Scan all owned App Registrations for expiring Client Secrets

check-ad-app-reg-secrets.sh

#!/bin/bash
set -e

TZ=Europe/London
TODAY=$(gdate -Idate)
DAYS_90_FUTURE=$(gdate --date="+90 days" +"%Y-%m-%d")
SILENT=0

# Set up a handy log output function
#
# @usage print -l 'Something happened :)'"
# @param -l <log>  Any information to output
# @param -e <0/1>  Message is an error
# @param -q <0/1>  Quiet mode
function print {
  OPTIND=1
  QUIET_MODE=0
  ERROR=0
  while getopts "l:q:e:" opt; do
    case $opt in
      l)
        LOG="$OPTARG"
        ;;
      q)
        QUIET_MODE="$OPTARG"
        ;;
      e)
        ERROR="$OPTARG"
        ;;
      *)
        exit 1
        ;;
    esac
  done

  if [ "$QUIET_MODE" == "0" ]; then
    if [ "$ERROR" == "1" ]; then
      echo "[!] $LOG" >&2
    else
      echo "$LOG"
    fi
  fi
}

BIN_EXPIRED=""
BIN_EXPIRING=""
BIN_VALID=""

while read -r APP; do
  APP_NAME=$(echo "$APP" | jq -rc '.displayName')
  print -l "App Registration: $APP_NAME" -q 0 -e 0

  while read -r SECRET; do
    SECRET=$(echo "$SECRET" | jq --arg app "$APP_NAME" '.appName = $app')
    SECRET_NAME=$(echo "$SECRET" | jq -r '.displayName')
    SECRET_EXPIRY=$(echo "$SECRET" | jq -r '.endDateTime')

    # Check expiry of existing token
    SECRET_EXPIRY_EXPIRY_DATE=${SECRET_EXPIRY:0:10}
    SECRET_EXPIRY_EXPIRY_DATE_COMP=${SECRET_EXPIRY_EXPIRY_DATE//-/}
    DAYS_90_FUTURE=${DAYS_90_FUTURE:0:10}
    DAYS_90_FUTURE_COMP=${DAYS_90_FUTURE//-/}
    TODAY_COMP=${TODAY//-/}

    if [[ "$SECRET_EXPIRY_EXPIRY_DATE_COMP" -lt "$TODAY_COMP" ]] || [[ "$SECRET_EXPIRY_EXPIRY_DATE_COMP" -eq "$TODAY_COMP" ]]; then
      SECRET_STATUS="Expired"
      BIN_EXPIRED="$SECRET, $BIN_EXPIRED"
    elif [[ "$SECRET_EXPIRY_EXPIRY_DATE_COMP" -gt "$TODAY_COMP" ]] && [[ "$SECRET_EXPIRY_EXPIRY_DATE_COMP" -lt "$DAYS_90_FUTURE_COMP" ]]; then
      SECRET_STATUS="Expiring soon"
      BIN_EXPIRING="$SECRET, $BIN_EXPIRING"
    else
      SECRET_STATUS="Valid"
      BIN_VALID="$SECRET, $BIN_VALID"
    fi

    print -l "Secret: $SECRET_NAME | Expiry Date: $SECRET_EXPIRY_EXPIRY_DATE | State: $SECRET_STATUS" -q $SILENT -e 0
  done < <(echo "$APP" | jq -c '.passwordCredentials | .[]')
  echo
done < <(az ad app list --show-mine | jq -c '.[] | select(.passwordCredentials != [])')

if [ "$BIN_EXPIRING" == "" ] && [ "$BIN_EXPIRED" == "" ]; then
  print -l "Secrets are still valid" -q $SILENT -e 0
else
  if [ "$BIN_EXPIRING" != "" ]; then
    BIN_EXPIRING="[${BIN_EXPIRING/%, /}]"
    BIN_EXPIRING_COUNT=$(echo "$BIN_EXPIRING" | jq -r 'length')
    BIN_EXPIRING_SECRET_NAMES=$(echo "$BIN_EXPIRING" | jq -rc '.[] | [.appName, .displayName, .endDateTime]')
    TOTAL_EXPIRING_COUNT=$((TOTAL_EXPIRING_COUNT + BIN_EXPIRING_COUNT))

    print -l "$BIN_EXPIRING_COUNT Secrets were found that are close to expiry. You should renew these:" -q 0 -e 0
    print -l "$BIN_EXPIRING_SECRET_NAMES" -q 0 -e 0
  fi
  if [ "$BIN_EXPIRED" != "" ]; then
    BIN_EXPIRED="[${BIN_EXPIRED/%, /}]"
    BIN_EXPIRED_COUNT=$(echo "$BIN_EXPIRED" | jq -r 'length')
    BIN_EXPIRED_SECRET_NAMES=$(echo "$BIN_EXPIRED" | jq -rc '.[] | [.appName, .displayName, .endDateTime]')
    TOTAL_EXPIRED_COUNT=$((TOTAL_EXPIRED_COUNT + BIN_EXPIRED_COUNT))

    print -l "$BIN_EXPIRED_COUNT Secrets were found that have expired. You should remove them if they are not in use:" -q 0 -e 0
    print -l "$BIN_EXPIRED_SECRET_NAMES" -q 0 -e 0
  fi
fi