Azure / Azure/Azure-Landing-Zones

'vpn_protocols' set to 'IkeV2 and OpenVPN' when using AAD Authentication

Open
#359 7 comments 0 reactions 1 assignee Assigned to @matt-FFFFFF View on GitHub
Transfer From: TF avm-ptn-con-vwan :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### (Optional) Module Version

0.11.0

### (Optional) Correlation Id

_No response_

### Description

When deploying Point-to-Site VPN Configuration with authentication type 'AAD', the tunnel type is set to 'OpenVpn and IkeV2'.

```
p2s_gateway_vpn_server_configurations = {
(local.p2s_gateway_vpn_server_configuration_key) = {
name = local.p2s_gateway_vpn_server_configuration_name
tags = local.p2s-tags
virtual_hub_key = local.virtual_hub_key
vpn_authentication_types = ["AAD"]
azure_active_directory_authentication = {
audience = "c632b3df-fb67-4d84-bdcf-b95ad541b5c8"
issuer = "https://sts.windows.net/${data.azurerm_client_config.current.tenant_id}/"
tenant = "https://login.microsoftonline.com/${data.azurerm_client_config.current.tenant_id}"
}
}
}
}
```
See screenshot below:

![Image](https://github.com/user-attachments/assets/16e31a20-4503-4bba-982b-3c7672f84caa)

This causes an error when trying to add User Groups to the configuration through the portal:

![Image](https://github.com/user-attachments/assets/ac99202d-1bb8-46fb-a148-a02181994f07)

To fix this add the [vpn_protocols](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/vpn_server_configuration#vpn_protocols-1) argument the azurerm_vpn_server_configuration resource.

Possible fix in p2s-vpn-gateway.tf:

```
resource "azurerm_vpn_server_configuration" "p2s_gateway_vpn_server_configuration" {
for_each = local.p2s_gateway_vpn_server_configurations != null && length(local.p2s_gateway_vpn_server_configurations) > 0 ? local.p2s_gateway_vpn_server_configurations : {}

location = module.virtual_hubs.location[each.value.virtual_hub_key]
name = each.value.name
resource_group_name = module.virtual_hubs.resource_group_name[each.value.virtual_hub_key]
vpn_authentication_types = each.value.vpn_authentication_types
vpn_protocols = each.value.vpn_protocols //Added argument
tags = try(each.value.tags, {})

dynamic "azure_active_directory_authentication" {
for_each = each.value.azure_active_directory_authentication != null ? [each.value.azure_active_directory_authentication] : []

content {
audience = each.value.azure_active_directory_authentication.audience
issuer = each.value.azure_active_directory_authentication.issuer
tenant = each.value.azure_active_directory_authentication.tenant
}
}
dynamic "client_root_certificate" {
for_each = each.value.client_root_certificate != null ? [each.value.client_root_certificate] : []

content {
name = each.value.client_root_certificate.name
public_cert_data = each.value.client_root_certificate.public_cert_data
}
}
}
```

in locals.tf

```
p2s_gateway_vpn_server_configurations = var.p2s_gateway_vpn_server_configurations != null ? {
for key, svr in var.p2s_gateway_vpn_server_configurations : key => {
name = svr.name
virtual_hub_key = svr.virtual_hub_key
vpn_authentication_types = svr.vpn_authentication_types
vpn_protocols = svr.vpn_protocols //Added
client_root_certificate = svr.client_root_certificate
azure_active_directory_authentication = svr.azure_active_directory_authentication
}
}
```

in variables.tf

```
variable "p2s_gateway_vpn_server_configurations" {
type = map(object({
name = string
virtual_hub_key = string
vpn_authentication_types = list(string)
vpn_protocols = list(string)
tags = optional(map(string))
client_root_certificate = optional(object({
name = string
public_cert_data = string
}))
azure_active_directory_authentication = optional(object({
audience = string
issuer = string
tenant = string
}))
}))
default = {}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.