Skip to content

Commit 8c041a4

Browse files
markcowlmarkcowl
committed
Merge pull request #970 from shuagarw/parameterAndBugFixes
Parameter and bug fixes in Role Assignment commands
2 parents b7a4473 + 2bc9f92 commit 8c041a4

17 files changed

+213
-310
lines changed

‎src/ResourceManager/Resources/Commands.Resources.Test/Commands.Resources.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
</Reference>
6363
<Reference Include="Microsoft.Azure.Graph.RBAC">
6464
<SpecificVersion>False</SpecificVersion>
65-
<HintPath>..\..\..\packages\Microsoft.Azure.Graph.RBAC.1.7.0-preview\lib\net40\Microsoft.Azure.Graph.RBAC.dll</HintPath>
65+
<HintPath>..\..\..\packages\Microsoft.Azure.Graph.RBAC.1.7.1-preview\lib\net40\Microsoft.Azure.Graph.RBAC.dll</HintPath>
6666
</Reference>
6767
<Reference Include="Microsoft.Azure.Insights">
6868
<HintPath>..\..\..\packages\Microsoft.Azure.Insights.0.7.7-preview\lib\net45\Microsoft.Azure.Insights.dll</HintPath>

‎src/ResourceManager/Resources/Commands.Resources/Commands.Resources.csproj

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
</Reference>
6767
<Reference Include="Microsoft.Azure.Graph.RBAC">
6868
<SpecificVersion>False</SpecificVersion>
69-
<HintPath>..\..\..\packages\Microsoft.Azure.Graph.RBAC.1.7.0-preview\lib\net40\Microsoft.Azure.Graph.RBAC.dll</HintPath>
69+
<HintPath>..\..\..\packages\Microsoft.Azure.Graph.RBAC.1.7.1-preview\lib\net40\Microsoft.Azure.Graph.RBAC.dll</HintPath>
7070
</Reference>
7171
<Reference Include="Microsoft.Azure.Management.Authorization">
7272
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Authorization.1.0.0\lib\net40\Microsoft.Azure.Management.Authorization.dll</HintPath>
@@ -165,9 +165,6 @@
165165
<Compile Include="Models.Authorization\FilterRoleAssignmentsOptions.cs" />
166166
<Compile Include="Models.ActiveDirectory\ActiveDirectoryClient.cs" />
167167
<Compile Include="Models.Authorization\AuthorizationClientExtensions.cs" />
168-
<Compile Include="Models.Authorization\PSGroupRoleAssignment.cs" />
169-
<Compile Include="Models.Authorization\PSServiceRoleAssignment.cs" />
170-
<Compile Include="Models.Authorization\PSUserRoleAssignment.cs" />
171168
<Compile Include="Models.Authorization\PSRoleAssignment.cs" />
172169
<Compile Include="Models.Authorization\PSRoleDefinition.cs" />
173170
<Compile Include="Models.Authorization\PSPermission.cs" />

‎src/ResourceManager/Resources/Commands.Resources/Models.ActiveDirectory/ADObjectFilterOptions.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ public class ADObjectFilterOptions
1919
{
2020
public string SearchString { get; set; }
2121

22+
public string SignInName { get; set; }
23+
2224
public string Mail { get; set; }
2325

2426
public string UPN { get; set; }
@@ -48,6 +50,8 @@ public string ActiveFilter
4850
return SPN;
4951
else if (!string.IsNullOrEmpty(Mail))
5052
return Mail;
53+
else if (!string.IsNullOrEmpty(SignInName))
54+
return SignInName;
5155
else if (!string.IsNullOrEmpty(SearchString))
5256
return SearchString;
5357
else

‎src/ResourceManager/Resources/Commands.Resources/Models.ActiveDirectory/ActiveDirectoryClient.cs

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ public PSADObject GetADObject(ADObjectFilterOptions options)
4747

4848
Debug.Assert(options != null);
4949

50-
if (IsSet(options.Mail, options.UPN, options.Id))
50+
if (IsSet(options.SignInName, options.Mail, options.UPN, options.Id))
5151
{
5252
result = FilterUsers(options).FirstOrDefault();
5353
}
@@ -163,11 +163,11 @@ public List<PSADUser> FilterUsers(ADObjectFilterOptions options)
163163
users.Add(user.ToPSADUser());
164164
}
165165
}
166-
else if (!string.IsNullOrEmpty(options.Mail))
166+
else if (!string.IsNullOrEmpty(options.Mail) || !string.IsNullOrEmpty(options.SignInName))
167167
{
168168
try
169169
{
170-
user = GraphClient.User.GetBySignInName(options.Mail).Users.FirstOrDefault();
170+
user = GraphClient.User.GetBySignInName(Normalize(options.Mail) ?? Normalize(options.SignInName)).Users.FirstOrDefault();
171171
}
172172
catch { /* The user does not exist, ignore the exception. */ }
173173

