3 WIKI
="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS"
5 ######## Public functions #####################
7 # Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
8 # Used to add txt record
10 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/createorupdate
17 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
18 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
19 AZUREDNS_SUBSCRIPTIONID
=""
22 AZUREDNS_CLIENTSECRET
=""
23 _err
"You didn't specify the Azure Subscription ID"
26 #save subscription id to account conf file.
27 _saveaccountconf_mutable AZUREDNS_SUBSCRIPTIONID
"$AZUREDNS_SUBSCRIPTIONID"
29 AZUREDNS_MANAGEDIDENTITY
="${AZUREDNS_MANAGEDIDENTITY:-$(_readaccountconf_mutable AZUREDNS_MANAGEDIDENTITY)}"
30 if [ "$AZUREDNS_MANAGEDIDENTITY" = true
]; then
31 _info
"Using Azure managed identity"
32 #save managed identity as preferred authentication method, clear service principal credentials from conf file.
33 _saveaccountconf_mutable AZUREDNS_MANAGEDIDENTITY
"$AZUREDNS_MANAGEDIDENTITY"
34 _saveaccountconf_mutable AZUREDNS_TENANTID
""
35 _saveaccountconf_mutable AZUREDNS_APPID
""
36 _saveaccountconf_mutable AZUREDNS_CLIENTSECRET
""
38 _info
"You didn't ask to use Azure managed identity, checking service principal credentials"
39 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
40 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
41 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
43 if [ -z "$AZUREDNS_TENANTID" ]; then
44 AZUREDNS_SUBSCRIPTIONID
=""
47 AZUREDNS_CLIENTSECRET
=""
48 _err
"You didn't specify the Azure Tenant ID "
52 if [ -z "$AZUREDNS_APPID" ]; then
53 AZUREDNS_SUBSCRIPTIONID
=""
56 AZUREDNS_CLIENTSECRET
=""
57 _err
"You didn't specify the Azure App ID"
61 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
62 AZUREDNS_SUBSCRIPTIONID
=""
65 AZUREDNS_CLIENTSECRET
=""
66 _err
"You didn't specify the Azure Client Secret"
70 #save account details to account conf file, don't opt in for azure manages identity check.
71 _saveaccountconf_mutable AZUREDNS_MANAGEDIDENTITY
"false"
72 _saveaccountconf_mutable AZUREDNS_TENANTID
"$AZUREDNS_TENANTID"
73 _saveaccountconf_mutable AZUREDNS_APPID
"$AZUREDNS_APPID"
74 _saveaccountconf_mutable AZUREDNS_CLIENTSECRET
"$AZUREDNS_CLIENTSECRET"
77 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
79 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
83 _debug _domain_id
"$_domain_id"
84 _debug _sub_domain
"$_sub_domain"
85 _debug _domain
"$_domain"
87 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
88 _debug
"$acmeRecordURI"
89 # Get existing TXT record
90 _azure_rest GET
"$acmeRecordURI" "" "$accesstoken"
91 values
="{\"value\":[\"$txtvalue\"]}"
93 if [ "$_code" = "200" ]; then
94 vlist
="$(echo "$response" | _egrep_o "\"value
\"\\s
*:\\s
*\\[\\s
*\"[^
\"]*\"\\s
*]" | cut -d : -f 2 | tr -d "[]\"")"
95 _debug
"existing TXT found"
97 existingts
="$(echo "$response" | _egrep_o "\"acmetscheck
\"\\s
*:\\s
*\"[^
\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")"
98 if [ -z "$existingts" ]; then
99 # the record was not created by acme.sh. Copy the exisiting entires
100 existingts
=$timestamp
102 _diff
="$(_math "$timestamp - $existingts")"
103 _debug
"existing txt age: $_diff"
104 # only use recently added records and discard if older than 2 hours because they are probably orphaned
105 if [ "$_diff" -lt 7200 ]; then
106 _debug
"existing txt value: $vlist"
108 values
="$values ,{\"value\":[\"$v\"]}"
112 # Add the txtvalue TXT Record
113 body
="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
114 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
115 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
116 _info
"validation value added"
119 _err
"error adding validation value ($_code)"
124 # Usage: fulldomain txtvalue
125 # Used to remove the txt record after validation
127 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/delete
133 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
134 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
