Add create and delete scripts creating Public Client Application (Remove unused JavaScript version).

2026-03-06 14:51:23 +01:00
parent 3b37b26571
commit a53d2896b1
3 changed files with 183 additions and 256 deletions
--- a/scripts/create-pca.sh
+++ b/scripts/create-pca.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+
+set -uo pipefail
+
+usage() {
+    cat <<EOF
+Usage: $(basename "$0") [options] <app-name>
+Options:
+  -c, --config <path>    Write JSON config to file (optional)
+  -h, --help             Show this help message and exit
+EOF
+}
+
+CONFIG_PATH=""
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -c|--config)
+            if [[ $# -le 0 ]]; then
+                echo "Error: Missing value for --config" >&2
+                exit 1
+            fi
+            CONFIG_PATH="$2"
+            shift 2
+            ;;
+        -*)
+            echo "Error: Unknown option: $1" >&2
+            exit 1
+            ;;
+        *)
+            break
+            ;;
+    esac
+done
+
+APP_NAME="${1:-}"
+if [[ -z "$APP_NAME" ]]; then
+    echo "Error: Application name is required." >&2
+    usage >&2
+    exit 1
+fi
+
+APP_ID="$(az ad app list --display-name "$APP_NAME" | jq -r '[.[].appId] | join(",")')"
+if [[ "$APP_ID" =~ "," ]]; then
+    echo "Error: The application name '$APP_NAME' is not unique." >&2
+    exit 1
+fi
+
+if [[ -z "$APP_ID" ]]; then
+    APP_ID="$(az ad app create --display-name "$APP_NAME" --query appId -o tsv)"
+    if [[ -z "$APP_ID" ]]; then
+        echo "Error: Failed to create application '$APP_NAME'." >&2
+        exit 1
+    fi
+    echo "Created application '$APP_NAME' with appId '$APP_ID'."
+else
+    printf "Application '%s' already exists. Update it? [y/N]: " "$APP_NAME" >&2
+    read -r ANSWER
+    if [[ ! "$ANSWER" =~ ^[Yy]([Ee][Ss])*$ ]]; then
+        echo "Canceled." >&2
+        exit 0
+    fi
+fi
+
+RESOURCE_ACCESS='[
+  {
+    "resourceAppId": "00000003-0000-0000-c000-000000000000",
+    "resourceAccess": [
+      { "id": "0e263e50-5827-48a4-b97c-d940288653c7", "type": "Scope" }
+    ]
+  },
+  {
+    "resourceAppId": "499b84ac-1321-427f-aa17-267ca6975798",
+    "resourceAccess": [
+      { "id": "ee69721e-6c3a-468f-a9ec-302d16a4c599", "type": "Scope" }
+    ]
+  },
+  {
+    "resourceAppId": "797f4846-ba00-4fd7-ba43-dac1f8f63013",
+    "resourceAccess": [
+      { "id": "41094075-9dad-400e-a0bd-54e686782033", "type": "Scope" }
+    ]
+  }
+]'
+
+if ! az ad app update \
+    --id "$APP_ID" \
+    --sign-in-audience AzureADMyOrg \
+    --is-fallback-public-client true \
+    --required-resource-accesses "$RESOURCE_ACCESS" \
+    --public-client-redirect-uris http://localhost "msal${APP_ID}://auth" \
+    --enable-access-token-issuance true \
+    --enable-id-token-issuance true \
+    >/dev/null 2>&1; then
+    echo "Error: Failed to configure application '$APP_NAME' ($APP_ID)." >&2
+    exit 1
+fi
+
+SP_ID="$(az ad sp show --id "$APP_ID" --query id -o tsv)"
+if [[ -z "$SP_ID" ]]; then
+    SP_ID="$(az ad sp create --id "$APP_ID" --query id -o tsv)"
+    if [[ -z "$SP_ID" ]]; then
+        echo "Error: Failed to create service principal for application '$APP_NAME' ($APP_ID)." >&2
+        exit 1
+    fi
+else
+    echo "Service principal for application '$APP_NAME' already exists with id '$SP_ID'."
+fi
+
+az ad app permission admin-consent --id "$APP_ID"
+if [[ $? -ne 0 ]]; then
+    echo "Error: Failed to grant admin consent for application '$APP_NAME' ($APP_ID)." >&2
+    exit 1
+fi
+
+TENANT_ID="$(az account show --query tenantId -o tsv)"
+if [[ -z "$TENANT_ID" ]]; then
+    echo "Error: Failed to resolve tenantId from current Azure CLI context." >&2
+    exit 1
+fi
+
+CONFIG="{
+  \"tenantId\": \"$TENANT_ID\",
+  \"clientId\": \"$APP_ID\"
+}
+"
+
+if [[ -n "$CONFIG_PATH" ]]; then
+    mkdir -p "$(dirname "$CONFIG_PATH")"
+else
+    CONFIG_PATH="/dev/null"
+fi
+
+echo "$CONFIG" | tee "$CONFIG_PATH"