Add test coverage for no role assignment in default SP creation scenario

Author: cormacpayne

ChangeLog.md

@@ -3,7 +3,7 @@
 * Revert change to `New-AzureRmADServicePrincipal` that gave service principals `Contributor` permissions over the current subscription if no values were provided for the `Role` or `Scope` parameters
     - If no values are provided for `Role` or `Scope`, the service principal is created with no permissions
     - If a `Role` is provided, but no `Scope`, the service principal is created with the specified `Role` permissions over the current subscription
-    - If a `Scope` is provided, but no `Scope`, the service principal is created with `Contributor` permissions over the specified `Scope`
+    - If a `Scope` is provided, but no `Role`, the service principal is created with `Contributor` permissions over the specified `Scope`
     - If both `Role` and `Scope` are provided, the service principal is created with the specified `Role` permissions over the specified `Scope`
 
 ## 6.1.0 - May 2018

src/ResourceManager/Resources/AzureRM.Resources.psd1

@@ -163,7 +163,7 @@ PrivateData = @{
         ReleaseNotes = '* Revert change to `New-AzureRmADServicePrincipal` that gave service principals `Contributor` permissions over the current subscription if no values were provided for the `Role` or `Scope` parameters
     - If no values are provided for `Role` or `Scope`, the service principal is created with no permissions
     - If a `Role` is provided, but no `Scope`, the service principal is created with the specified `Role` permissions over the current subscription
-    - If a `Scope` is provided, but no `Scope`, the service principal is created with `Contributor` permissions over the specified `Scope`
+    - If a `Scope` is provided, but no `Role`, the service principal is created with `Contributor` permissions over the specified `Scope`
     - If both `Role` and `Scope` are provided, the service principal is created with the specified `Role` permissions over the specified `Scope`'
 
         # Prerelease string of this module

src/ResourceManager/Resources/ChangeLog.md

@@ -23,7 +23,7 @@
 * Revert change to `New-AzureRmADServicePrincipal` that gave service principals `Contributor` permissions over the current subscription if no values were provided for the `Role` or `Scope` parameters
     - If no values are provided for `Role` or `Scope`, the service principal is created with no permissions
     - If a `Role` is provided, but no `Scope`, the service principal is created with the specified `Role` permissions over the current subscription
-    - If a `Scope` is provided, but no `Scope`, the service principal is created with `Contributor` permissions over the specified `Scope`
+    - If a `Scope` is provided, but no `Role`, the service principal is created with `Contributor` permissions over the specified `Scope`
     - If both `Role` and `Scope` are provided, the service principal is created with the specified `Role` permissions over the specified `Scope`
 
 ## Version 6.0.0

src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/ActiveDirectoryTests.cs

@@ -599,7 +599,7 @@ public void TestNewADApplication()
             ResourcesController.NewInstance.RunPsTest("Test-NewADApplication");
         }
 
-        [Fact(Skip = "Need AD team to re-record test")]
+        [Fact]
         [Trait(Category.AcceptanceType, Category.CheckIn)]
         public void TestNewADServicePrincipalWithoutApp()
         {

src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/ActiveDirectoryTests.ps1

@@ -549,10 +549,12 @@ function Test-NewADServicePrincipalWithoutApp
 
     # Test
     $servicePrincipal = New-AzureRmADServicePrincipal -DisplayName $displayName
+	$role = Get-AzureRmRoleAssignment -ObjectId $servicePrincipal.Id
 
     # Assert
     Assert-NotNull $servicePrincipal
     Assert-AreEqual $servicePrincipal.DisplayName $displayName
+	Assert-Null $role
 
     # GetServicePrincipal by ObjectId
     $sp1 = Get-AzureRmADServicePrincipal -ObjectId $servicePrincipal.Id

src/ResourceManager/Resources/Commands.Resources.Test/SessionRecords/Microsoft.Azure.Commands.Resources.Test.ScenarioTests.ActiveDirectoryTests/TestNewADServicePrincipalWithoutApp.json

@@ -100,7 +100,7 @@ public override void ExecuteCmdlet()
                 }
 
                 // Get AppObjectId
-                var applicationObjectId = sp.Id;
+                var applicationObjectId = GetObjectIdFromApplicationId(sp.ApplicationId.ToString());
                 ApplicationUpdateParameters parameters = new ApplicationUpdateParameters()
                 {
                     DisplayName = DisplayName,
@@ -117,5 +117,16 @@ public override void ExecuteCmdlet()
                 }
             });
         }
+
+        private Guid GetObjectIdFromApplicationId(string applicationId)
+        {
+            var odataQueryFilter = new Rest.Azure.OData.ODataQuery<Application>(a => a.AppId == applicationId);
+            var app = ActiveDirectoryClient.GetApplicationWithFilters(odataQueryFilter).SingleOrDefault();
+            if (app == null)
+            {
+                throw new InvalidOperationException(String.Format("Application with AppId '{0}' does not exist.", applicationId));
+            }
+            return app.ObjectId;
+        }
     }
 }

src/ResourceManager/Resources/Commands.Resources/ActiveDirectory/UpdateAzureADServicePrincipalCommand.cs

@@ -164,7 +164,7 @@ AzureRM.Resources
 * Revert change to `New-AzureRmADServicePrincipal` that gave service principals `Contributor` permissions over the current subscription if no values were provided for the `Role` or `Scope` parameters
     - If no values are provided for `Role` or `Scope`, the service principal is created with no permissions
     - If a `Role` is provided, but no `Scope`, the service principal is created with the specified `Role` permissions over the current subscription
-    - If a `Scope` is provided, but no `Scope`, the service principal is created with `Contributor` permissions over the specified `Scope`
+    - If a `Scope` is provided, but no `Role`, the service principal is created with `Contributor` permissions over the specified `Scope`
     - If both `Role` and `Scope` are provided, the service principal is created with the specified `Role` permissions over the specified `Scope`
 '