135 AZUREDNS_SUBSCRIPTIONID
=""
138 AZUREDNS_CLIENTSECRET
=""
139 _err
"You didn't specify the Azure Subscription ID "
143 AZUREDNS_MANAGEDIDENTITY
="${AZUREDNS_MANAGEDIDENTITY:-$(_readaccountconf_mutable AZUREDNS_MANAGEDIDENTITY)}"
144 if [ "$AZUREDNS_MANAGEDIDENTITY" = true
]; then
145 _info
"Using Azure managed identity"
147 _info
"You didn't ask to use Azure managed identity, checking service principal credentials"
148 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
149 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
150 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
152 if [ -z "$AZUREDNS_TENANTID" ]; then
153 AZUREDNS_SUBSCRIPTIONID
=""
156 AZUREDNS_CLIENTSECRET
=""
157 _err
"You didn't specify the Azure Tenant ID "
161 if [ -z "$AZUREDNS_APPID" ]; then
162 AZUREDNS_SUBSCRIPTIONID
=""
165 AZUREDNS_CLIENTSECRET
=""
166 _err
"You didn't specify the Azure App ID"
170 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
171 AZUREDNS_SUBSCRIPTIONID
=""
174 AZUREDNS_CLIENTSECRET
=""
175 _err
"You didn't specify the Azure Client Secret"
180 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
182 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
183 _err
"invalid domain"
186 _debug _domain_id
"$_domain_id"
187 _debug _sub_domain
"$_sub_domain"
188 _debug _domain
"$_domain"
190 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
191 _debug
"$acmeRecordURI"
192 # Get existing TXT record
193 _azure_rest GET
"$acmeRecordURI" "" "$accesstoken"
195 if [ "$_code" = "200" ]; then
196 vlist
="$(echo "$response" | _egrep_o "\"value
\"\\s
*:\\s
*\\[\\s
*\"[^
\"]*\"\\s
*]" | cut -d : -f 2 | tr -d "[]\"" | grep -v -- "$txtvalue")"
200 values
="$values$comma{\"value\":[\"$v\"]}"
203 if [ -z "$values" ]; then
204 # No values left remove record
205 _debug
"removing validation record completely $acmeRecordURI"
206 _azure_rest DELETE
"$acmeRecordURI" "" "$accesstoken"
207 if [ "$_code" = "200" ] ||
[ "$_code" = '204' ]; then
208 _info
"validation record removed"
210 _err
"error removing validation record ($_code)"
214 # Remove only txtvalue from the TXT Record
215 body
="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
216 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
217 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
218 _info
"validation value removed"
221 _err
"error removing validation value ($_code)"
228 ################### Private functions below ##################################
236 MAX_REQUEST_RETRY_TIMES
=5
237 _request_retry_times
=0
238 while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
239 _debug3 _request_retry_times
"$_request_retry_times"
240 export _H1
="authorization: Bearer $accesstoken"
241 export _H2
="accept: application/json"
242 export _H3
="Content-Type: application/json"
243 # clear headers from previous request to avoid getting wrong http code on timeouts
246 if [ "$m" != "GET" ]; then
247 _secure_debug2
"data $data"
248 response
="$(_post "$data" "$ep" "" "$m")"
250 response
="$(_get "$ep")"
253 _secure_debug2
"response $response"
254 _code
="$(grep "^HTTP
" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r
\\n
")"
255 _debug
"http response code $_code"
256 if [ "$_code" = "401" ]; then
257 # we have an invalid access token set to expired
258 _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO
"0"
259 _err
"access denied make sure your Azure settings are correct. See $WIKI"
262 # See https://docs.microsoft.com/en-us/azure/architecture/best-practices/retry-service-specific#general-rest-and-retry-guidelines for retryable HTTP codes
263 if [ "$_ret" != "0" ] ||
[ -z "$_code" ] ||
[ "$_code" = "408" ] ||
[ "$_code" = "500" ] ||
[ "$_code" = "503" ] ||
[ "$_code" = "504" ]; then
264 _request_retry_times
="$(_math "$_request_retry_times" + 1)"
265 _info
"REST call error $_code retrying $ep in $_request_retry_times s"
266 _sleep
"$_request_retry_times"
271 if [ "$_request_retry_times" = "$MAX_REQUEST_RETRY_TIMES" ]; then
272 _err
"Error Azure REST called was retried $MAX_REQUEST_RETRY_TIMES times."
