Add new Trusted Token Issuer to a SharePoint 2013 Site – S2S HighTrust Apps

# ———————————————————————————
# Setup for a new Trusted Security Token Issuer for an on-prem Developer Hosted App
# $TargetUrl = Developer SiteCollection Url
# $publicCertPath = Path to the public part of the certificate
# (optional) $issuerID = Unique ID for the App, generated if omitted
#
# e.g. .\AddTrustedTokenIssuerToSite “http://developerSite/” “c:\PathTo.Cer”
#
# The isserID is printed at the end of the script -> keep it for
# the App’s web.config
# ———————————————————————————

param(
[string]$TargetUrl,
[string]$publicCertPath,
[string]$issuerID = “”
)

Write-Host
Write-Host “Register new Trusted Identity Token Issuer…” -ForegroundColor White
Write-Host ” Script Steps:” -ForegroundColor White
Write-Host ” (1 of 5) Validating parameters…” -ForegroundColor White
Write-Host ” (2 of 5) Verify SharePoint PowerShell Snapin Loaded” -ForegroundColor White
Write-Host ” (3 of 5) Check if site collection exists at target $SiteUrl” -ForegroundColor White
Write-Host ” (4 of 5) Adding IssuerIdentifier at target $SiteUrl” -ForegroundColor White
Write-Host ” (5 of 5) Verify OAuth over https is disabled” -ForegroundColor White
Write-Host

# ———————————————–

# verify parameters passed in
Write-Host “(1 of 5) Validating parameters…” -ForegroundColor White
if ($TargetUrl -eq $null -xor $TargetUrl -eq “”) {
  Write-Error ‘$TargetUrl is required’
  Exit
}
if ($publicCertPath -eq $null -xor $publicCertPath -eq “”) {
  Write-Error ‘$publicCertPath is required’
  Exit
}
Write-Host ” All parameters valid” -ForegroundColor Gray

# ———————————————–

if ($issuerID -eq $null -xor $issuerID -eq “”) {
  Write-Host ‘ IssuerID is empty, generating’
  $issuerID = [System.Guid]::NewGuid().ToString()
}

# ———————————————–

# Load SharePoint PowerShell snapin
Write-Host
Write-Host “(2 of 5) Verify SharePoint PowerShell Snapin Loaded” -ForegroundColor White
$snapin = Get-PSSnapin | Where-Object {$_.Name -eq ‘Microsoft.SharePoint.PowerShell’}
if ($snapin -eq $null) {
  Write-Host ” .. loading SharePoint PowerShell Snapin…” -ForegroundColor Gray
  Add-PSSnapin “Microsoft.SharePoint.PowerShell”
}
Write-Host ” Microsoft SharePoint PowerShell snapin loaded” -ForegroundColor Gray

# ———————————————–

Write-Host
Write-Host “(3 of 5) Check if site collection exists at target $TargetUrl” -ForegroundColor White
$targetSpSite = Get-SPSite $TargetUrl
if ($targetSpSite -ne $null) {
  Write-Host ” … site found” -ForegroundColor Gray

  $realm = Get-SPAuthenticationRealm -ServiceContext $targetSpSite
  $certificate = Get-PfxCertificate $publicCertPath
  $fullIssuerIdentifier = $issuerId + ‘@’ + $realm

  Write-Host
  Write-Host “(4 of 5) Adding IssuerIdentifier $fullIssuerIdentifier ” -ForegroundColor White
  Write-Host ” as TrustedSecurityTokenIssuer to $TargetUrl” -ForegroundColor White

  $result = New-SPTrustedSecurityTokenIssuer -Name $issuerId -Certificate $certificate -RegisteredIssuerName $fullIssuerIdentifier –IsTrustBroker

  Write-Host
  write-host “— ### Results ### —” -ForegroundColor Green
  write-host ” Realm: $realm” -ForegroundColor Green
  # write-host “FullIssuerID: $fullIssuerIdentifier” -ForegroundColor Green
  write-host ” IssuerID: $issuerId” -ForegroundColor Green
  write-host ” Result: $result” -ForegroundColor Green
  write-host “— ### Results ### —” -ForegroundColor Green
}
else
{
  Write-Error “$TargetUrl not found”
  Exit
}

Write-Host
Write-Host “(5 of 5) Verify OAuth over https is disabled” -ForegroundColor White
$serviceConfig = Get-SPSecurityTokenServiceConfig
if($serviceConfig.AllowOAuthOverHttp -ne $true) {
    $serviceConfig.AllowOAuthOverHttp = $true
    $serviceConfig.Update()
    write-host ‘ OAuth over https disabled’ -ForegroundColor Green
}
else
{
  write-host ‘ OAuth over https is already disabled’ -ForegroundColor White
}