Skip to content

Commit cc0879d

Browse files
yanjungao718msJinLei
yanjungao718
and
msJinLei
authored
Migrate Azure AD features in Az.Synapse to MSGraph API (#16713)
* Migrate AAD Graph to MS Graph and update help doc -Set-AzSynapseSqlActiveDirectoryAdministrator -New-AzSynapseRoleAssignment -Get-AzSynapseRoleAssignment -Remove-AzSynapseRoleAssignment * Update Get-AzSynapseRoleAssignment.md * Update New-AzSynapseRoleAssignment.md * Update Set-AzSynapseSqlActiveDirectoryAdministrator.md * Update Remove-AzSynapseRoleAssignment.md Co-authored-by: Jin Lei <[email protected]>
1 parent 2d1a372 commit cc0879d

File tree

7 files changed

+74
-42
lines changed

7 files changed

+74
-42
lines changed

‎src/Synapse/Synapse/ChangeLog.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@
2020

2121
## Upcoming Release
2222
* General availability of Az.Synapse
23+
* Migrated Azure AD features in Az.Synapse to MSGraph APIs. The cmdlets below called MSGraph API according to input parameters:
24+
- `New-AzSynapseRoleAssignment` cmdlet
25+
- `Get-AzSynapseRoleAssignment` cmdlet
26+
- `Remove-AzSynapseRoleAssignment` cmdlet
27+
- `Set-AzSynapseSqlActiveDirectoryAdministrator` cmdlet
2328
* Added a default value for [-AutoPauseDelayInMinute] parameter of command `New-AzSynapseSparkpool` and `Update-AzSynapseSparkpool`
2429

2530
## Version 0.19.0

‎src/Synapse/Synapse/Models/DataPlaneModels/AccessControl/SynapseAnalyticsRoleClient.cs

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,15 @@
1414

1515
using Azure.Analytics.Synapse.AccessControl;
1616
using Azure.Analytics.Synapse.AccessControl.Models;
17+
using Microsoft.Azure.Commands.Common.Authentication;
1718
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
1819
using Microsoft.Azure.Commands.Common.Exceptions;
20+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0;
21+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Applications;
22+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Applications.Models;
23+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Users.Models;
1924
using Microsoft.Azure.Commands.Synapse.Common;
2025
using Microsoft.Azure.Commands.Synapse.Properties;
21-
using Microsoft.Azure.Graph.RBAC.Version1_6;
22-
using Microsoft.Azure.Graph.RBAC.Version1_6.ActiveDirectory;
23-
using Microsoft.Azure.Graph.RBAC.Version1_6.Models;
2426
using System;
2527
using System.Collections.Generic;
2628
using System.Linq;
@@ -31,7 +33,7 @@ public class SynapseAnalyticsRoleClient
3133
{
3234
private readonly RoleAssignmentsClient _roleAssignmentsClient;
3335
private readonly RoleDefinitionsClient _roleDefinitionsClient;
34-
private readonly ActiveDirectoryClient _activeDirectoryClient;
36+
private readonly MicrosoftGraphClient _graphClient;
3537

3638
public SynapseAnalyticsRoleClient(string workspaceName, IAzureContext context)
3739
{
@@ -44,7 +46,8 @@ public SynapseAnalyticsRoleClient(string workspaceName, IAzureContext context)
4446
Uri uri = new Uri("https://" + workspaceName + "." + suffix);
4547
_roleAssignmentsClient = new RoleAssignmentsClient(uri, new AzureSessionCredential(context));
4648
_roleDefinitionsClient = new RoleDefinitionsClient(uri, new AzureSessionCredential(context));
47-
_activeDirectoryClient = new ActiveDirectoryClient(context);
49+
_graphClient = AzureSession.Instance.ClientFactory.CreateArmClient<MicrosoftGraphClient>(context, AzureEnvironment.ExtendedEndpoint.MicrosoftGraphUrl);
50+
_graphClient.TenantID = context.Tenant.Id.ToString();
4851
}
4952

5053
public IReadOnlyList<RoleAssignmentDetails> ListRoleAssignments(string roleDefinitionId = null, string objectId = null, string scope = null)
@@ -110,14 +113,15 @@ public string GetObjectIdFromSignInName(string signInName)
110113
return null;
111114
}
112115

