VPN Gateway P2S support

docs/wiki/DeploymentFlow.md

@@ -88,7 +88,7 @@ In addition, the identity that wants to create a Tenant scope deployment must ha
 
 ### Service Principal Account
 
-A service principal account is required to automate through Azure DevOps or GitHub Workflows. This can be created through the [Portal](https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal), [Azure PowerShell](https://learn.microsoft.com/azure/active-directory/develop/howto-authenticate-service-principal-powershell) or [Azure CLI](https://learn.microsoft.com/cli/azure/create-an-azure-service-principal-azure-cli).
+A service principal account is required to automate through Azure DevOps or GitHub Workflows. This can be created through the [Portal](https://learn.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal), [Azure PowerShell](https://learn.microsoft.com/azure/active-directory/develop/howto-authenticate-service-principal-powershell) or [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/azure-cli-sp-tutorial-1).
 
 - **Service Principal Name**:  any name (i.e. `spn-azure-platform-ops`)
 - **RBAC Assignment**

infra-as-code/bicep/modules/hubNetworking/README.md

@@ -35,6 +35,31 @@ Module deploys the following resources:
 >
 > See child module, [`privateDnsZones.bicep` docs](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/privateDnsZones#dns-zones) for more info on how this works
 
+To configure P2S VPN connections edit the vpnClientConfiguration value in the `parVpnGatewayConfig` parameter.
+
+AAD Authentication Example:
+
+```bicep
+"vpnClientConfiguration": {
+  "vpnClientAddressPool": {
+    "addressPrefixes": [
+      "172.16.0.0/24"
+    ]
+  },
+  "vpnClientProtocols": [
+    "OpenVPN"
+  ],
+  "vpnAuthenticationTypes": [
+    "AAD"
+  ],
+  "aadTenant": "https://login.microsoftonline.com/{AzureAD TenantID}",
+  "aadAudience": "41b23e61-6c1e-4545-b367-cd054e0ed4b4",
+  "aadIssuer": "https://sts.windows.net/{AzureAD TenantID}/"
+}
+```
+
+Replace the values for `aadTenant`, `aadAudience`, and `aadIssuer` as documented [here](https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant#enable-authentication)
+
 ## Outputs
 
 The module will generate the following outputs:

infra-as-code/bicep/modules/hubNetworking/generateddocs/hubNetworking.bicep.md

@@ -307,7 +307,7 @@ Configuration for VPN virtual network gateway to be deployed. If a VPN virtual n
   "value": {}
 }
 
-- Default value: `@{name=[format('{0}-Vpn-Gateway', parameters('parCompanyPrefix'))]; gatewayType=Vpn; sku=VpnGw1; vpnType=RouteBased; generation=Generation1; enableBgp=False; activeActive=False; enableBgpRouteTranslationForNat=False; enableDnsForwarding=False; bgpPeeringAddress=; bgpsettings=}`
+- Default value: `@{name=[format('{0}-Vpn-Gateway', parameters('parCompanyPrefix'))]; gatewayType=Vpn; sku=VpnGw1; vpnType=RouteBased; generation=Generation1; enableBgp=False; activeActive=False; enableBgpRouteTranslationForNat=False; enableDnsForwarding=False; bgpPeeringAddress=; bgpsettings=; vpnClientConfiguration=}`
 
 ### parExpressRouteGatewayConfig
 
@@ -570,7 +570,8 @@ outHubVirtualNetworkId | string |
                     "asn": 65515,
                     "bgpPeeringAddress": "",
                     "peerWeight": 5
-                }
+                },
+                "vpnClientConfiguration": {}
             }
         },
         "parExpressRouteGatewayConfig": {

infra-as-code/bicep/modules/hubNetworking/hubNetworking.bicep

@@ -238,6 +238,7 @@ param parVpnGatewayConfig object = {
     bgpPeeringAddress: ''
     peerWeight: 5
   }
+  vpnClientConfiguration: {}
 }
 
 @sys.description('''Configuration for ExpressRoute virtual network gateway to be deployed. If a ExpressRoute virtual network gateway is not desired an empty object should be used as the input parameter in the parameter file, i.e.
@@ -593,6 +594,17 @@ resource resGateway 'Microsoft.Network/virtualNetworkGateways@2023-02-01' = [for
       name: gateway.sku
       tier: gateway.sku
     }
+    vpnClientConfiguration: (gateway.gatewayType == 'VPN') ? {
+      vpnClientAddressPool: contains(gateway.vpnClientConfiguration, 'vpnClientAddressPool') ? gateway.vpnClientConfiguration.vpnClientAddressPool: ''
+      vpnClientProtocols: contains(gateway.vpnClientConfiguration, 'vpnClientProtocols') ? gateway.vpnClientConfiguration.vpnClientProtocols: ''
+      vpnAuthenticationTypes: contains(gateway.vpnClientConfiguration, 'vpnAuthenticationTypes') ? gateway.vpnClientConfiguration.vpnAuthenticationTypes: ''
+      aadTenant: contains(gateway.vpnClientConfiguration, 'aadTenant') ? gateway.vpnClientConfiguration.aadTenant : ''
+      aadAudience: contains(gateway.vpnClientConfiguration, 'aadAudience') ? gateway.vpnClientConfiguration.aadAudience : ''
+      aadIssuer: contains(gateway.vpnClientConfiguration, 'aadIssuer') ? gateway.vpnClientConfiguration.aadIssuer: ''
+      vpnClientRootCertificates: contains(gateway.vpnClientConfiguration, 'vpnClientRootCertificates') ? gateway.vpnClientConfiguration.vpnClientRootCertificates: ''
+      radiusServerAddress: contains(gateway.vpnClientConfiguration, 'radiusServerAddress') ? gateway.vpnClientConfiguration.radiusServerAddress: ''
+      radiusServerSecret: contains(gateway.vpnClientConfiguration, 'radiusServerSecret') ? gateway.vpnClientConfiguration.radiusServerSecret: ''
+    } : null
     ipConfigurations: [
       {
         id: resHubVnet.id

infra-as-code/bicep/modules/hubNetworking/parameters/hubNetworking.parameters.all.json

@@ -188,7 +188,7 @@
     "parVpnGatewayConfig": {
       "value": {
         "name": "alz-Vpn-Gateway",
-        "gatewayType": "Vpn",
+        "gatewayType": "VPN",
         "sku": "VpnGw1",
         "vpnType": "RouteBased",
         "generation": "Generation1",
@@ -201,7 +201,8 @@
           "asn": "65515",
           "bgpPeeringAddress": "",
           "peerWeight": "5"
-        }
+        },
+        "vpnClientConfiguration": {}
       }
     },
     "parExpressRouteGatewayConfig": {

infra-as-code/bicep/modules/hubNetworking/parameters/mc-hubNetworking.parameters.all.json

@@ -163,7 +163,8 @@
           "asn": "65515",
           "bgpPeeringAddress": "",
           "peerWeight": "5"
-        }
+        },
+        "vpnClientConfiguration": {}
       }
     },
     "parExpressRouteGatewayConfig": {