see the generated keys and passwords but I cannot remove them via removePassword or removeKey calls. In case addtokensigningcertificate is called it will add a new cert to the principal.

Ref: https://docs.microsoft.com/en-us/graph/api/serviceprincipal-addtokensigningcertificate

I am able to remove the certs on Enterprise apps but this is using a different internal API.

Therefore I would suggest not create an own terraform resource for that feature. Instead use an optional field on the azuread_service_principal called token_signing_certificate_name. If a name is set it will create a cert and update the preferred_token_signing_key_thumbprint computed field of the resource. token_signing_certificate_name would be a ForceNew field to avoid creating multiple certificates in case of an update.

Does that make sense for you? Or do you prefer having a seperate resource for the created certificate.

manicminer · 2022-02-17T03:13:36Z

Hi @dhohengassner, thanks for looking into it. That's unfortunate - using ForceNew as a workaround on the service_principal resource may be an option, but I'd like to reach out first and find out whether that API might be expanded with full CRD support that we can make a proper resource of it.

dhohengassner · 2022-02-17T09:05:17Z

Hey @manicminer good idea!
I will create a PR with the workaround using ForceNew as temp solution I can test.

So I understood right that you will contact Microsoft to ask for a new API feature?
Thank you for all the help with that!

…erredTokenSigningKeyThumbprint This commit adds support to create the certificiate for Azure AD signed certs and set the preferred token thumbprint on the service principal. This will allow to follow the steps described in https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#create-a-signing-certificate using hamilton SDK. Currently Microsoft does not support a method to remove the created certificate key from the service principal. https://docs.microsoft.com/en-us/graph/api/serviceprincipal-addtokensigningcertificate Also manual removal via `removePassword` and `removekey` API calls are not supported and fail with an internal server error. This SDK extension is the base to extend the `terraform-provider-azuread`. Issue: hashicorp/terraform-provider-azuread#732

We do like to add support to the provider to create a token signing certificate. This commit adds a new field `token_signing_certificate_name` to the resource `azuread_service_principal`. If this is set a ceritificate will be generated and the thumbprint will be stored in a computed field called `preferred_token_signing_key_thumbprint`. Issue: hashicorp#732

…erredTokenSigningKeyThumbprint This commit adds support to create the certificiate for Azure AD signed certs and set the preferred token thumbprint on the service principal. This will allow to follow the steps described in https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#create-a-signing-certificate using hamilton SDK. Currently Microsoft does not support a method to remove the created certificate key from the service principal. https://docs.microsoft.com/en-us/graph/api/serviceprincipal-addtokensigningcertificate Also manual removal via `removePassword` and `removekey` API calls are not supported and fail with an internal server error. This SDK extension is the base to extend the `terraform-provider-azuread`. Issue: hashicorp/terraform-provider-azuread#732

We do like to add support to the provider to create a token signing certificate. This commit adds a new field `token_signing_certificate_name` to the resource `azuread_service_principal`. If this is set a ceritificate will be generated and the thumbprint will be stored in a computed field called `preferred_token_signing_key_thumbprint`. Issue: hashicorp#732

We do like to add support to the provider to create a token signing certificate. This commit adds new optional fields `token_signing_certificate_name` and `token_signing_certificate_end_date` to the resource `azuread_service_principal`. If both of these fields are set a token signing ceritificate for the service principal gets created and attached. The certificate thumbprint will be stored in a computed field called `preferred_token_signing_key_thumbprint`. There is now way to update or rotate the certificate because of missing API support. Therefore in case of an adjustment the principal will be replaced. Issue: hashicorp#732

…erredTokenSigningKeyThumbprint This commit adds support to create the certificiate for Azure AD signed certs and set the preferred token thumbprint on the service principal. This will allow to follow the steps described in https://docs.microsoft.com/en-us/graph/application-saml-sso-configure-api#create-a-signing-certificate using hamilton SDK. Currently Microsoft does not support a method to remove the created certificate key from the service principal. https://docs.microsoft.com/en-us/graph/api/serviceprincipal-addtokensigningcertificate Also manual removal via `removePassword` and `removekey` API calls are not supported and fail with an internal server error. This SDK extension is the base to extend the `terraform-provider-azuread`. Issue: hashicorp/terraform-provider-azuread#732

