panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
51 lines
2.0 KiB
Terraform
51 lines
2.0 KiB
Terraform
# Entra app registration for the Postfix sasl-xoauth2 relay.
|
|
# Delegated Microsoft Graph SMTP.Send + admin consent + a client secret. The relay
|
|
# still needs a one-time device-code login to mint the refresh token (see ../README.md).
|
|
|
|
data "azuread_client_config" "current" {}
|
|
|
|
# Microsoft Graph well-known IDs, so we don't hardcode the SMTP.Send permission UUID.
|
|
data "azuread_application_published_app_ids" "well_known" {}
|
|
|
|
resource "azuread_service_principal" "msgraph" {
|
|
client_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
|
|
use_existing = true
|
|
}
|
|
|
|
resource "azuread_application" "smtp_relay" {
|
|
display_name = var.app_display_name
|
|
sign_in_audience = "AzureADMyOrg"
|
|
|
|
# Enables "Allow public client flows" so the device-code flow works, while we still
|
|
# keep a client secret for confidential refresh.
|
|
fallback_public_client_enabled = true
|
|
|
|
public_client {
|
|
redirect_uris = ["https://login.microsoftonline.com/common/oauth2/nativeclient"]
|
|
}
|
|
|
|
required_resource_access {
|
|
resource_app_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
|
|
|
|
resource_access {
|
|
id = azuread_service_principal.msgraph.oauth2_permission_scope_ids["SMTP.Send"]
|
|
type = "Scope" # delegated
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "azuread_service_principal" "smtp_relay" {
|
|
client_id = azuread_application.smtp_relay.client_id
|
|
}
|
|
|
|
# NOTE: no client secret. This is a PUBLIC client (device-code delegated flow); the
|
|
# refresh token is the credential. Presenting a secret makes Entra reject the refresh
|
|
# with AADSTS700025 ("Client is public..."). CLIENT_SECRET in the k8s secret is empty.
|
|
|
|
# Org-wide admin consent for the delegated SMTP.Send scope (no per-user consent prompt).
|
|
resource "azuread_service_principal_delegated_permission_grant" "smtp_send" {
|
|
service_principal_object_id = azuread_service_principal.smtp_relay.object_id
|
|
resource_service_principal_object_id = azuread_service_principal.msgraph.object_id
|
|
claim_values = ["SMTP.Send"]
|
|
}
|