Admin App v4.0.1 — Scripts v1.1

Admin App v4.0.1 — Scripts v1.1

Adds managed Azure SQL Database support across all three script folders, two more identity providers, and the first automated tests in the repository.

Validated against Admin App v4.0.1, Ed-Fi ODS/API 7.3.x, SQL Server 2019/2022/2025, PostgreSQL, and managed Azure SQL Database.

Managed Azure SQL Database

Every folder can now target a managed Azure SQL Database instead of a local instance.

• windows-install/: install-all.ps1 -SqlServerHost <fqdn> -SqlAdminUsername <admin> provisions the Admin App login as a contained user and configures the API to connect with encryption and certificate validation. uninstall.ps1 drops only that contained user and leaves the managed database intact.
• quick-start/: new -AppSqlServer / APP_SQL_SERVER for the Admin App application database, alongside the existing SECURITY_SQL_SERVER for EdFi_Security.
• edorg-sync/: the source ODS and the target Admin App database can each be remote, independently.

Azure SQL accepts SQL authentication only, so -UseIntegratedSecurity against a remote target now fails up front with an actionable message instead of a driver error.

Certificate validation on remote connections

A remote SQL Server is now connected to with sqlcmd -N, which encrypts the connection and validates the server certificate. Previously the remote path passed neither -N nor -C, which per the sqlcmd documentation negotiates without validating the certificate — so remote connections were encrypted but unvalidated. A loopback target still trusts its self-signed certificate (-C), and -TrustServerCertificate remains the only way to skip validation on a remote server.

Database passwords no longer appear in process arguments: sqlcmd and psql read them from the environment instead of -P or docker exec -e VAR=value.

Identity providers

• Auth0 is supported as an identity provider (-IdpProvider auth0).
• windows-install/idp-entra-setup.ps1 is a new optional helper that creates or reconciles the Microsoft Entra App Registration through the Graph PowerShell SDK and outputs the values to pass to install-all.ps1.

Tests

First automated tests in this repository: tests/Test-SqlCompat.ps1 in each folder covers the local-versus-remote decision, the sqlcmd flags per target, and the actionable failure messages. They need no database, no server and no module, and run on both Windows PowerShell 5.1 and PowerShell 7.

Behaviour change worth noting

cleanup-edorgs.ps1 previously ignored its .env file without saying so, because its -EnvFile default could not resolve, and fell back to tcp:localhost,1433. It now reads the file. If you had unknowingly relied on that fallback, the script will target the server your .env names.

Included PRs

#9 (Auth0), #5 (Entra helper), #10 (Azure SQL for the installer), #11 (Azure SQL for Quick Start and Ed-Org Sync).

Admin App v4.0.1 — Scripts v1.0

Admin App v4.0.1 — Scripts v1.0

First release of the PowerShell tooling that automates installing and operating the Ed-Fi Admin App on Windows, plus companion data scripts.

Validated against Admin App v4.0.1, Ed-Fi ODS/API 7.3.x, SQL Server 2019/2022/2025 and PostgreSQL.

Included

• Windows IIS installation (windows-install/): end-to-end install-all.ps1 (SQL Server or PostgreSQL, IIS, Node, build, deploy, local Keycloak IdP), per-phase scripts, and uninstall.ps1.
• Quick Start (quick-start/): bootstraps a machine client and seeds a Team, Environment, ODS, and claim-set copies through the Admin App API.
• Ed-Org synchronization (edorg-sync/): export education organizations from an ODS and import them into the Admin App database.

Compatibility notes

• PowerShell 5 and PowerShell 7
• SQL Server 2025
• Reboot survival for the local Keycloak IdP.

Requirements

Windows 10/11 Pro or Windows Server 2016+, administrator rights, winget and an existing Ed-Fi ODS/API. See windows-install/README.md for the full list.