113-
var odataQueryFilter = new Rest.Azure.OData.ODataQuery<User>(s => s.UserPrincipalName == signInName);
114-
var user = _activeDirectoryClient.GraphClient.Users.List(odataQueryFilter.ToString()).SingleOrDefault();
116+
var odataQueryFilter = new Rest.Azure.OData.ODataQuery<MicrosoftGraphUser>(s => s.UserPrincipalName == signInName);
117+
var user = _graphClient.FilterUsers(odataQueryFilter).SingleOrDefault();
118+
115119
if (user == null)
116120
{
117121
throw new AzPSInvalidOperationException(String.Format(Resources.UserNameDoesNotExist, signInName));
118122
}
119123

120-
return user.ObjectId;
124+
return user.Id;
121125
}
122126

123127
public string GetObjectIdFromServicePrincipalName(string servicePrincipalName)
@@ -127,14 +131,14 @@ public string GetObjectIdFromServicePrincipalName(string servicePrincipalName)
127131
return null;
128132
}
129133

130-
var odataQueryFilter = new Rest.Azure.OData.ODataQuery<ServicePrincipal>(s => s.ServicePrincipalNames.Contains(servicePrincipalName));
131-
var servicePrincipal = _activeDirectoryClient.GraphClient.ServicePrincipals.List(odataQueryFilter.ToString()).SingleOrDefault();
134+
var odataQueryFilter = new Rest.Azure.OData.ODataQuery<MicrosoftGraphServicePrincipal>(s => s.ServicePrincipalNames.Contains(servicePrincipalName));
135+
var servicePrincipal = _graphClient.FilterServicePrincipals(odataQueryFilter).SingleOrDefault();
132136
if (servicePrincipal == null)
133137
{
134138
throw new AzPSInvalidOperationException(String.Format(Resources.ServicePrincipalNameDoesNotExist, servicePrincipalName));
135139
}
136140

137-
return servicePrincipal.ObjectId;
141+
return servicePrincipal.Id;
138142
}
139143

140144
public string GetRoleDefinitionIdFromRoleDefinitionName(string roleDefinitionName)

‎src/Synapse/Synapse/Models/ManagementModels/SynapseAnalyticsManagementClient.cs

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@
1919
using Microsoft.Azure.Commands.Synapse.Common;
2020
using Microsoft.Azure.Commands.Synapse.Properties;
2121
using Microsoft.Azure.Commands.Synapse.VulnerabilityAssessment.Model;
22-
using Microsoft.Azure.Graph.RBAC.Version1_6.ActiveDirectory;
23-
using Microsoft.Azure.Graph.RBAC.Version1_6.Models;
2422
using Microsoft.Azure.Management.Internal.Resources;
2523
using Microsoft.Azure.Management.Internal.Resources.Models;
2624
using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
@@ -30,7 +28,6 @@
3028
using Microsoft.Azure.Management.Synapse.Models;
3129
using Microsoft.Rest;
3230
using Microsoft.Rest.Azure;
33-
using Microsoft.Rest.Azure.OData;
3431
using Newtonsoft.Json;
3532
using Newtonsoft.Json.Linq;
3633
using System;
@@ -51,6 +48,10 @@
5148
using ErrorResponseException = Microsoft.Azure.Management.Synapse.Models.ErrorResponseException;
5249
using Microsoft.Azure.Commands.Synapse.Models.Auditing;
5350
using Microsoft.DataTransfer.Gateway.Encryption;
51+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0;
52+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Applications.Models;
53+
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Groups.Models;
54+
using Microsoft.Rest.Azure.OData;
5455

5556
namespace Microsoft.Azure.Commands.Synapse.Models
5657
{
@@ -62,7 +63,7 @@ public class SynapseAnalyticsManagementClient
6263
private readonly Guid _tenantId;
6364
private readonly SynapseManagementClient _synapseManagementClient;
6465
private readonly SynapseSqlV3ManagementClient _synapseSqlV3ManagementClient;
65-
private ActiveDirectoryClient _activeDirectoryClient;
66+
private MicrosoftGraphClient _graphClient;
6667
private ResourceManagementClient _resourceManagementClient;
6768
private StorageManagementClient _storageManagementClient;
6869
private MonitorManagementClient _monitorManagementClient;
@@ -88,20 +89,20 @@ public SynapseAnalyticsManagementClient(IAzureContext context)
8889

