添加Tenant URL和Secret Token到企业应用预配时遇URI匹配错误

问题背景 #

需要实现自动化将Tenant URL、Secret Token等管理员凭据添加到企业应用的SCIM预配中（与Azure门户手动操作效果一致）。目前已通过Terraform创建了企业应用和服务主体，但尝试通过null_resource结合Azure CLI调用Graph API的方式配置预配时失败，提示请求URI无效。

现有Terraform代码（应用与服务主体创建） #

# Enterprise Application
resource "azuread_application" "enterprise_app_scim" {
  display_name = var.ent_app_display_name
  owners       = var.ent_app_owners
}

resource "azuread_service_principal" "enterprise_app_scim_sp" {
  client_id                     = azuread_application.enterprise_app_scim.client_id
  owners                        = azuread_application.enterprise_app_scim.owners
  preferred_single_sign_on_mode = "saml"
  app_role_assignment_required  = true

  feature_tags {
    enterprise           = true
    custom_single_sign_on = true
  }
}

尝试的预配配置代码（无效） #

resource "null_resource" "scim_provisioning" {
  provisioner "local-exec" {
    command = <<EOT
      TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv)
      az rest --method PATCH \
        --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${azuread_service_principal.enterprise_app_scim_sp.id}/synchronization" \
        --headers "{\"Authorization\": \"Bearer $TOKEN\"}" \
        --body '{
          "synchronization": {
            "jobs": [
              {
                "tenantUrl": "${var.scim_tenant_url}",
                "secretToken": "${var.scim_bearer_token}"
              }
            ]
          }
        }'
    EOT
  }
}

错误信息（已翻译） #

未找到资源({"error":{"code":"UnknownError","message":"{"Message":"未找到与请求URI 'https://syncfabric.windowsazure.com/api/servicePrincipals('63e5e074-xxxx-4367-ba72-257f07052e9f')/synchronization/secrets?api-version=2.0'匹配的HTTP资源。"}","innerError":{"date":"2025-02-20T12:31:22","request-id":"467a024e-574c-42c3-9612-xxxxxxx","client-request-id":"467a024e-574c-42c3-9612-b320e07c299d"}}})

解决方案 #

1. 修正Graph API调用逻辑 #

配置SCIM预配凭据需要分两步完成，原代码的端点和请求方式均不正确：

• 第一步：启用服务主体的预配功能，指定SCIM模板ID
• 第二步：设置预配所需的Tenant URL和Secret Token凭据

2. 修正后的Terraform代码 #

替换原有的null_resource为以下代码：

resource "null_resource" "scim_provisioning" {
  depends_on = [azuread_service_principal.enterprise_app_scim_sp]

  provisioner "local-exec" {
    command = <<EOT
      # 启用预配功能
      az rest --method PATCH \
        --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${azuread_service_principal.enterprise_app_scim_sp.id}" \
        --resource "https://graph.microsoft.com" \
        --body '{
          "synchronization": {
            "templateId": "SCIM",
            "enabled": true
          }
        }'

      # 设置SCIM凭据
      az rest --method POST \
        --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${azuread_service_principal.enterprise_app_scim_sp.id}/synchronization/secrets" \
        --resource "https://graph.microsoft.com" \
        --body '{
          "value": [
            {
              "key": "tenantUrl",
              "value": "${var.scim_tenant_url}"
            },
            {
              "key": "secretToken",
              "value": "${var.scim_bearer_token}"
            }
          ]
        }'
    EOT
  }
}

3. 关键说明 #

• 端点修正：设置凭据的正确端点是/servicePrincipals/{id}/synchronization/secrets，且需用POST方法而非PATCH
• 权限要求：执行操作的账号需拥有Application Administrator、Cloud Application Administrator权限，或具备Synchronization Configuration.ReadWrite.All应用权限
• 依赖关系：添加depends_on确保服务主体创建完成后再执行预配配置
• 简化认证：使用az rest的--resource参数自动处理认证，无需手动拼接Authorization头

内容的提问来源于stack exchange，提问作者New Programmer