Azure-docs: az cli commands to create server application and client application

[haodeon]

Hi,

Could the documentation please be updated with the correct az cli commands to create the server application and client application.

The steps I have figured out so far are

1. az ad sp create-for-rbac -n "server-application" --skip-assignment

2. Make note of appid and secret

3. az ad app update --id "server-application-appid" --set groupMembershipClaims=All allowPublicClient=false --reply-urls "http://server-application" --required-resource-accesses @server-manifest.json

server-manifest.json contains definitions for resourceAccess and resourceAppId

I'm not entirely sure how to create the native-app app registration, it keeps complaining about indentifier-uris being incorrect when include --available-to-other-tenants, which I'm not even sure is needed but creating it through the portal creates one with this property.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: a47c6df7-5103-1336-eb0b-68f95155e6c8
• Version Independent ID: f4420b08-9b57-f581-fcb4-f069afdd5b0c
• Content: Integrate Azure Active Directory with Azure Kubernetes Service
• Content Source: articles/aks/aad-integration.md
• Service: container-service
• GitHub Login: @iainfoulds
• Microsoft Alias: iainfou

[jakaruna-MSFT]

Thanks for the feedback! We are currently investigating and will update you shortly.

[jakaruna-MSFT]

I am assigning the issue to the content author to investigate further and update the document as appropriate.

[jakaruna-MSFT]

@iainfoulds Please take a look at this issue.

[cwoolum]

Here are the commands I used. There does seem to be a bug with the CLI though on version 2.0.54 and I'm unable to run either of the grant commands. It's easy enough to just go to the portal and grant manually in the meantime though.

serverApplicationSecret="$(openssl rand -base64 30)"
serverApplicationId="$(az ad app create --display-name AKSAADServer --identifier-uris "https://AKSAADServer" --end-date "2050-1-1" --password $serverApplicationSecret --query appId -o tsv)"
az ad app update --id $serverApplicationId --set groupMembershipClaims=All
az ad app permission add --id $serverApplicationId --api 00000003-0000-0000-c000-000000000000 --api-permissions e1fe6dd8-ba31-4d61-89e7-88639da4683d=Scope 06da0dbc-49e2-44d2-8312-53f166ab848a=Scope 7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role
az ad app permission grant --id $serverApplicationId --api 00000003-0000-0000-c000-000000000000 --subscription $tenantId

oAuthPermissionId="$(az ad app show --id $serverApplicationId --query "oauth2Permissions[0].id" -o tsv)"
clientApplicationId="$(az ad app create --display-name AKSAADClient --native-app --reply-urls https://AKSAADClient --query appId -o tsv)"
az ad app permission add --id $clientApplicationId --api $serverApplicationId --api-permissions $oAuthPermissionId=Scope

I can submit a PR but I'd like to figure out why the grant fails first.

[feniix]

@cwoolum have you been able to figure out why the grant fails?

[iainfoulds]

Sorry for the delay on this one. We actually published a doc a few weeks that outlines how to use the Azure CLI to create an Azure AD-enabled cluster - https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration-cli

There was an issue in the Azure CLI in how it was granting permissions. That was resolved a few releases ago, so make sure you're running the latest Azure CLI.

please-close

[AshokPeddakotla-MSFT]

@haodeon We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[paolosalvatori]

Hi Ian I personally tested the procedure in https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration-cli and it doesn't work. I was able to fix the problem just setting the following values in the manifest of both the client and server applications:

I was able to fix this issue with Azure AD v2 application by setting the following in the client manifest:

"allowPublicClient": true,
"oauth2AllowIdTokenImplicitFlow": true,
"signInAudience": "AzureADMultipleOrgs",

I'm investigating how to set the allowPublicClient property as it looks like that the following command doesn't work:
az ad app update \
--id $aksServerApplicationAppId \
--set allowPublicClient=true

[haodeon]

@paolosalvatori You've already found my other issue, which I opened when I encountered problems with "allowPublicClient=true".

But for those who are new to this issue I am referencing it here to help. Azure/azure-cli#7955