Click here to Skip to main content
15,116,813 members
Articles / All Topics
Technical Blog
Posted 4 Nov 2016

Tagged as

Stats

3.9K views

Continuous Delivery with TFS / VSTS – Join a VM to a Domain with Azure Resource Manager Templates

Rate me:
Please Sign up or sign in to vote.
5.00/5 (1 vote)
4 Nov 2016CPOL4 min read
In the previous post in my blog post series on Continuous Delivery with TFS / VSTS we learned how to provision a Windows Server virtual machine using Azure Resource Manager templates. The next major step in this quest to automate the creation and configuration of the infrastructure to which we&#8217

This article is an entry in our Microsoft Azure IoT Contest. Articles in this section are not required to be full articles so care should be taken when voting.

In the previous post in my blog post series on Continuous Delivery with TFS / VSTS we learned how to provision a Windows Server virtual machine using Azure Resource Manager templates. The next major step in this quest to automate the creation and configuration of the infrastructure to which we’ll deploy our application is to configure server internals, starting with joining a VM to the domain. My initial thinking was that this would need to be some kind of PowerShell command, and whilst this is an option I was very pleased to find that there is an ARM template resource to do this. The resource in question goes by the name of JsonADDomainExtension; it’s a VM extension and you can read about it (and the PowerShell commands to do the same thing) in this blog post.

I have to confess that I struggled to get the extension to work at first. I spent a whole afternoon fiddling with the settings and getting nowhere, and spent quite a bit of time reading forum posts from others who were having similar difficulties (mostly with the PowerShell commands though). I gave up in frustration, only to come back to it a few days later to try again to find it was all working! I describe the steps I took below – please be aware that it’s very much a direct continuation of this post so please do check that out first if you haven’t done so already.

Adding the JsonADDomainExtension to the JSON Template

Getting starting with the extension is very easy, as it’s just a case of dropping the JSON in to the resources part of the template. The code I initially used to make the extension work was as follows:

{
  "apiVersion": "2015-06-15",
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "name": "[concat(variables('nodeNameToLower'),'/joindomain')]",
  "location": "[resourceGroup().location]",
  "dependsOn": [
    "[concat('Microsoft.Compute/virtualMachines/', variables('nodeNameToUpper'))]"
  ],
  "tags": {
    "displayName": "JoinDomain"
  },
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "JsonADDomainExtension",
    "typeHandlerVersion": "1.0",
    "settings": {
      "Name": "prm.local",
      "OUPath": "",
      "User": "prm\\graham",
      "Restart": "true",
      "Options": "3"
    },
    "protectedsettings": {
      "Password": "MySuperSecureDomainAdminPassword"
    }
  }
}

I added this code to the WindowsServer2012R2Datacenter.json file which has variables defined for use where the VM name is required. Note that OUPath can be an empty string, the requirement for the escaped backslash for the (domain) User and the use of the magic number 3 in Options (just go with it or see here for the details).

Whilst this (eventually) worked fine for me the big issue was how to hide the password for the account that will join the VM to the domain. I hard coded it in to the template to get the extension working but even when refactored as a parameter the password is still in plain view – now just in the PowerShell calling script.

Say Hello to Azure Key Vault

As luck would have it around the time I was initially getting JsonADDomainExtension to work I watched Cloud Cover Episode 200: Azure Resource Manager Tooling with Brian Moore where Brian mentioned the forthcoming ability to use Azure Key Vault to supply secret values such as passwords to ARM templates. Following a very helpful email exchange Brian pointed me towards this page which is a partial answer to the solution I wanted to get working.

At the time of writing there was no portal interface for configuring Azure Key Vault so it’s over to PowerShell (no bad thing) to create a new vault:

# Authentication details are abstracted away in a PS module
Set-AzureRmAuthenticationForMsdnEnterprise

New-AzureRmKeyVault -VaultName 'prmkeyvault' -ResourceGroupName PRM-COMMON -Location 'West Europe'

In the code above this creates a vault named prmkeyvault. Next we need to add our password as a secret:

$secretValue = ConvertTo-SecureString 'MySuperSecureDomainAdminPassword' -AsPlainText -Force
Set-AzureKeyVaultSecret -VaultName 'prmkeyvault' -Name 'DomainAdminPassword' -SecretValue $secretValue

This creates a new secret called DomainAdminPassword. Of course, the objects that have just been created can be examined with Azure Resource Explorer:

azure-resource-explorer-key-vault

Use the Secret in the JSON Template

The Microsoft guidance for passing secrets to templates is based on the use of an ARM parameters file. This wasn’t quite what I wanted as I’m using a PowerShell script to supply my parameters. The way to access secrets using PowerShell is along the following lines:

# Assumes authentication has already been made
$domainAdminPassword = Get-AzureKeyVaultSecret –VaultName prmkeyvaulttest –Name DomainAdminAdminPassword

# Use this syntax to return the secret
$domainAdminPassword.SecretValueText

You can see how I integrated the code above in to my PowerShell script by examining Create PRM-DAT.ps1 in the code release that accompanies this post on my Infrastructure repository on GitHub. It’s not quite the full solution at the moment though because despite having a mechanism in place for automatically authenticating to Azure PowerShell the use of Azure Key Vault cmdlets in the script causes the authentication dialog to pop-up. I’m still working on how to stop that – if you know please leave a message in the comments!

Cheers – Graham

The post Continuous Delivery with TFS / VSTS – Join a VM to a Domain with Azure Resource Manager Templates appeared first on Please Release Me.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Graham D Smith
United Kingdom United Kingdom
Dr Graham Smith is a former research scientist who got bitten by the programming and database bug so badly that in 2000 he changed careers to become a full-time software developer. Life moves on and Graham currently manages a team of software engineers and specialises in continuous delivery and application lifecycle management with the Team Foundation Server ecosystem.

Comments and Discussions

 
-- There are no messages in this forum --