3 WIKI
="https://github.com/Neilpang/acme.sh/wiki/How-to-use-Azure-DNS"
5 ######## Public functions #####################
7 # Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
8 # Used to add txt record
10 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/createorupdate
16 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
17 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
18 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
19 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
21 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
22 AZUREDNS_SUBSCRIPTIONID
=""
25 AZUREDNS_CLIENTSECRET
=""
26 _err
"You didn't specify the Azure Subscription ID "
30 if [ -z "$AZUREDNS_TENANTID" ]; then
31 AZUREDNS_SUBSCRIPTIONID
=""
34 AZUREDNS_CLIENTSECRET
=""
35 _err
"You didn't specify the Azure Tenant ID "
39 if [ -z "$AZUREDNS_APPID" ]; then
40 AZUREDNS_SUBSCRIPTIONID
=""
43 AZUREDNS_CLIENTSECRET
=""
44 _err
"You didn't specify the Azure App ID"
48 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
49 AZUREDNS_SUBSCRIPTIONID
=""
52 AZUREDNS_CLIENTSECRET
=""
53 _err
"You didn't specify the Azure Client Secret"
56 #save account details to account conf file.
57 _saveaccountconf_mutable AZUREDNS_SUBSCRIPTIONID
"$AZUREDNS_SUBSCRIPTIONID"
58 _saveaccountconf_mutable AZUREDNS_TENANTID
"$AZUREDNS_TENANTID"
59 _saveaccountconf_mutable AZUREDNS_APPID
"$AZUREDNS_APPID"
60 _saveaccountconf_mutable AZUREDNS_CLIENTSECRET
"$AZUREDNS_CLIENTSECRET"
62 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
64 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
68 _debug _domain_id
"$_domain_id"
69 _debug _sub_domain
"$_sub_domain"
70 _debug _domain
"$_domain"
72 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
73 _debug
"$acmeRecordURI"
74 # Get existing TXT record
75 _azure_rest GET
"$acmeRecordURI" "" "$accesstoken"
76 values
="{\"value\":[\"$txtvalue\"]}"
78 if [ "$_code" = "200" ]; then
79 vlist
="$(echo "$response" | _egrep_o "\"value
\"\\s
*:\\s
*\\[\\s
*\"[^
\"]*\"\\s
*]" | cut -d : -f 2 | tr -d "[]\"")"
80 _debug
"existing TXT found"
82 existingts
="$(echo "$response" | _egrep_o "\"acmetscheck
\"\\s
*:\\s
*\"[^
\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")"
83 if [ -z "$existingts" ]; then
84 # the record was not created by acme.sh. Copy the exisiting entires
87 _diff
="$(_math "$timestamp - $existingts")"
88 _debug
"existing txt age: $_diff"
89 # only use recently added records and discard if older than 2 hours because they are probably orphaned
90 if [ "$_diff" -lt 7200 ]; then
91 _debug
"existing txt value: $vlist"
93 values
="$values ,{\"value\":[\"$v\"]}"
97 # Add the txtvalue TXT Record
98 body
="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
99 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
100 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
101 _info
"validation value added"
104 _err
"error adding validation value ($_code)"
109 # Usage: fulldomain txtvalue
110 # Used to remove the txt record after validation
112 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/delete
118 AZUREDNS_SUBSCRIPTIONID
="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
119 AZUREDNS_TENANTID
="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
120 AZUREDNS_APPID
="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
121 AZUREDNS_CLIENTSECRET
="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
123 if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
124 AZUREDNS_SUBSCRIPTIONID
=""
127 AZUREDNS_CLIENTSECRET
=""
128 _err
"You didn't specify the Azure Subscription ID "
132 if [ -z "$AZUREDNS_TENANTID" ]; then
133 AZUREDNS_SUBSCRIPTIONID
=""
136 AZUREDNS_CLIENTSECRET
=""
137 _err
"You didn't specify the Azure Tenant ID "
141 if [ -z "$AZUREDNS_APPID" ]; then
142 AZUREDNS_SUBSCRIPTIONID
=""
145 AZUREDNS_CLIENTSECRET
=""
146 _err
"You didn't specify the Azure App ID"
150 if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
151 AZUREDNS_SUBSCRIPTIONID
=""
154 AZUREDNS_CLIENTSECRET
=""
155 _err
"You didn't specify the Azure Client Secret"
159 accesstoken
=$
(_azure_getaccess_token
"$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
161 if ! _get_root
"$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
162 _err
"invalid domain"
165 _debug _domain_id
"$_domain_id"
166 _debug _sub_domain
"$_sub_domain"
167 _debug _domain
"$_domain"
169 acmeRecordURI
="https://management.azure.com$(printf '%s' "$_domain_id" | sed 's/\\//g')/TXT/$_sub_domain?api-version=2017-09-01"
170 _debug
"$acmeRecordURI"
171 # Get existing TXT record
172 _azure_rest GET
"$acmeRecordURI" "" "$accesstoken"
174 if [ "$_code" = "200" ]; then
175 vlist
="$(echo "$response" | _egrep_o "\"value
\"\\s
*:\\s
*\\[\\s
*\"[^
\"]*\"\\s
*]" | cut -d : -f 2 | tr -d "[]\"" | grep -v "$txtvalue")"
179 values
="$values$comma{\"value\":[\"$v\"]}"
182 if [ -z "$values" ]; then
183 # No values left remove record
184 _debug
"removing validation record completely $acmeRecordURI"
185 _azure_rest DELETE
"$acmeRecordURI" "" "$accesstoken"
186 if [ "$_code" = "200" ] ||
[ "$_code" = '204' ]; then
