CreateServicePrincipal.sh

#!/bin/bash
set -euo pipefail

echo "Creating service principal account for scripted login"

config_file="/etc/Backup2Azure/backup2azure.conf"

if [ ! -f "$config_file" ]; then
  echo "Config file not found: $config_file"
  exit 1
fi

source "$config_file"

for var in account_name container_name; do
  if [ -z "${!var:-}" ]; then
    echo "Missing $var environment variable"
    exit 1
  fi
done


sp_name="sp-blob-pve-archive"

#Check if info has been passed as arguments
if [ $# -ge 2 ] && [ -n "$1" ] && [ -n "$2" ]; then
  az_subscription_id="$1"
  echo "az_subscription_id has been set to $az_subscription_id"
  az_storage_rg="$2"
  echo "az_storage_rg has been set to $az_storage_rg"
else
  echo "Missing az_subscription_id and/or az_storage_rg. Pass them as arguments when calling this script."
  exit 1
fi

echo "Logging in to Azure (interactive)..."
if ! az login; then
  echo "az login failed."
  exit 1
fi

scope="/subscriptions/${az_subscription_id}/resourceGroups/${az_storage_rg}/providers/Microsoft.Storage/storageAccounts/${account_name}/blobServices/default/containers/${container_name}"

sp_tsv=$(az ad sp create-for-rbac --name "$sp_name" \
                                  --role "Storage Blob Data Contributor" \
                                  --scopes "$scope" \
                                  --query '[appId,password,tenant]' -o tsv)

IFS=$'\t' read -r new_app_id new_password new_tenant <<< "$sp_tsv"

if [ -z "$new_app_id" ] || [ -z "$new_password" ] || [ -z "$new_tenant" ]; then
  echo "Failed to parse appId/password/tenant from az ad sp create-for-rbac output."
  echo "$sp_tsv"
  exit 1
fi

cp "$config_file" "${config_file}.bak"
chmod 600 "${config_file}.bak"

sed -i "s|^sp_app_id=.*|sp_app_id=\"${new_app_id}\"|" "$config_file"
sed -i "s|^sp_password=.*|sp_password=\"${new_password}\"|" "$config_file"
sed -i "s|^sp_tenant_id=.*|sp_tenant_id=\"${new_tenant}\"|" "$config_file"
chmod 600 "$config_file"

echo "Updated sp_app_id, sp_password and sp_tenant_id in $config_file (backup at ${config_file}.bak)"
echo "Done."