@@ -225,6 +225,14 @@ public List<PSADObject> ListUserGroups(string principal)
225225
return result;
226226
}
227227

228+
public List<PSADObject> GetObjectsByObjectId(List<string> objectIds)
229+
{
230+
List<PSADObject> result = new List<PSADObject>();
231+
var adObjects = GraphClient.Objects.GetObjectsByObjectIds(new GetObjectsParameters { Ids = objectIds }).AADObject;
232+
result.AddRange(adObjects.Select(o => o.ToPSADObject()));
233+
return result;
234+
}
235+
228236
public List<PSADGroup> FilterGroups(ADObjectFilterOptions options)
229237
{
230238
List<PSADGroup> groups = new List<PSADGroup>();

‎src/ResourceManager/Resources/Commands.Resources/Models.ActiveDirectory/ActiveDirectoryClientExtensions.cs

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ public static PSADObject ToPSADObject(this AADObject obj)
5151
Id = new Guid(obj.ObjectId),
5252
Type = obj.ObjectType,
5353
UserPrincipalName = obj.UserPrincipalName,
54+
SignInName = obj.SignInName,
5455
Mail = obj.Mail
5556
};
5657
}
@@ -66,6 +67,16 @@ public static PSADObject ToPSADObject(this AADObject obj)
6667
};
6768

6869
}
70+
else if (obj.ObjectType == typeof(ServicePrincipal).Name)
71+
{
72+
return new PSADServicePrincipal()
73+
{
74+
DisplayName = obj.DisplayName,
75+
Id = new Guid(obj.ObjectId),
76+
Type = obj.ObjectType,
77+
ServicePrincipalName = obj.ServicePrincipalNames.FirstOrDefault()
78+
};
79+
}
6980
else
7081
{
7182
return new PSADObject()
@@ -93,7 +104,8 @@ public static PSADUser ToPSADUser(this User user)
93104
DisplayName = user.DisplayName,
94105
Id = new Guid(user.ObjectId),
95106
UserPrincipalName = user.UserPrincipalName,
96-
Mail = user.SignInName
107+
Mail = user.SignInName,
108+
SignInName = user.SignInName
97109
};
98110
}
99111

‎src/ResourceManager/Resources/Commands.Resources/Models.ActiveDirectory/PSADUser.cs

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,7 @@ public class PSADUser : PSADObject
1919
public string UserPrincipalName { get; set; }
2020

2121
public string Mail { get; set; }
22+
23+
public string SignInName { get; set; }
2224
}
2325
}

‎src/ResourceManager/Resources/Commands.Resources/Models.ActiveDirectory/ParameterSet.cs

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,38 +22,34 @@ internal static class ParameterSet
2222

2323
public const string SPN = "SPNParameterSet";
2424

25+
public const string SignInName = "SignInNameParameterSet";
26+
2527
public const string SearchString = "SearchStringParameterSet";
2628

2729
public const string ObjectId = "ObjectIdParameterSet";
2830

2931
public const string Scope = "ScopeParameterSet";
3032

31-
public const string ScopeWithMail = "ScopeWithMailParameterSet";
32-
33-
public const string ScopeWithUPN = "ScopeWithUPNParameterSet";
34-
3533
public const string ScopeWithSPN = "ScopeWithSPNParameterSet";
3634

35+
public const string ScopeWithSignInName = "ScopeWithSignInNameParameterSet";
36+
3737
public const string ScopeWithObjectId = "ScopeWithObjectIdParameterSet";
3838

3939
public const string ResourceGroup = "ResourceGroupParameterSet";
4040

41-
public const string ResourceGroupWithMail = "ResourceGroupWithMailParameterSet";
42-
43-
public const string ResourceGroupWithUPN = "ResourceGroupWithUPNParameterSet";
44-
4541
public const string ResourceGroupWithSPN = "ResourceGroupWithSPNParameterSet";
4642

