Fix appID in broker-plugin link

microsoft · Nov 14, 2022 · 373f6f7 · 373f6f7
1 parent 1347949
commit 373f6f7
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 8 deletions.
diff --git a/src/deployment/deploy.py b/src/deployment/deploy.py
@@ -486,7 +486,7 @@ def setup_rbac(self) -> None:
 
             requiredRedirectUris = [
                 "http://localhost",  # required for browser-based auth
-                "ms-appx-web://Microsoft.AAD.BrokerPlugin/3b5603df-3ddc-464c-a1ea-6a186bdee389",  # required for broker auth
+                f"ms-appx-web://Microsoft.AAD.BrokerPlugin/{onefuzz_cli_app['appId']}",  # required for broker auth
             ]
 
             redirectUris: List[str] = onefuzz_cli_app["publicClient"]["redirectUris"]

diff --git a/src/deployment/deploylib/registration.py b/src/deployment/deploylib/registration.py
@@ -257,13 +257,6 @@ def create_application_registration(
     params = {
         "isDeviceOnlyAuthSupported": True,
         "displayName": name,
-        "publicClient": {
-            "redirectUris": [
-                "https://%s.azurewebsites.net" % onefuzz_instance_name,
-                "http://localhost",  # required for browser auth
-                "ms-appx-web://Microsoft.AAD.BrokerPlugin/3b5603df-3ddc-464c-a1ea-6a186bdee389",  # required for broker auth
-            ]
-        },
         "isFallbackPublicClient": True,
         "requiredResourceAccess": (
             [
@@ -284,6 +277,23 @@ def create_application_registration(
         subscription=subscription_id,
     )
 
+    # next patch the redirect URIs; we must do this
+    # separately because we need the AppID to include
+    query_microsoft_graph(
+        method="PATCH",
+        resource=f"applications/{registered_app['id']}",
+        body={
+            "publicClient": {
+                "redirectUris": [
+                    "https://%s.azurewebsites.net" % onefuzz_instance_name,
+                    "http://localhost",  # required for browser auth
+                    f"ms-appx-web://Microsoft.AAD.BrokerPlugin/{app['appId']}",  # required for broker auth
+                ]
+            },
+        },
+        subscription=subscription_id,
+    )
+
     logger.info("creating service principal")
 
     service_principal_params = {