azure-samples / aad-dotnet-manage-service-principals

Getting started on managing service principals using C#

page_type	languages	products	extensions
sample	csharp	azure	services platforms Graph-Rbac dotnet

Getting started on managing service principals using C#

Azure Service Principal sample for managing Service Principal -

• Create an Active Directory application
• Create a Service Principal for the application and assign a role
• Export the Service Principal to an authentication file
• Use the file to list subcription virtual machines
• Update the application
• Update the service principal to revoke the password credential and the role
• Delete the Service Principal.

Running this Sample

To run this sample:

Set the environment variable AZURE_AUTH_LOCATION with the full path for an auth file. See how to create an auth file.

git clone https://github.com/Azure-Samples/aad-dotnet-manage-service-principals.git

cd aad-dotnet-manage-service-principals

dotnet build

bin\Debug\net452\ManageServicePrincipal.exe

More information

Azure Management Libraries for C# Azure .Net Developer Center If you don't have a Microsoft Azure subscription you can get a FREE trial account here

---

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

aad-dotnet-manage-service-principals's Issues

Getting a forbiden when trying to update SPI key

Hey,

When trying to update SPI with new key I get an exception telling me that its forbidden, but the SPI I am using is owner of the APP I am trying to update. I have tried using PS to update key with success (see code below). But when I try to update (under same AAD context using dotnet i get an exception :-(. Also I can update the APP key if I use the SPI that originally created the APP, but not with another SPI that has owner rights on exact same app.

.NET
var aadServicePrincipal = await servicePrincipal .Update() .DefinePasswordCredential("secret") .WithPasswordValue(password) .WithDuration(TimeSpan.FromHours(1)) .Attach() .ApplyAsync(); return aadServicePrincipal;

PS code
`$TenantId = "xxxxxx"
$ApplicationId = "xxxxx"
$ServicePrincipalKey = "xxx"
$ApplicationObjectIdNeedsKey = "xxxx"

Add-Type -AssemblyName System.Web
$clientKeyURLEncoded = [System.Web.HttpUtility]::UrlEncode($ServicePrincipalKey)
$tokenrequest = "grant_type=client_credentials&client_id=$ApplicationId&client_secret=$clientKeyURLEncoded&resource=https://graph.windows.net"
$authResult = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$TenantId/oauth2/token" -Body $tokenrequest

Write-Information "Login to AzureAD with same SP: $ApplicationId"
Connect-AzureAD -AadAccessToken $authResult.access_token -AccountId $ApplicationId -TenantId $TenantId

$startDate = Get-Date
$endDate = $startDate.AddYears($script:yearsOfExpiration)
$aadAppKeyPwd = New-AzureADApplicationPasswordCredential -ObjectId $ApplicationObjectIdNeedsKey -CustomKeyIdentifier "xallm3.test" -StartDate $startDate -EndDate $endDate

$aadAppKeyPwd`

Getting error as TSL 1.0/1.1 Deprecated

I am trying to execute the solution. Getting below error:

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: AADSTS1002016: You are using TLS version 1.0, 1.1 and/or 3DES cipher which is deprecated to improve the security posture of Azure AD.

How do we mitigate this issue? Is there any other implementation that addresses this?

The link to the auth file is broken

https://github.com/Azure/azure-sdk-for-net/blob/Fluent/AUTH.md

Insufficient privileges to complete the operation

Hi,

Getting the below errors while run the sample code (Use Auth file)
{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."},"requestId":"99436c5d-f1c8-4728-8ce7-a52e6d78aa83","date":"2019-09-03T05:48:51"}}

Call stack:
at Microsoft.Azure.Management.Graph.RBAC.Fluent.ApplicationsOperations.d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult() at Microsoft.Azure.Management.Graph.RBAC.Fluent.ApplicationsOperationsExtensions.<CreateAsync>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult()
at Microsoft.Azure.Management.Graph.RBAC.Fluent.ActiveDirectoryApplicationImpl.d__25.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Microsoft.Azure.Management.ResourceManager.Fluent.Core.ResourceActions.Creatable4.<Microsoft-Azure-Management-ResourceManager-Fluent-Core-ResourceActions-IResourceCreator-CreateResourceAsync>d__15.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter1.GetResult() at Microsoft.Azure.Management.ResourceManager.Fluent.Core.DAG.CreatorTaskItem1.d__6.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at Microsoft.Azure.Management.ResourceManager.Fluent.Core.DAG.TaskGroupBase1.<ExecuteNodeTaskAsync>d__14.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter1.GetResult()
at Microsoft.Azure.Management.ResourceManager.Fluent.Core.Extensions.Synchronize[TResult](Func1 function) at Microsoft.Azure.Management.ResourceManager.Fluent.Core.ResourceActions.Creatable4.Create()
at ManageServicePrincipal.Program.CreateActiveDirectoryApplication(IAuthenticated authenticated)
at ManageServicePrincipal.Program.RunSample(IAuthenticated authenticated)