8990
_monitorManagementClient = SynapseCmdletBase.CreateSynapseClient<MonitorManagementClient>(context,
9091
AzureEnvironment.Endpoint.ResourceManager);
91-
}
92+
}
9293

93-
public ActiveDirectoryClient ActiveDirectoryClient
94+
public MicrosoftGraphClient GraphClient
9495
{
9596
get
9697
{
97-
if (_activeDirectoryClient == null)
98-
{
99-
_activeDirectoryClient = new ActiveDirectoryClient(Context);
98+
if (_graphClient == null) {
99+
_graphClient = AzureSession.Instance.ClientFactory.CreateArmClient<MicrosoftGraphClient>(Context, AzureEnvironment.ExtendedEndpoint.MicrosoftGraphUrl);
100+
_graphClient.TenantID = Context.Tenant.Id.ToString();
100101
}
101-
return this._activeDirectoryClient;
102+
return this._graphClient;
102103
}
103-
104-
set { this._activeDirectoryClient = value; }
104+
105+
set { this._graphClient = value; }
105106
}
106107

107108
public ResourceManagementClient ResourceManagementClient
@@ -422,19 +423,20 @@ private WorkspaceAadAdminInfo GetActiveDirectoryInformation(string displayName,
422423
Guid tenantId = _tenantId;
423424

424425
// Check for a Azure Active Directory group. Recommended to always use group.
425-
IEnumerable<PSADGroup> groupList = null;
426-
PSADGroup group = null;
426+
IEnumerable<MicrosoftGraphGroup> groupList = null;
427427

428-
var filter = new ADObjectFilterOptions()
428+
MicrosoftGraphGroup group = null;
429+
430+
var filter = new MicrosoftObjectFilterOptions()
429431
{
430432
Id = (objectId != null && objectId != Guid.Empty) ? objectId.ToString() : null,
431433
SearchString = displayName,
432434
Paging = true,
433435
};
434436

435437
// Get a list of groups from Azure Active Directory
436-
groupList = ActiveDirectoryClient.FilterGroups(filter).Where(gr => string.Equals(gr.DisplayName, displayName, StringComparison.OrdinalIgnoreCase));
437-
438+
groupList = GraphClient.FilterGroups(filter).Where(gr => string.Equals(gr.DisplayName, displayName, StringComparison.OrdinalIgnoreCase));
439+
438440
if (groupList != null && groupList.Count() > 1)
439441
{
440442
// More than one group was found with that display name.
@@ -453,19 +455,19 @@ private WorkspaceAadAdminInfo GetActiveDirectoryInformation(string displayName,
453455
}
454456

455457
// Lookup for serviceprincipals
456-
ODataQuery<ServicePrincipal> odataQueryFilter;
458+
ODataQuery<MicrosoftGraphServicePrincipal> odataQueryFilter;
457459

458460
if ((objectId != null && objectId != Guid.Empty))
459461
{
460462
var applicationIdString = objectId.ToString();
461-
odataQueryFilter = new Rest.Azure.OData.ODataQuery<ServicePrincipal>(a => a.AppId == applicationIdString);
463+
odataQueryFilter = new ODataQuery<MicrosoftGraphServicePrincipal>(a => a.AppId == applicationIdString);
462464
}
463465
else
464-
{
465-
odataQueryFilter = new Rest.Azure.OData.ODataQuery<ServicePrincipal>(a => a.DisplayName == displayName);
466+
{
467+
odataQueryFilter = new ODataQuery<MicrosoftGraphServicePrincipal>(a => a.DisplayName == displayName);
466468
}
467-
468-
var servicePrincipalList = ActiveDirectoryClient.FilterServicePrincipals(odataQueryFilter);
469+
470+
var servicePrincipalList = GraphClient.FilterServicePrincipals(odataQueryFilter);
469471

