Använd ditt GitHub-konto för att logga in på Azure

2024-01-10

Skapa en Microsoft Entra-app och tjänstens huvudnamn i portalen

- tilldela säkerhetsrollen till en app.
Kopiera prenumerations-ID:t.

Skapa en Microsoft Entra ID-app.
```
az ad app create --display-name myApp
```
Skapa ett huvudnamn för tjänsten.
```
 az ad sp create --id $appId
```

az role assignment create --role contributor --subscription $subscriptionId --assignee-object-id  $assigneeObjectId --assignee-principal-type ServicePrincipal --scope /subscriptions/$subscriptionId/resourceGroups/$resourceGroupName

Skapa en Microsoft Entra ID-app.
```
New-AzADApplication -DisplayName myApp
```

Skapa ett huvudnamn för tjänsten.

$clientId = (Get-AzADApplication -DisplayName myApp).AppId
New-AzADServicePrincipal -ApplicationId $clientId

Guide till att skapa en ny rolltilldelning

$objectId = (Get-AzADServicePrincipal -DisplayName myApp).Id
New-AzRoleAssignment -ObjectId $objectId -RoleDefinitionName Contributor -ResourceGroupName $resourceGroupName

$clientId = (Get-AzADApplication -DisplayName myApp).AppId
$subscriptionId = (Get-AzContext).Subscription.Id
$tenantId = (Get-AzContext).Subscription.TenantId

Fält	Description	Exempel
Organisation		`contoso`
Lagringsplats	GitHub-lagringsplatsnamn	`contoso-app`
Entitetstyp		`Environment`, `Branch`, `Pull request`, `Tag`
GitHub-namngivning		`main`
Name		`contoso-deploy`

- Exempel: repo:n-username/ node_express:ref:refs/heads/my-branch eller repo:n-username/ node_express:ref:refs/tags/my-tag.

az ad app federated-credential create --id <APPLICATION-OBJECT-ID> --parameters credential.json
("credential.json" contains the following content)
{
    "name": "<CREDENTIAL-NAME>",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:octo-org/octo-repo:environment:Production",
    "description": "Testing",
    "audiences": [
        "api://AzureADTokenExchange"
    ]
}

- Exempel: repo:n-username/ node_express:ref:refs/heads/my-branch eller repo:n-username/ node_express:ref:refs/tags/my-tag.

New-AzADAppFederatedCredential -ApplicationObjectId APPLICATION-OBJECT-ID -Audience api://AzureADTokenExchange -Issuer 'https://token.actions.githubusercontent.com/' -Name 'GitHub-Actions-Test' -Subject 'repo:octo-org/octo-repo:environment:Production'

GitHub-hemligheter Azure Active Directory-programmet

App-ID (klient-ID)

Katalog-ID (klientorganisation)

Prenumerations-ID:t

GitHub-hemligheter	Azure Active Directory-programmet
	App-ID (klient-ID)
	Katalog-ID (klientorganisation)
	Prenumerations-ID:t

Linux
Windows

name: Run Azure Login with OpenID Connect
on: [push]

permissions:
      id-token: write
      contents: read
      
jobs: 
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    - name: 'Az CLI login'
      uses: azure/login@v1
      with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
  
    - name: 'Run Azure CLI commands'
      run: |
          az account show
          az group list
          pwd

name: Run Azure Login with OpenID Connect and PowerShell
on: [push]

permissions:
  id-token: write
  contents: read
      
jobs: 
  Windows-latest:
    runs-on: windows-latest
    steps:
      - name: OIDC Login to Azure Public Cloud with AzPowershell (enableAzPSSession true)
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} 
          enable-AzPSSession: true

      - name: 'Get resource group with PowerShell action'
        uses: azure/powershell@v1
        with:
          inlineScript: |
            Get-AzResourceGroup
          azPSVersion: "latest"

Du bör se meddelandet Login successful.

GitHub Actions Azure Login successful.

Skapa ett huvudnamn för tjänsten

Kommentar

az cloud update -n {environmentName} --endpoint-sql-management https://notsupported

Skapa en Azure AD-app och tjänstens huvudnamn i portalen

    az ad sp create-for-rbac --name "myApp" --role contributor \
                                --scopes /subscriptions/{subscription-id}/resourceGroups/{resource-group} \
                                --json-auth

{
    "clientId": "<GUID>",
    "clientSecret": "<GUID>",
    "subscriptionId": "<GUID>",
    "tenantId": "<GUID>",
    (...)
}

Gå till GitHub-lagringsplatssidan.
I navigeringsmenyn går du till InställningarDetaljer.
Välj Add secret (Lägg till hemlighet).

on: [push]

name: AzureLoginSample

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Log in with Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'

on: [push]

name: AzureLoginSample

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Log in with Azure
        uses: azure/login@v1
        with:
          creds: '${{ secrets.AZURE_CREDENTIALS }}'
          enable-AzPSSession: true
      - name: Azure PowerShell Action
        uses: Azure/powershell@v1
        with:
          inlineScript: Get-AzResourceGroup -Name "< YOUR RESOURCE GROUP >"
          azPSVersion: "latest"

on: [push]

name: AzureLoginSample

jobs:
build-and-deploy:
  runs-on: ubuntu-latest
  steps:

    - name: Log in with Azure
      uses: azure/login@v1
      with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

    - name: Azure CLI script
      uses: azure/CLI@v1
      with:
          azcliversion: 2.0.72
          inlineScript: |
            az account show
            az storage -h

   - name: Login to Azure US Gov Cloud with CLI
     uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_US_GOV_CREDENTIALS }}
          environment: 'AzureUSGovernment'
          enable-AzPSSession: false
   - name: Login to Azure US Gov Cloud with Az Powershell
      uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_US_GOV_CREDENTIALS }}
          environment: 'AzureUSGovernment'
          enable-AzPSSession: true

Använda med andra Azure-tjänster

Microsoft Entra-ID

Power BI

Anslutningar

Vanliga frågor och svar rörande anpassade anslutningsprogram för Azure Logic Apps, Power Automate och Power Apps

Azure Databricks

Distribuera till Azure från GitHub

Feedback

Var den här sidan till hjälp?