3 WIKI
="https://github.com/Neilpang/acme.sh/wiki/How-to-use-Azure-DNS"
5 ######## Public functions #####################
7 # Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
8 # Used to add txt record
10 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/createorupdate
16 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
17 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
18 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
19 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
21 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
22 AZUREDNS_SUBSCRIPTIONID
=""
25 AZUREDNS_CLIENTSECRET
=""
26 _err
"You didn't specify the Azure Subscription ID "
30 if [ -z "$AZUREDNS_TENANTID" ]; then
31 AZUREDNS_SUBSCRIPTIONID
=""
34 AZUREDNS_CLIENTSECRET
=""
35 _err
"You didn't specify the Azure Tenant ID "
39 if [ -z "$AZUREDNS_APPID" ]; then
40 AZUREDNS_SUBSCRIPTIONID
=""
43 AZUREDNS_CLIENTSECRET
=""
44 _err
"You didn't specify the Azure App ID"
48 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
49 AZUREDNS_SUBSCRIPTIONID
=""
52 AZUREDNS_CLIENTSECRET
=""
53 _err
"You didn't specify the Azure Client Secret"
56 #save account details to account conf file.
57 _saveaccountconf_mutable AZUREDNS_SUBSCRIPTIONID
"$AZUREDNS_SUBSCRIPTIONID"
58 _saveaccountconf_mutable AZUREDNS_TENANTID
"$AZUREDNS_TENANTID"
59 _saveaccountconf_mutable AZUREDNS_APPID
"$AZUREDNS_APPID"
60 _saveaccountconf_mutable AZUREDNS_CLIENTSECRET
"$AZUREDNS_CLIENTSECRET"
62 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
64 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
68 _debug _domain_id
"$_domain_id"
69 _debug _sub_domain
"$_sub_domain"
70 _debug _domain
"$_domain"
72 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
73 _debug
"$acmeRecordURI"
74 # Get existing TXT record
75 _azure_rest GET
"$acmeRecordURI" "" "$accesstoken"
76 values
="{\"value\":[\"$txtvalue\"]}"
78 if [ "$_code" = "200" ]; then
79 vlist
="$(echo "$response" | _egrep_o "\"value
\"\s
*:\s
*\
[\s
*\"[^
\"]*\"\s
*]" | cut -d : -f 2 | tr -d "[]\"")"
80 _debug
"existing TXT found"
82 existingts
="$(echo "$response" | _egrep_o "\"acmetscheck
\"\s
*:\s
*\"[^
\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")"
83 if [ -z "$existingts" ]; then
84 # the record was not created by acme.sh. Copy the exisiting entires
87 _diff
="$(_math "$timestamp - $existingts")"
88 _debug
"existing txt age: $_diff"
89 # only use recently added records and discard if older than 2 hours because they are probably orphaned
90 if [ "$_diff" -lt 7200 ]; then
91 _debug
"existing txt value: $vlist"
93 values
="$values ,{\"value\":[\"$v\"]}"
97 # Add the txtvalue TXT Record
98 body
="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
99 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
100 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
101 _info
"validation value added"
103 _err
"error adding validation value ($_code)"
108 # Usage: fulldomain txtvalue
109 # Used to remove the txt record after validation
111 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/delete
117 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
118 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
119 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
120 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
122 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
123 AZUREDNS_SUBSCRIPTIONID
=""
126 AZUREDNS_CLIENTSECRET
=""
127 _err
"You didn't specify the Azure Subscription ID "
131 if [ -z "$AZUREDNS_TENANTID" ]; then
132 AZUREDNS_SUBSCRIPTIONID
=""
135 AZUREDNS_CLIENTSECRET
=""
136 _err
"You didn't specify the Azure Tenant ID "
140 if [ -z "$AZUREDNS_APPID" ]; then
141 AZUREDNS_SUBSCRIPTIONID
=""
144 AZUREDNS_CLIENTSECRET
=""
145 _err
"You didn't specify the Azure App ID"
149 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
150 AZUREDNS_SUBSCRIPTIONID
=""
153 AZUREDNS_CLIENTSECRET
=""
154 _err
"You didn't specify the Azure Client Secret"
158 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
160 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
161 _err
"invalid domain"
164 _debug _domain_id
"$_domain_id"
165 _debug _sub_domain
"$_sub_domain"
166 _debug _domain
"$_domain"
168 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
169 _debug
"$acmeRecordURI"
170 # Get existing TXT record
171 _azure_rest GET
"$acmeRecordURI" "" "$accesstoken"
173 if [ "$_code" = "200" ]; then
174 vlist
="$(echo "$response" | _egrep_o "\"value
\"\s
*:\s
*\
[\s
*\"[^
\"]*\"\s
*]" | cut -d : -f 2 | tr -d "[]\"" | grep -v "$txtvalue")"
178 values
="$values$comma{\"value\":[\"$v\"]}"
181 if [ -z "$values" ]; then
182 # No values left remove record
183 _debug
"removing validation record completely $acmeRecordURI"
184 _azure_rest DELETE
"$acmeRecordURI" "" "$accesstoken"
185 if [ "$_code" = "200" ] ||
[ "$_code" = '204' ]; then
