How to create authentication (enterprise application) in terraform

[AppElent]

Hi,

i really like this project. I am working in terraform. I just want to add the function app authentication part to terraform as well, because if I add authentication after the deployment, terraform will recognize a difference and reset the function app.

In the code I saw that it is possible to add an auth_settings block.
Can you provide an example on how I create such an Enterprise application and which auth_settings to set?

BTW I am using regular Microsoft authentication.

[AppElent]

Sorry that I created an issue.

I am still working on this and did not succeed yet. It would be very valuable to have a terraform example with authentication so that terraform is actually useable. Now, it isnt useable because terraform would make auth undone when redeploying from state.

[AppElent]

One of the helpful links are:
https://stackoverflow.com/questions/57260721/turn-on-app-service-authentication-for-azure-active-directory-from-terraform-s

I am trying with that nnow

[AppElent]

Hi @shibayan , I am still working on this. I have a feeling that this IS an issue, instead of a discussion.
Workflow is: you create azure-acmebot with terraform. THEN you need to add authentication. THEN terraform sees a difference and deletes the authentication from the function app.

Can you please provide guidance on how to fix this? I think I am missing "client_secret_setting_name" from the auth_settings, because this one is set after the APP_REGISTRATION is connected to the function app.

[AppElent]

This is my current code. It creates:
resource group
keyvault
acmebot
app registration
service principal
client_secret
role assignments for acmebot to dns zone and to keyvault

// RG used as shared RG between environments
resource "azurerm_resource_group" "rg_acmebot" {
  location = var.location
  name     = "rg-appelent-acmebot"
}

resource "azurerm_key_vault" "acmebot_keyvault" {
  name                       = "kv-appelent-acmebot"
  location                   = azurerm_resource_group.rg_acmebot.location
  resource_group_name        = azurerm_resource_group.rg_acmebot.name
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days = 7
  purge_protection_enabled   = true

  sku_name                  = "standard"
  enable_rbac_authorization = true
}

module "keyvault_acmebot" {
  source  = "shibayan/keyvault-acmebot/azurerm"
  version = "~> 2.0"

  function_app_name     = "func-appelent-acmebot"
  app_service_plan_name = "asp-appelent-acmebot"
  storage_account_name  = "saappelentacmebot"
  app_insights_name     = "appi-appelent-acmebot"
  workspace_name        = "log-appelent-acmebot"
  resource_group_name   = azurerm_resource_group.rg_acmebot.name
  location              = azurerm_resource_group.rg_acmebot.location
  mail_address          = data.azuread_user.me.other_mails[0]
  vault_uri             = azurerm_key_vault.acmebot_keyvault.vault_uri

  azure_dns = {
    subscription_id = data.azurerm_client_config.current.subscription_id
  }

  app_settings = {
    "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" = azuread_service_principal_password.acmebot_secret.value
  }

  auth_settings = {
    enabled = true
    issuer  = "https://sts.windows.net/${data.azurerm_client_config.current.tenant_id}/v2.0"
    active_directory = {
      client_id         = azuread_application.acmebot_application.application_id
      allowed_audiences = ["api://${azuread_application.acmebot_application.application_id}"]
    }
    default_provider              = "AzureActiveDirectory"
    token_store_enabled           = true
    unauthenticated_client_action = "RedirectToLoginPage"
  }
}

resource "azuread_application" "acmebot_application" {
  display_name = "app-appelent-acmebot"

  web {
    redirect_uris = ["https://func-appelent-acmebot.azurewebsites.net/.auth/login/aad/callback"]

  }
}

resource "azuread_service_principal" "acmebot_service_principal" {
  application_id = azuread_application.acmebot_application.application_id
}

resource "azuread_service_principal_password" "acmebot_secret" {
  service_principal_id = azuread_service_principal.acmebot_service_principal.object_id
}

# resource "azuread_service_principal" "argocd" {
#   application_id                = azuread_application.acmebot_application.application_id
#   owners                        = azuread_application.acmebot_application.owners
#   preferred_single_sign_on_mode = "saml"
#   //login_url                     = "https://argocd.mysite.ca/auth/login"
#   feature_tags {
#     custom_single_sign_on = true
#   }
# }

resource "azurerm_role_assignment" "akv_acmebot_roleassignment" {
  scope                = azurerm_key_vault.acmebot_keyvault.id
  role_definition_name = "Key Vault Certificates Officer"
  principal_id         = module.keyvault_acmebot.principal_id
}

resource "azurerm_role_assignment" "dns_acmebot_roleassignment" {
  scope                = azurerm_dns_zone.appelent.id
  role_definition_name = "DNS Zone Contributor"
  principal_id         = module.keyvault_acmebot.principal_id
}

[AppElent]

and this is what terraform plan returns:

      ~ auth_settings {
            # (8 unchanged attributes hidden)

          ~ active_directory {
              ~ allowed_audiences          = [
                  - "api://a7265eb4-5a4e-4a1e-b30e-dc869d3f4b67",
                  + "api://8c2c4f19-1014-4d4f-b11e-9d97d802d4c5",
                ]
              ~ client_id                  = "a7265eb4-5a4e-4a1e-b30e-dc869d3f4b67" -> "8c2c4f19-1014-4d4f-b11e-9d97d802d4c5"
              - client_secret_setting_name = "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" -> null
            }
        }

      - sticky_settings {
          - app_setting_names       = [
              - "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET",
            ] -> null
          - connection_string_names = [] -> null
        }

        # (2 unchanged blocks hidden)

So, it looks like client_secret_setting_name is something that is missing? And also something regarding sticky settings

[DevSecNinja]

Thanks for that sample input @AppElent! You might want to add

    implicit_grant {
      access_token_issuance_enabled = false
      id_token_issuance_enabled     = true
    }

to your 'web' section in the resource "azuread_application" resource. Without that, it wouldn't let me authenticate.

[shibayan]

Close as I have already added AzureAD integration to the sample code.