187 _info
"validation record removed"
189 _err
"error removing validation record ($_code)"
193 # Remove only txtvalue from the TXT Record
194 body
="{\"properties\":{\"metadata\":{\"acmetscheck\":\"$timestamp\"},\"TTL\":10, \"TXTRecords\":[$values]}}"
195 _azure_rest PUT
"$acmeRecordURI" "$body" "$accesstoken"
196 if [ "$_code" = "200" ] ||
[ "$_code" = '201' ]; then
197 _info
"validation value removed"
200 _err
"error removing validation value ($_code)"
207 ################### Private functions below ##################################
215 MAX_REQUEST_RETRY_TIMES
=5
216 _request_retry_times
=0
217 while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
218 _debug3 _request_retry_times
"$_request_retry_times"
219 export _H1
="authorization: Bearer $accesstoken"
220 export _H2
="accept: application/json"
221 export _H3
="Content-Type: application/json"
222 # clear headers from previous request to avoid getting wrong http code on timeouts
225 if [ "$m" != "GET" ]; then
226 _secure_debug2
"data $data"
227 response
="$(_post "$data" "$ep" "" "$m")"
229 response
="$(_get "$ep")"
232 _secure_debug2
"response $response"
233 _code
="$(grep "^HTTP
" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r
\\n
")"
234 _debug
"http response code $_code"
235 if [ "$_code" = "401" ]; then
236 # we have an invalid access token set to expired
237 _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO
"0"
238 _err
"access denied make sure your Azure settings are correct. See $WIKI"
241 # See https://docs.microsoft.com/en-us/azure/architecture/best-practices/retry-service-specific#general-rest-and-retry-guidelines for retryable HTTP codes
242 if [ "$_ret" != "0" ] ||
[ -z "$_code" ] ||
[ "$_code" = "408" ] ||
[ "$_code" = "500" ] ||
[ "$_code" = "503" ] ||
[ "$_code" = "504" ]; then
243 _request_retry_times
="$(_math "$_request_retry_times" + 1)"
244 _info
"REST call error $_code retrying $ep in $_request_retry_times s"
245 _sleep
"$_request_retry_times"
250 if [ "$_request_retry_times" = "$MAX_REQUEST_RETRY_TIMES" ]; then
251 _err
"Error Azure REST called was retried $MAX_REQUEST_RETRY_TIMES times."
252 _err
"Calling $ep failed."
255 response
="$(echo "$response" | _normalizeJson)"
259 ## Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service#request-an-access-token
260 _azure_getaccess_token
() {
265 accesstoken
="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
266 expires_on
="${AZUREDNS_TOKENVALIDTO:-$(_readaccountconf_mutable AZUREDNS_TOKENVALIDTO)}"
268 # can we reuse the bearer token?
269 if [ -n "$accesstoken" ] && [ -n "$expires_on" ]; then
270 if [ "$(_time)" -lt "$expires_on" ]; then
271 # brearer token is still valid - reuse it
272 _debug
"reusing bearer token"
273 printf "%s" "$accesstoken"
276 _debug
"bearer token expired"
279 _debug
"getting new bearer token"
281 export _H1
="accept: application/json"
282 export _H2
="Content-Type: application/x-www-form-urlencoded"
284 body
="resource=$(printf "%s
" 'https://management.core.windows.net/' | _url_encode)&client_id=$(printf "%s
" "$clientID" | _url_encode)&client_secret=$(printf "%s
" "$clientSecret" | _url_encode)&grant_type=client_credentials"
285 _secure_debug2
"data $body"
286 response
="$(_post "$body" "https
://login.microsoftonline.com
/$tenantID/oauth
2/token
" "" "POST
")"
288 _secure_debug2
"response $response"
289 response
="$(echo "$response" | _normalizeJson)"
290 accesstoken
=$
(echo "$response" | _egrep_o
"\"access_token\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
291 expires_on
=$
(echo "$response" | _egrep_o
"\"expires_on\":\"[^\"]*\"" | _head_n
1 | cut
-d : -f 2 |
tr -d \")
293 if [ -z "$accesstoken" ]; then
294 _err
"no acccess token received. Check your Azure settings see $WIKI"
297 if [ "$_ret" != "0" ]; then
298 _err
"error $response"
301 _saveaccountconf_mutable AZUREDNS_BEARERTOKEN
"$accesstoken"
302 _saveaccountconf_mutable AZUREDNS_TOKENVALIDTO
"$expires_on"
303 printf "%s" "$accesstoken"
314 ## Ref: https://docs.microsoft.com/en-us/rest/api/dns/zones/list
315 ## returns up to 100 zones in one response therefore handling more results is not not implemented
316 ## (ZoneListResult with continuation token for the next page of results)
317 ## Per https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#dns-limits you are limited to 100 Zone/subscriptions anyways
319 _azure_rest GET
"https://management.azure.com/subscriptions/$subscriptionId/providers/Microsoft.Network/dnszones?\$top=500&api-version=2017-09-01" "" "$accesstoken"
320 # Find matching domain name is Json response
322 h
=$
(printf "%s" "$domain" | cut
-d .
-f $i-100)
323 _debug2
"Checking domain: $h"
326 _err
"Invalid domain"
330 if _contains
"$response" "\"name\":\"$h\"" >/dev
/null
; then
331 _domain_id
=$
(echo "$response" | _egrep_o
"\\{\"id\":\"[^\"]*$h\"" |
head -n 1 | cut
-d : -f 2 |
tr -d \")
332 if [ "$_domain_id" ]; then
333 if [ "$i" = 1 ]; then
334 #create the record at the domain apex (@) if only the domain name was provided as --domain-alias
337 _sub_domain
=$
(echo "$domain" | cut
-d .
-f 1-$p)