122 lines
3.9 KiB
HCL
122 lines
3.9 KiB
HCL
data "azuread_client_config" "current" {}
|
|
|
|
data "azuread_application_published_app_ids" "well_known" {}
|
|
|
|
resource "random_uuid" "oauth2_permission_scope_uuid" {}
|
|
|
|
resource "random_uuid" "read_app_role_uuid" {}
|
|
|
|
resource "random_uuid" "write_app_role_uuid" {}
|
|
|
|
resource "azuread_application" "app_registration" {
|
|
display_name = var.app_reg_name
|
|
owners = [data.azuread_client_config.current.object_id]
|
|
sign_in_audience = "AzureADMyOrg"
|
|
|
|
api {
|
|
requested_access_token_version = 2
|
|
|
|
dynamic "oauth2_permission_scope" {
|
|
for_each = var.oauth2_permission_scopes != null ? var.oauth2_permission_scopes : []
|
|
|
|
content {
|
|
admin_consent_description = oauth2_permission_scope.value.admin_consent_description
|
|
admin_consent_display_name = oauth2_permission_scope.value.admin_consent_display_name
|
|
enabled = oauth2_permission_scope.value.enabled
|
|
id = oauth2_permission_scope.value.id
|
|
type = oauth2_permission_scope.value.type
|
|
user_consent_description = oauth2_permission_scope.value.user_consent_description
|
|
user_consent_display_name = oauth2_perimission_scope.value.user_consent_display_name
|
|
value = oauth2_perimission_scope.value.value
|
|
}
|
|
}
|
|
}
|
|
|
|
dynamic "app_role" {
|
|
for_each = var.app_roles != null ? var.app_roles : []
|
|
|
|
content {
|
|
allowed_member_types = app_role.value.allowed_member_types
|
|
description = app_role.value.description
|
|
display_name = app_role.value.display_name
|
|
enabled = app_role.value.enabled
|
|
id = app_role.value.id
|
|
value = app_role.value.value
|
|
}
|
|
}
|
|
|
|
required_resource_access {
|
|
resource_app_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
|
|
|
|
resource_access {
|
|
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # email
|
|
type = "Scope"
|
|
}
|
|
|
|
resource_access {
|
|
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # openid
|
|
type = "Scope"
|
|
}
|
|
|
|
resource_access {
|
|
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # profile
|
|
type = "Scope"
|
|
}
|
|
|
|
resource_access {
|
|
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" # User.Read
|
|
type = "Role"
|
|
}
|
|
|
|
dynamic "resource_access" {
|
|
for_each = var.additional_resource_access != null ? var.additional_resource_access : []
|
|
|
|
content {
|
|
id = resource_access.value.id
|
|
type = resource_access.value.type
|
|
}
|
|
}
|
|
}
|
|
|
|
single_page_application {
|
|
redirect_uris = var.redirect_uris != null ? var.redirect_uris : []
|
|
}
|
|
|
|
web {
|
|
implicit_grant {
|
|
access_token_issuance_enabled = var.access_token_issuance_enabled != null ? var.access_token_issuance_enabled : false
|
|
id_token_issuance_enabled = var.id_token_issuance_enabled != null ? var.id_token_issuance_enabled : false
|
|
}
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [
|
|
identifier_uris, password
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "azuread_application_identifier_uri" "app_registration_identifier_uri" {
|
|
count = var.enable_identifier_uri != null ? 1 : 0
|
|
application_id = azuread_application.app_registration.id
|
|
identifier_uri = "api://${azuread_application.app_registration.client_id}"
|
|
}
|
|
|
|
resource "azuread_application_federated_identity_credential" "github_actions_federated_identity_credential" {
|
|
count = var.federated_identity_credential != null ? 1 : 0
|
|
application_id = azuread_application.app_registration.id
|
|
display_name = var.federated_identity_credential.display_name
|
|
description = var.federated_identity_credential.description
|
|
audiences = var.federated_identity_credential.audiences
|
|
issuer = var.federated_identity_credential.issuer
|
|
subject = var.federated_identity_credential.subject
|
|
}
|
|
|
|
resource "azuread_application_password" "app_registration_secret" {
|
|
count = var.secret != null ? 1 : 0
|
|
application_id = azuread_application.app_registration.id
|
|
display_name = var.secret.display_name
|
|
end_date = var.secret.end_date != null ? var.secret.end_date : null
|
|
}
|
|
|