186 _info
"validation record removed"
188 _err
"error removing validation record ($_code)"
192 # Remove only txtvalue from the TXT Record
193 body
="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
194 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
195 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
196 _info
"validation value removed"
198 _err
"error removing validation value ($_code)"
205 ################### Private functions below ##################################
213 MAX_REQUEST_RETRY_TIMES
=5
214 _request_retry_times
=0
215 while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
216 _debug3 _request_retry_times
"$_request_retry_times"
217 export _H1
="authorization: Bearer $accesstoken"
218 export _H2
="accept: application/json"
219 export _H3
="Content-Type: application/json"
220 # clear headers from previous request to avoid getting wrong http code on timeouts
223 if [ "$m" != "GET" ]; then
224 _secure_debug2
"data $data"
225 response
="$(_post "$data" "$ep" "" "$m")"
227 response
="$(_get "$ep")"
229 _secure_debug2
"response $response"
230 _code
="$(grep "^HTTP
" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
231 _debug
"http response code $_code"
232 if [ "$_code" = "401" ]; then
233 # we have an invalid access token set to expired
234 _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO
"0"
235 _err
"access denied make sure your Azure settings are correct. See $WIKI"
238 # See https://docs.microsoft.com/en-us/azure/architecture/best-practices/retry-service-specific#general-rest-and-retry-guidelines for retryable HTTP codes
239 if [ "$?" != "0" ] ||
[ -z "$_code" ] ||
[ "$_code" = "408" ] ||
[ "$_code" = "500" ] ||
[ "$_code" = "503" ] ||
[ "$_code" = "504" ]; then
240 _request_retry_times
="$(_math "$_request_retry_times" + 1)"
241 _info
"REST call error $_code retrying $ep in $_request_retry_times s"
242 _sleep
"$_request_retry_times"
247 if [ "$_request_retry_times" = "$MAX_REQUEST_RETRY_TIMES" ]; then
248 _err
"Error Azure REST called was retried $MAX_REQUEST_RETRY_TIMES times."
249 _err
"Calling $ep failed."
252 response
="$(echo "$response" | _normalizeJson)"
256 ## Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service#request-an-access-token
257 _azure_getaccess_token
() {
262 accesstoken
="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
263 expires_on
="${AZUREDNS_TOKENVALIDTO:-$(_readaccountconf_mutable AZUREDNS_TOKENVALIDTO)}"
265 # can we reuse the bearer token?
266 if [ -n "$accesstoken" ] && [ -n "$expires_on" ]; then
267 if [ "$(_time)" -lt "$expires_on" ]; then
268 # brearer token is still valid - reuse it
269 _debug
"reusing bearer token"
270 printf "%s" "$accesstoken"
273 _debug
"bearer token expired"
276 _debug
"getting new bearer token"
278 export _H1
="accept: application/json"
279 export _H2
="Content-Type: application/x-www-form-urlencoded"
281 body
="resource=$(printf "%s
" 'https://management.core.windows.net/' | _url_encode)&client_id=$(printf "%s
" "$clientID" | _url_encode)&client_secret=$(printf "%s
" "$clientSecret" | _url_encode)&grant_type=client_credentials"
282 _secure_debug2
"data $body"
283 response
="$(_post "$body" "https
://login.microsoftonline.com
/$tenantID/oauth
2/token
" "" "POST
")"
284 _secure_debug2
"response $response"
285 response
="$(echo "$response" | _normalizeJson)"
286 accesstoken
=$
(echo "$response" | _egrep_o
"\"access_token\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
287 expires_on
=$
(echo "$response" | _egrep_o
"\"expires_on\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
289 if [ -z "$accesstoken" ]; then
290 _err
"no acccess token received. Check your Azure settings see $WIKI"
293 if [ "$?" != "0" ]; then
294 _err
"error $response"
297 _saveaccountconf_mutable AZUREDNS_BEARERTOKEN
"$accesstoken"
298 _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO
"$expires_on"
299 printf "%s" "$accesstoken"
310 ## Ref: https://docs.microsoft.com/en-us/rest/api/dns/zones/list
311 ## returns up to 100 zones in one response therefore handling more results is not not implemented
312 ## (ZoneListResult with continuation token for the next page of results)
313 ## Per https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#dns-limits you are limited to 100 Zone/subscriptions anyways
315 _azure_rest GET
"https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?api-version=2017-09-01" "" "$accesstoken"
316 # Find matching domain name is Json response
318 h
=$
(printf "%s" "$domain" | cut
-d .
-f $i-100)
319 _debug2
"Checking domain: $h"
322 _err
"Invalid domain"
326 if _contains
"$response" "\"name\":\"$h\"" >/dev
/null
; then
327 _domain_id
=$
(echo "$response" | _egrep_o
"\{\"id\":\"[^\"]*$h\"" |
head -n 1 | cut
-d : -f 2 |
tr -d \")
328 if [ "$_domain_id" ]; then
329 _sub_domain
=$
(printf "%s" "$domain" | cut
-d .
-f 1-$p)