Terraform-provider-azurerm: Support for azurerm_virtual_network_gateway Azure AD authentication properties

[BjBe]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Please add support for the following properties to be configured via terraform resource azurerm_virtual_network_gateway

AadTenantUri
AadAudienceId
AadIssuerUri

New or Affected Resource(s)

• azurerm_virtual_network_gateway

Potential Terraform Configuration

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.

References

More information directly from Microsoft
https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant#enable-authentication

Powershell equivalent to set the properties for the VPN gateway.

Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw -AadTenantUri "https://login.microsoftonline.com/<your Directory ID>" -AadAudienceId "41b23e61-6c1e-4545-b367-cd054e0ed4b4" -AadIssuerUri "https://sts.windows.net/<your Directory ID>/"

• #0000

[juanswan13]

Potential Terraform Configuration

resource "azurerm_virtual_network_gateway" "example" {
  name                = "test"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  type     = "Vpn"
  vpn_type = "RouteBased"

  active_active = false
  enable_bgp    = false
  sku           = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.example.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.example.id
  }

  vpn_client_configuration {
    address_space = ["10.2.0.0/24"]
    tenant_uri = "https://login.microsoftonline.com/<your Directory ID>"
    audience_id = "41b23e61-6c1e-4545-b367-cd054e0ed4b4"
    aad_issuer_uri = "https://sts.windows.net/<your Directory ID>/"
  }
} 

The Tenant Uri must be specified completely since for gov cloud it's a different one, the same happens with the audience_id.

[aka6an]

Could also simply be:

• tenant
• audience
• issuer

And would probably need:

• vpn_authentication_types = ["AAD"]

Looks like this is already supported in Virtual WAN scenarios
https://www.terraform.io/docs/providers/azurerm/r/vpn_server_configuration.html

[hashibot[bot]]

This has been released in version 2.27.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.27.0"
}
# ... other configuration ...

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!