4743
public const string ResourceGroupWithObjectId = "ResourceGroupWithObjectIdParameterSet";
4844

49-
public const string Resource = "ResourceParameterSet";
50-
51-
public const string ResourceWithMail = "ResourceWithMailParameterSet";
45+
public const string ResourceGroupWithSignInName = "ResourceGroupWithSignInNameParameterSet";
5246

53-
public const string ResourceWithUPN = "ResourceWithUPNParameterSet";
47+
public const string Resource = "ResourceParameterSet";
5448

5549
public const string ResourceWithSPN = "ResourceWithSPNParameterSet";
5650

51+
public const string ResourceWithSignInName = "ResourceWithSignInNameParameterSet";
52+
5753
public const string ResourceWithObjectId = "ResourceWithObjectIdParameterSet";
5854

5955
public const string ApplicationWithoutCredential = "ApplicationWithoutCredentialParameterSet";

‎src/ResourceManager/Resources/Commands.Resources/Models.Authorization/AuthorizationClient.cs

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ public PSRoleDefinition GetRoleDefinition(string roleId)
6868

6969
/// <summary>
7070
/// Filters the existing role Definitions.
71+
/// If name is not provided, all role definitions are fetched.
7172
/// </summary>
7273
/// <param name="name">The role name</param>
7374
/// <returns>The matched role Definitions</returns>
@@ -122,7 +123,11 @@ public PSRoleAssignment CreateRoleAssignment(FilterRoleAssignmentsOptions parame
122123
};
123124

124125
AuthorizationManagementClient.RoleAssignments.Create(parameters.Scope, roleAssignmentId, createParameters);
125-
return AuthorizationManagementClient.RoleAssignments.Get(parameters.Scope, roleAssignmentId).RoleAssignment.ToPSRoleAssignment(this, ActiveDirectoryClient);
126+
127+
RoleAssignment assignment = AuthorizationManagementClient.RoleAssignments.Get(parameters.Scope, roleAssignmentId).RoleAssignment;
128+
IEnumerable<RoleAssignment> assignments = new List<RoleAssignment>() { assignment };
129+
130+
return assignments.ToPSRoleAssignments(this, ActiveDirectoryClient).FirstOrDefault();
126131
}
127132

128133
/// <summary>
@@ -159,9 +164,10 @@ public List<PSRoleAssignment> FilterRoleAssignments(FilterRoleAssignmentsOptions
159164
{
160165
parameters.PrincipalId = string.IsNullOrEmpty(options.ADObjectFilter.Id) ? adObject.Id : Guid.Parse(options.ADObjectFilter.Id);
161166
}
162-
167+
163168
result.AddRange(AuthorizationManagementClient.RoleAssignments.List(parameters)
164-
.RoleAssignments.Select(r => r.ToPSRoleAssignment(this, ActiveDirectoryClient, options.ExcludeAssignmentsForDeletedPrincipals)).Where(r => r != null));
169+
.RoleAssignments.ToPSRoleAssignments(this, ActiveDirectoryClient, options.ExcludeAssignmentsForDeletedPrincipals));
170+
165171

166172
// Filter out by scope
167173
if (!string.IsNullOrEmpty(options.Scope))
@@ -173,13 +179,14 @@ public List<PSRoleAssignment> FilterRoleAssignments(FilterRoleAssignmentsOptions
173179
{
174180
// Filter by scope and above directly
175181
parameters.AtScope = true;
182+
176183
result.AddRange(AuthorizationManagementClient.RoleAssignments.ListForScope(options.Scope, parameters)
177-
.RoleAssignments.Select(r => r.ToPSRoleAssignment(this, ActiveDirectoryClient, options.ExcludeAssignmentsForDeletedPrincipals)).Where(r => r != null));
184+
.RoleAssignments.ToPSRoleAssignments(this, ActiveDirectoryClient, options.ExcludeAssignmentsForDeletedPrincipals));
178185
}
179186
else
180187
{
181188
result.AddRange(AuthorizationManagementClient.RoleAssignments.List(parameters)
182-
.RoleAssignments.Select(r => r.ToPSRoleAssignment(this, ActiveDirectoryClient, options.ExcludeAssignmentsForDeletedPrincipals)).Where(r => r != null));
189+
.RoleAssignments.ToPSRoleAssignments(this, ActiveDirectoryClient, options.ExcludeAssignmentsForDeletedPrincipals));
183190
}
184191

