✨ add support for token signing certificate

[dhohengassner]

We do like to add support to the provider to create a token signing certificate.

This commit adds a new field token_signing_certificate_name to the
resource azuread_service_principal.

If this is set a ceritificate will be generated and the thumbprint
will be stored in a computed field called preferred_token_signing_key_thumbprint.

Issue: #732

[dhohengassner]

@manicminer This is a draft using the hamilton extension from manicminer/hamilton#151

to solve #732

Please review if that would be an ok workaround until we get an API extension from Microsoft.
The extended unit test seems to work for me locally.
I am happy to adjust and add documentation based on your feedback.
Thanks in advance

[manicminer]

Hi @dhohengassner, thanks for the PR, this would be great to add to the provider! Sorry for the delay in reviewing.

I'm wondering if this would be better as a separate resource, similar to azuread_service_principal_certificate?

[isarns]

A welcome feature, waiting to see it in the provider :)
If someone needs this functionality now you can use this python script:

    def create_self_sign_cert(self) -> None:
        output_date = datetime.datetime.now()
        output_date = output_date + datetime.timedelta(days=365*3)
        output_date = output_date.strftime("%Y-%m-%dT%H:%M:%SZ")
        request_headers = {
                    'Authorization': 'bearer %s'% (token), ## access token
                    'content-type': 'application/json'
                }
        create_message_URL = "https://graph.microsoft.com/v1.0/servicePrincipals/" + ent_app_id + "/addTokenSigningCertificate" ## service principal id 
        payload = {
                "displayName":"CN=SelfSignedCert",
                "endDateTime":output_date
        }
        result = requests.post(create_message_URL, json.dumps(payload), headers = request_headers)
        #print(result.text)
        #print(result.status_code)
        if(result.status_code == 200):
            print(f"Added Cert")
        else:
            print("ERROR: Did not add Cert.")
            sys.exit(1)

[tagur87]

Hi @manicminer - Just wanting to follow up on this.

Hi @dhohengassner, thanks for the PR, this would be great to add to the provider! Sorry for the delay in reviewing.

I'm wondering if this would be better as a separate resource, similar to azuread_service_principal_certificate?

Based on a previous comment here: #732 (comment), it was indicated that it might not be best to do a separate resource for this certificate. You also indicated you were going to check with the internal Graph API team to see if full CRUD support for this resource was coming.

Has there been any movement on this?
Do we want to go the way that this PR suggests, or should we re-work it for a separate resource?

Thanks for the help, and let me know if there’s anything I can do to help.