273 _err
"Calling $ep failed."
276 response
="$(echo "$response" | _normalizeJson)"
280 ## Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service#request-an-access-token
281 _azure_getaccess_token
() {
287 accesstoken
="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
288 expires_on
="${AZUREDNS_TOKENVALIDTO:-$(_readaccountconf_mutable AZUREDNS_TOKENVALIDTO)}"
290 # can we reuse the bearer token?
291 if [ -n "$accesstoken" ] && [ -n "$expires_on" ]; then
292 if [ "$(_time)" -lt "$expires_on" ]; then
293 # brearer token is still valid - reuse it
294 _debug
"reusing bearer token"
295 printf "%s" "$accesstoken"
298 _debug
"bearer token expired"
301 _debug
"getting new bearer token"
303 if [ "$managedIdentity" = true
]; then
304 # https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http
305 export _H1
="Metadata: true"
306 response
="$(_get http://169.254.169.254/metadata/identity/oauth2/token\?api-version=2018-02-01\&resource=https://management.azure.com/)"
307 response
="$(echo "$response" | _normalizeJson)"
308 accesstoken
=$
(echo "$response" | _egrep_o
"\"access_token\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
309 expires_on
=$
(echo "$response" | _egrep_o
"\"expires_on\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
311 export _H1
="accept: application/json"
312 export _H2
="Content-Type: application/x-www-form-urlencoded"
313 body
="resource=$(printf "%s
" 'https://management.core.windows.net/' | _url_encode)&client_id=$(printf "%s
" "$clientID" | _url_encode)&client_secret=$(printf "%s
" "$clientSecret" | _url_encode)&grant_type=client_credentials"
314 _secure_debug2
"data $body"
315 response
="$(_post "$body" "https
://login.microsoftonline.com
/$tenantID/oauth
2/token
" "" "POST
")"
317 _secure_debug2
"response $response"
318 response
="$(echo "$response" | _normalizeJson)"
319 accesstoken
=$
(echo "$response" | _egrep_o
"\"access_token\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
320 expires_on
=$
(echo "$response" | _egrep_o
"\"expires_on\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
323 if [ -z "$accesstoken" ]; then
324 _err
"no acccess token received. Check your Azure settings see $WIKI"
327 if [ "$_ret" != "0" ]; then
328 _err
"error $response"
331 _saveaccountconf_mutable AZUREDNS_BEARERTOKEN
"$accesstoken"
332 _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO
"$expires_on"
333 printf "%s" "$accesstoken"
344 ## Ref: https://docs.microsoft.com/en-us/rest/api/dns/zones/list
345 ## returns up to 100 zones in one response therefore handling more results is not not implemented
346 ## (ZoneListResult with continuation token for the next page of results)
347 ## Per https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#dns-limits you are limited to 100 Zone/subscriptions anyways
349 _azure_rest GET
"https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?\$top=500&api-version=2017-09-01" "" "$accesstoken"
350 # Find matching domain name in Json response
352 h
=$
(printf "%s" "$domain" | cut
-d .
-f $i-100)
353 _debug2
"Checking domain: $h"
356 _err
"Invalid domain"
360 if _contains
"$response" "\"name\":\"$h\"" >/dev
/null
; then
361 _domain_id
=$
(echo "$response" | _egrep_o
"\\{\"id\":\"[^\"]*\\/$h\"" |
head -n 1 | cut
-d : -f 2 |
tr -d \")
362 if [ "$_domain_id" ]; then
363 if [ "$i" = 1 ]; then
364 #create the record at the domain apex (@) if only the domain name was provided as --domain-alias
367 _sub_domain
=$
(echo "$domain" | cut
-d .
-f 1-$p)