185192
if (!string.IsNullOrEmpty(options.RoleDefinition))
@@ -204,7 +211,8 @@ public List<PSRoleAssignment> FilterRoleAssignments(FilterRoleAssignmentsOptions
204211
var userObject = adObject as PSADUser;
205212
classicAdministratorsAssignments = classicAdministratorsAssignments.Where(c =>
206213
c.DisplayName.Equals(userObject.UserPrincipalName, StringComparison.OrdinalIgnoreCase) ||
207-
c.DisplayName.Equals(userObject.Mail, StringComparison.OrdinalIgnoreCase)).ToList();
214+
c.DisplayName.Equals(userObject.Mail, StringComparison.OrdinalIgnoreCase) ||
215+
c.DisplayName.Equals(userObject.SignInName, StringComparison.OrdinalIgnoreCase)).ToList();
208216
}
209217

210218
result.AddRange(classicAdministratorsAssignments);

‎src/ResourceManager/Resources/Commands.Resources/Models.Authorization/AuthorizationClientExtensions.cs

Lines changed: 74 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -44,69 +44,82 @@ public static PSRoleDefinition ToPSRoleDefinition(this RoleDefinition role)
4444
return roleDefinition;
4545
}
4646

47-
public static PSRoleAssignment ToPSRoleAssignment(this RoleAssignment role, AuthorizationClient policyClient, ActiveDirectoryClient activeDirectoryClient, bool excludeAssignmentsForDeletedPrincipals = true)
47+
public static IEnumerable<PSRoleAssignment> ToPSRoleAssignments(this IEnumerable<RoleAssignment> assignments, AuthorizationClient policyClient, ActiveDirectoryClient activeDirectoryClient, bool excludeAssignmentsForDeletedPrincipals = true)
4848
{
49-
PSRoleDefinition roleDefinition = policyClient.GetRoleDefinition(role.Properties.RoleDefinitionId);
50-
PSADObject adObject = activeDirectoryClient.GetADObject(new ADObjectFilterOptions { Id = role.Properties.PrincipalId.ToString() }) ?? new PSADObject() { Id = role.Properties.PrincipalId };
51-
52-
if (adObject is PSADUser)
49+
List<PSRoleAssignment> psAssignments = new List<PSRoleAssignment>();
50+
if(assignments ==null || !assignments.Any())
5351
{
54-
return new PSUserRoleAssignment()
55-
{
56-
RoleAssignmentId = role.Id,
57-
DisplayName = adObject.DisplayName,
58-
Actions = roleDefinition.Actions,
59-
NotActions = roleDefinition.NotActions,
60-
RoleDefinitionName = roleDefinition.Name,
61-
Scope = role.Properties.Scope,
62-
UserPrincipalName = ((PSADUser)adObject).UserPrincipalName,
63-
Mail = ((PSADUser)adObject).Mail,
64-
ObjectId = adObject.Id
65-
};
52+
return psAssignments;
6653
}
67-
else if (adObject is PSADGroup)
54+
55+
List<string> objectIds = new List<string>();
56+
objectIds.AddRange(assignments.Select(r => r.Properties.PrincipalId.ToString()));
57+
List<PSADObject> adObjects = activeDirectoryClient.GetObjectsByObjectId(objectIds);
58+
59+
List<PSRoleDefinition> roleDefinitions = policyClient.FilterRoleDefinitions(name: null);
60+
61+
foreach (RoleAssignment assignment in assignments)
6862
{
69-
return new PSGroupRoleAssignment()
63+
PSADObject adObject = adObjects.SingleOrDefault(o => o.Id == assignment.Properties.PrincipalId) ?? new PSADObject() { Id = assignment.Properties.PrincipalId };
64+
PSRoleDefinition roleDefinition = roleDefinitions.SingleOrDefault(r => r.Id == assignment.Properties.RoleDefinitionId) ?? new PSRoleDefinition() { Id = assignment.Properties.RoleDefinitionId };
65+
66+
if (adObject is PSADUser)
7067
{
71-
RoleAssignmentId = role.Id,
72-
DisplayName = adObject.DisplayName,
73-
Actions = roleDefinition.Actions,
74-
NotActions = roleDefinition.NotActions,
75-
RoleDefinitionName = roleDefinition.Name,
76-
Scope = role.Properties.Scope,
