0

我正在尝试创建一个将在 Azure AD 中注册应用程序的 terraform 脚本。

生成仅从 Microsoft Graph 范围读取的脚本时，我已经成功。但我无法弄清楚这些范围在 Business Central（云版本）中的等价物是什么。

对于 Microsoft Graph，我拥有以下权限：

  • 电子邮件
  • 离线访问
  • 打开ID
  • 轮廓
  • Financials.ReadWrite.All
  • 用户读

我在 terraform 中这样阅读它们：

provider "azuread" {
  # Whilst version is optional, we /strongly recommend/ using it to pin the version of the Provider being used
  version         = "~> 0.10"
  subscription_id = var.subscription_id
}

data "azuread_service_principal" "graph-api" {
  display_name = "Microsoft Graph"
}

locals {
  MAIL_PERMISSION                  = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("email"))[0]}"
  USER_READ_PERMISSION             = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("User.Read"))[0]}"
  FINANCIALS_READ_WRITE_PERMISSION = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("Financials.ReadWrite.All"))[0]}"
  OFFLINE_PERMISSION               = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("offline_access"))[0]}"
  OPENID_PERMISSION                = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("openid"))[0]}"
  PROFILE_PERMISSION               = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("profile"))[0]}"
}

这似乎工作正常。我只是在努力为Dynamics 365 Business Central找到类似的方法

我对这些感兴趣：

  • app_access
  • Financials.ReadWrite.All
  • user_impersonation

有人知道那个端点可能是什么样子吗？文档非常有限。

编辑：

这是有兴趣设置 Business Central 应用程序注册的任何人的最终脚本

variable "subscription_id" {
  type = string
}
variable "app_name" {
  type = string
}
variable "app_homepage" {
  type = string
}
variable "app_reply_urls" {
  type = list(string)
}

provider "azuread" {
  # Whilst version is optional, we /strongly recommend/ using it to pin the version of the Provider being used
  version         = "~> 0.10"
  subscription_id = var.subscription_id
}

data "azuread_service_principal" "graph-api" {
  display_name = "Microsoft Graph"
}

data "azuread_service_principal" "d365bc" {
  display_name = "Dynamics 365 Business Central"
}

locals {
  APP_ACCESS_PERMISSION                 = "${matchkeys(data.azuread_service_principal.d365bc.app_roles.*.id, data.azuread_service_principal.d365bc.app_roles.*.value, list("app_access"))[0]}"
  USER_IMPERSONATION_PERMISSION         = "${matchkeys(data.azuread_service_principal.d365bc.oauth2_permissions.*.id, data.azuread_service_principal.d365bc.oauth2_permissions.*.value, list("user_impersonation"))[0]}"
  BC_FINANCIALS_READ_WRITE_PERMISSION   = "${matchkeys(data.azuread_service_principal.d365bc.oauth2_permissions.*.id, data.azuread_service_principal.d365bc.oauth2_permissions.*.value, list("Financials.ReadWrite.All"))[0]}"
  GRAPH_FINANCIAL_READ_WRITE_PERMISSION = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("Financials.ReadWrite.All"))[0]}"
  MAIL_READ_PERMISSION                  = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("User.Read"))[0]}"
  MAIL_PERMISSION                       = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("email"))[0]}"
  OFFLINE_PERMISSION                    = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("offline_access"))[0]}"
  OPENID_PERMISSION                     = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("openid"))[0]}"
  PROFILE_PERMISSION                    = "${matchkeys(data.azuread_service_principal.graph-api.oauth2_permissions.*.id, data.azuread_service_principal.graph-api.oauth2_permissions.*.value, list("profile"))[0]}"
}

resource "azuread_application" "businessCentral" {
  name                       = var.app_name
  homepage                   = var.app_homepage
  identifier_uris            = []
  reply_urls                 = var.app_reply_urls
  available_to_other_tenants = true
  type                       = "webapp/api"

  required_resource_access {
    resource_app_id = data.azuread_service_principal.graph-api.application_id
    resource_access {
      id   = local.GRAPH_FINANCIAL_READ_WRITE_PERMISSION
      type = "Scope"
    }
    resource_access {
      id   = local.MAIL_PERMISSION
      type = "Scope"
    }
    resource_access {
      id   = local.MAIL_READ_PERMISSION
      type = "Scope"
    }
    resource_access {
      id   = local.OFFLINE_PERMISSION
      type = "Scope"
    }
    resource_access {
      id   = local.OPENID_PERMISSION
      type = "Scope"
    }
    resource_access {
      id   = local.PROFILE_PERMISSION
      type = "Scope"
    }
  }

  required_resource_access {
    resource_app_id = data.azuread_service_principal.d365bc.application_id
    resource_access {
      id   = local.APP_ACCESS_PERMISSION
      type = "Role"
    }
    resource_access {
      id   = local.USER_IMPERSONATION_PERMISSION
      type = "Scope"
    }
    resource_access {
      id   = local.BC_FINANCIALS_READ_WRITE_PERMISSION
      type = "Scope"
    }
  }

  app_role {
    allowed_member_types = [
      "Application"
    ]
    description  = "Admins can manage roles and perform all task actions"
    display_name = "Admin"
    is_enabled   = true
    value        = "Admin"
  }
}

需要注意的一件事是app_accessisRole和其余的 API 权限是Scope.

您可以使用以下命令调用上述 terraform：

terraform plan -var="subscription_id={your_scription_id}" -var='app_reply_urls={your_urls_array}' -var="app_name={your_app_name}" -var="app_homepage={your_app_homepage}"
4

1 回答 1

1

尝试这个：

provider "azuread" {
  # Whilst version is optional, we /strongly recommend/ using it to pin the version of the Provider being used
  version = "=0.10.0"
}

data "azuread_service_principal" "d365bc" {
  application_id = "996def3d-b36c-4153-8607-a6fd3c01b89f"
}

locals {
  APP_ACCESS_PERMISSION            = "${matchkeys(data.azuread_service_principal.d365bc.app_roles.*.id, data.azuread_service_principal.d365bc.app_roles.*.value, list("app_access"))[0]}"
  USER_IMPERSONATION_PERMISSION    = "${matchkeys(data.azuread_service_principal.d365bc.oauth2_permissions.*.id, data.azuread_service_principal.d365bc.oauth2_permissions.*.value, list("user_impersonation"))[0]}"
  FINANCIALS_READ_WRITE_PERMISSION = "${matchkeys(data.azuread_service_principal.d365bc.oauth2_permissions.*.id, data.azuread_service_principal.d365bc.oauth2_permissions.*.value, list("Financials.ReadWrite.All"))[0]}"
}

996def3d-b36c-4153-8607-a6fd3c01b89f是 Microsoft Dynamics 365 BC 服务主体的客户端 ID。

app_access是应用权限，所以我们需要在这里使用“app_roles”而不是“oauth2_permissions”。

于 2020-07-14T03:36:11.503 回答