This adds a new resource called `service_principal_token_signing_certificate` that is used to manage the whole lifecycle of token signing certificates used for SAML authentication. This resource makes use of the `AddTokenSigningCertificate` function that was added to hamilton previously here: manicminer/hamilton#158 MS Graphs Docs: https://learn.microsoft.com/en-us/graph/api/serviceprincipal-addtokensigningcertificate?view=graph-rest-1.0&tabs=http As documented in the docs above, when the `AddTokenSigningCertificate` function is invoked, 3 individual objects are created... - Verify `keyCredential` (Public Cert) - Sign `keyCredential` (Private Key) - `passwordCredential` (Private Key Password) When the object is returned, it includes the thumbprint, the public key pem value, and a `keyId`. However, we found an odd behavior that the `keyId` that is returned is actually for the Sign `keyCredential`. Since the Verify certificate is the one that we acutally care about, we used the `customKeyIdentifier`, which is the same for all 3 values, to get the Verify `keyId`, which we then use in building the resource ID. We additionally had to "calculate" the thumbprint value from the actual value of the Verify cert, as this value is not returned from the API, except after initial creation in the Create step. We did this by getting pem value of the Verify cert by adding the `$select=keyCredential` odata query to the GET of the service principal. By combining this value with the PEM header/footer, we can calculate the SHA-1 fingerprint, which matches up to the appropriate thumbprint. Finally, to delete the certificate, we have to PATCH the service principal with all 3 objects mentioned previously removed. To gather this, we used the `customKeyIdentifier` value in a loop. Closes hashicorp#732 And part of hashicorp#823

github-actions · 2023-02-18T02:14:07Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

manicminer added enhancement feature/service-principals new-resource labels Feb 9, 2022

dhohengassner added a commit to o11n/hamilton that referenced this issue Feb 10, 2022

✨ add AddTokenSigningCertificate method

d19d169

This commit adds support to create the certificiate for Azure AD signed certs. Issue: hashicorp/terraform-provider-azuread#732

dhohengassner added a commit to o11n/hamilton that referenced this issue Feb 14, 2022

✨ add AddTokenSigningCertificate method

5736772

This commit adds support to create the certificiate for Azure AD signed certs. Issue: hashicorp/terraform-provider-azuread#732

dhohengassner mentioned this issue Feb 15, 2022

✨ add servicePrincipal methods AddTokenSigningCertificate and SetPref… manicminer/hamilton#151

Closed

This was referenced Feb 17, 2022

✨ add support for token signing certificate #740

Closed

✨ add support for token signing certificate #741

Draft

manicminer mentioned this issue Apr 14, 2022

Service Principal: Support token signing certificates manicminer/hamilton#158

Merged

This comment was marked as off-topic.

Sign in to view

matt-tyler mentioned this issue Nov 28, 2022

Create a SSO SAML Signing Certificate #823

Open

tagur87 mentioned this issue Jan 10, 2023

Add token signing certificate resource #968

Merged

manicminer closed this as completed in #968 Jan 18, 2023

github-actions bot locked as resolved and limited conversation to collaborators Feb 18, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add azuread_service_principal_token_signing_certificate to simplify certificate management #732

Add azuread_service_principal_token_signing_certificate to simplify certificate management #732

dhohengassner commented Feb 8, 2022 •

edited

Loading

manicminer commented Feb 9, 2022

dhohengassner commented Feb 9, 2022 •

edited

Loading

dhohengassner commented Feb 15, 2022

dhohengassner commented Feb 16, 2022

manicminer commented Feb 17, 2022

dhohengassner commented Feb 17, 2022

This comment was marked as off-topic.

github-actions bot commented Feb 18, 2023

Add azuread_service_principal_token_signing_certificate to simplify certificate management #732

Add azuread_service_principal_token_signing_certificate to simplify certificate management #732

Comments

dhohengassner commented Feb 8, 2022 • edited Loading

Community Note

Description

New or Affected Resource(s)

References

manicminer commented Feb 9, 2022

dhohengassner commented Feb 9, 2022 • edited Loading

dhohengassner commented Feb 15, 2022

dhohengassner commented Feb 16, 2022

manicminer commented Feb 17, 2022

dhohengassner commented Feb 17, 2022

This comment was marked as off-topic.

github-actions bot commented Feb 18, 2023

dhohengassner commented Feb 8, 2022 •

edited

Loading

dhohengassner commented Feb 9, 2022 •

edited

Loading