77-
Mail = ((PSADGroup)adObject).Mail,
78-
ObjectId = adObject.Id
79-
};
80-
}
81-
else if (adObject is PSADServicePrincipal)
82-
{
83-
return new PSServiceRoleAssignment()
68+
psAssignments.Add(new PSRoleAssignment()
69+
{
70+
RoleAssignmentId = assignment.Id,
71+
DisplayName = adObject.DisplayName,
72+
RoleDefinitionId = roleDefinition.Id.GuidFromFullyQualifiedId(),
73+
RoleDefinitionName = roleDefinition.Name,
74+
Scope = assignment.Properties.Scope,
75+
SignInName = ((PSADUser)adObject).SignInName,
76+
ObjectId = adObject.Id,
77+
ObjectType = adObject.Type
78+
});
79+
}
80+
else if (adObject is PSADGroup)
8481
{
85-
RoleAssignmentId = role.Id,
86-
DisplayName = adObject.DisplayName,
87-
Actions = roleDefinition.Actions,
88-
NotActions = roleDefinition.NotActions,
89-
RoleDefinitionName = roleDefinition.Name,
90-
Scope = role.Properties.Scope,
91-
ServicePrincipalName = ((PSADServicePrincipal)adObject).ServicePrincipalName,
92-
ObjectId = adObject.Id
93-
};
94-
}
95-
else if (!excludeAssignmentsForDeletedPrincipals)
96-
{
97-
return new PSRoleAssignment()
82+
psAssignments.Add(new PSRoleAssignment()
83+
{
84+
RoleAssignmentId = assignment.Id,
85+
DisplayName = adObject.DisplayName,
86+
RoleDefinitionId = roleDefinition.Id.GuidFromFullyQualifiedId(),
87+
RoleDefinitionName = roleDefinition.Name,
88+
Scope = assignment.Properties.Scope,
89+
ObjectId = adObject.Id,
90+
ObjectType = adObject.Type
91+
});
92+
}
93+
else if (adObject is PSADServicePrincipal)
9894
{
99-
RoleAssignmentId = role.Id,
100-
DisplayName = adObject.DisplayName,
101-
Actions = roleDefinition.Actions,
102-
NotActions = roleDefinition.NotActions,
103-
RoleDefinitionName = roleDefinition.Name,
104-
Scope = role.Properties.Scope,
105-
ObjectId = adObject.Id
106-
};
95+
psAssignments.Add(new PSRoleAssignment()
96+
{
97+
RoleAssignmentId = assignment.Id,
98+
DisplayName = adObject.DisplayName,
99+
RoleDefinitionId = roleDefinition.Id.GuidFromFullyQualifiedId(),
100+
RoleDefinitionName = roleDefinition.Name,
101+
Scope = assignment.Properties.Scope,
102+
ObjectId = adObject.Id,
103+
ObjectType = adObject.Type
104+
});
105+
}
106+
else if (!excludeAssignmentsForDeletedPrincipals)
107+
{
108+
psAssignments.Add(new PSRoleAssignment()
109+
{
110+
RoleAssignmentId = assignment.Id,
111+
DisplayName = adObject.DisplayName,
112+
RoleDefinitionId = roleDefinition.Id.GuidFromFullyQualifiedId(),
113+
RoleDefinitionName = roleDefinition.Name,
114+
Scope = assignment.Properties.Scope,
115+
ObjectId = adObject.Id,
116+
});
117+
}
118+
119+
// Ignore the assignment if principal does not exists and excludeAssignmentsForDeletedPrincipals is set to true
107120
}
108121

109-
return null;
122+
return psAssignments;
110123
}
111124

112125
public static PSRoleAssignment ToPSRoleAssignment(this ClassicAdministrator classicAdministrator, string currentSubscriptionId)
@@ -115,9 +128,15 @@ public static PSRoleAssignment ToPSRoleAssignment(this ClassicAdministrator clas
115128
{
116129
RoleDefinitionName = classicAdministrator.Properties.Role,
117130
DisplayName = classicAdministrator.Properties.EmailAddress,
131+
SignInName = classicAdministrator.Properties.EmailAddress,
118132
Scope = "/subscriptions/" + currentSubscriptionId,
119-
Actions = new List<string>() {"*"}
133+
ObjectType = "User"
120134
};
121135
}
136+
137+
private static string GuidFromFullyQualifiedId(this string Id)
138+
{
139+
return Id.TrimEnd('/').Substring(Id.LastIndexOf('/') + 1);
140+
}
122141
}
123142
}

0 commit comments

Comments
 (0)