3 ######## Public functions #####################
5 # Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
6 # Used to add txt record
8 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/createorupdate
14 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
15 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
16 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
17 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
19 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
20 AZUREDNS_SUBSCRIPTIONID
=""
23 AZUREDNS_CLIENTSECRET
=""
24 _err
"You didn't specify the Azure Subscription ID "
28 if [ -z "$AZUREDNS_TENANTID" ]; then
29 AZUREDNS_SUBSCRIPTIONID
=""
32 AZUREDNS_CLIENTSECRET
=""
33 _err
"You didn't specify the Azure Tenant ID "
37 if [ -z "$AZUREDNS_APPID" ]; then
38 AZUREDNS_SUBSCRIPTIONID
=""
41 AZUREDNS_CLIENTSECRET
=""
42 _err
"You didn't specify the Azure App ID"
46 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
47 AZUREDNS_SUBSCRIPTIONID
=""
50 AZUREDNS_CLIENTSECRET
=""
51 _err
"You didn't specify the Azure Client Secret"
54 #save account details to account conf file.
55 _saveaccountconf_mutable AZUREDNS_SUBSCRIPTIONID
"$AZUREDNS_SUBSCRIPTIONID"
56 _saveaccountconf_mutable AZUREDNS_TENANTID
"$AZUREDNS_TENANTID"
57 _saveaccountconf_mutable AZUREDNS_APPID
"$AZUREDNS_APPID"
58 _saveaccountconf_mutable AZUREDNS_CLIENTSECRET
"$AZUREDNS_CLIENTSECRET"
60 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
62 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
66 _debug _domain_id
"$_domain_id"
67 _debug _sub_domain
"$_sub_domain"
68 _debug _domain
"$_domain"
70 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
71 _debug
"$acmeRecordURI"
72 body
="{\"properties\": {\"TTL\": 3600, \"TXTRecords\": [{\"value\": [\"$txtvalue\"]}]}}"
73 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
74 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
75 _info
"validation record added"
77 _err
"error adding validation record ($_code)"
82 # Usage: fulldomain txtvalue
83 # Used to remove the txt record after validation
85 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/delete
91 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
92 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
93 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
94 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
96 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
97 AZUREDNS_SUBSCRIPTIONID
=""
100 AZUREDNS_CLIENTSECRET
=""
101 _err
"You didn't specify the Azure Subscription ID "
105 if [ -z "$AZUREDNS_TENANTID" ]; then
106 AZUREDNS_SUBSCRIPTIONID
=""
109 AZUREDNS_CLIENTSECRET
=""
110 _err
"You didn't specify the Azure Tenant ID "
114 if [ -z "$AZUREDNS_APPID" ]; then
115 AZUREDNS_SUBSCRIPTIONID
=""
118 AZUREDNS_CLIENTSECRET
=""
119 _err
"You didn't specify the Azure App ID"
123 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
124 AZUREDNS_SUBSCRIPTIONID
=""
127 AZUREDNS_CLIENTSECRET
=""
128 _err
"You didn't specify the Azure Client Secret"
132 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
134 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
135 _err
"invalid domain"
138 _debug _domain_id
"$_domain_id"
139 _debug _sub_domain
"$_sub_domain"
140 _debug _domain
"$_domain"
142 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
143 _debug
"$acmeRecordURI"
144 body
="{\"properties\": {\"TTL\": 3600, \"TXTRecords\": [{\"value\": [\"$txtvalue\"]}]}}"
145 _azure_rest DELETE
"$acmeRecordURI" "" "$accesstoken"
146 if [ "$_code" = "200" ] ||
[ "$_code" = '204' ]; then
147 _info
"validation record removed"
149 _err
"error removing validation record ($_code)"
154 ################### Private functions below ##################################
162 export _H1
="authorization: Bearer $accesstoken"
163 export _H2
="accept: application/json"
164 export _H3
="Content-Type: application/json"
167 if [ "$m" != "GET" ]; then
169 response
="$(_post "$data" "$ep" "" "$m")"
171 response
="$(_get "$ep")"
173 _debug2 response
"$response"
175 _code
="$(grep "^HTTP
" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
176 _debug2
"http response code $_code"
178 if [ "$?" != "0" ]; then
185 ## Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service#request-an-access-token
186 _azure_getaccess_token
() {
191 export _H1
="accept: application/json"
192 export _H2
="Content-Type: application/x-www-form-urlencoded"
194 body
="resource=$(printf "%s
" 'https://management.core.windows.net/' | _url_encode)&client_id=$(printf "%s
" "$clientID" | _url_encode)&client_secret=$(printf "%s
" "$clientSecret" | _url_encode)&grant_type=client_credentials"
196 response
="$(_post "$body" "https
://login.windows.net
/$TENANTID/oauth
2/token
" "" "POST
")"
197 accesstoken
=$
(echo "$response" | _egrep_o
"\"access_token\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
198 _debug2
"response $response"
200 if [ -z "$accesstoken" ]; then
201 _err
"no acccess token received"
204 if [ "$?" != "0" ]; then
205 _err
"error $response"
208 printf "%s" "$accesstoken"
219 ## Ref: https://docs.microsoft.com/en-us/rest/api/dns/zones/list
220 ## returns up to 100 zones in one response therefore handling more results is not not implemented
221 ## (ZoneListResult with continuation token for the next page of results)
222 ## Per https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#dns-limits you are limited to 100 Zone/subscriptions anyways
224 _azure_rest GET
"https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?api-version=2017-09-01" "" "$accesstoken"
226 # Find matching domain name is Json response
228 h
=$
(printf "%s" "$domain" | cut
-d .
-f $i-100)
229 _debug2
"Checking domain: $h"
232 _err
"Invalid domain"
236 if _contains
"$response" "\"name\":\"$h\"" >/dev
/null
; then
237 _domain_id
=$
(echo "$response" | _egrep_o
"\{\"id\":\"[^\"]*$h\"" |
head -n 1 | cut
-d : -f 2 |
tr -d \")
238 if [ "$_domain_id" ]; then
239 _sub_domain
=$
(printf "%s" "$domain" | cut
-d .
-f 1-$p)