470472
if (servicePrincipalList != null && servicePrincipalList.Count() > 1)
471473
{
@@ -475,7 +477,7 @@ private WorkspaceAadAdminInfo GetActiveDirectoryInformation(string displayName,
475477
else if (servicePrincipalList != null && servicePrincipalList.Count() == 1)
476478
{
477479
// Only one user was found. Get the user display name and object id
478-
PSADServicePrincipal app = servicePrincipalList.First();
480+
MicrosoftGraphServicePrincipal app = servicePrincipalList.FirstOrDefault();
479481

480482
if (displayName != null && string.CompareOrdinal(displayName, app.DisplayName) != 0)
481483
{
@@ -490,7 +492,7 @@ private WorkspaceAadAdminInfo GetActiveDirectoryInformation(string displayName,
490492
return new WorkspaceAadAdminInfo()
491493
{
492494
Login = displayName,
493-
Sid = app.ApplicationId.ToString(),
495+
Sid = app.AppId.ToString(),
494496
TenantId = tenantId.ToString()
495497
};
496498
}
@@ -506,42 +508,42 @@ private WorkspaceAadAdminInfo GetActiveDirectoryInformation(string displayName,
506508
}
507509

508510
// No group or service principal was found. Check for a user
509-
filter = new ADObjectFilterOptions()
511+
filter = new MicrosoftObjectFilterOptions()
510512
{
511513
Id = (objectId != null && objectId != Guid.Empty) ? objectId.ToString() : null,
512514
SearchString = displayName,
513515
Paging = true,
514516
};
515517

516518
// Get a list of user from Azure Active Directory
517-
var userList = ActiveDirectoryClient.FilterUsers(filter).Where(gr => string.Equals(gr.DisplayName, displayName, StringComparison.OrdinalIgnoreCase));
519+
var userList = GraphClient.FilterUsers(filter).Where(gr => string.Equals(gr.DisplayName, displayName, StringComparison.OrdinalIgnoreCase));
518520

519521
// No user was found. Check if the display name is a UPN
520522
if (userList == null || userList.Count() == 0)
521523
{
522524
// Check if the display name is the UPN
523-
filter = new ADObjectFilterOptions()
525+
filter = new MicrosoftObjectFilterOptions()
524526
{
525527
Id = (objectId != null && objectId != Guid.Empty) ? objectId.ToString() : null,
526528
UPN = displayName,
527529
Paging = true,
528530
};
529531

530-
userList = ActiveDirectoryClient.FilterUsers(filter).Where(gr => string.Equals(gr.UserPrincipalName, displayName, StringComparison.OrdinalIgnoreCase));
532+
userList = GraphClient.FilterUsers(filter).Where(gr => string.Equals(gr.UserPrincipalName, displayName, StringComparison.OrdinalIgnoreCase));
531533
}
532534

533535
// No user was found. Check if the display name is a guest user.
534536
if (userList == null || userList.Count() == 0)
535537
{
536538
// Check if the display name is the UPN
537-
filter = new ADObjectFilterOptions()
539+
filter = new MicrosoftObjectFilterOptions()
538540
{
539541
Id = (objectId != null && objectId != Guid.Empty) ? objectId.ToString() : null,
540542
Mail = displayName,
541543
Paging = true,
542544
};
543545

544-
userList = ActiveDirectoryClient.FilterUsers(filter);
546+
userList = GraphClient.FilterUsers(filter);
545547
}
546548

547549
// No user was found

‎src/Synapse/Synapse/help/Get-AzSynapseRoleAssignment.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,11 @@ Get-AzSynapseRoleAssignment -WorkspaceObject <PSSynapseWorkspace> [-RoleDefiniti
8484
The **Get-AzSynapseRoleAssignment** cmdlet gets a Azure Synapse Analytics Role Assignment.
8585
If you do not specify a role definition or a user principal name, this cmdlet gets all role assignment.
8686

87+
The cmdlet may call below Microsoft Graph API according to input parameters:
88+
89+
* GET /users/{id}
90+
* GET /servicePrincipals/{id}
91+
8792
## EXAMPLES
8893

8994
### Example 1

‎src/Synapse/Synapse/help/New-AzSynapseRoleAssignment.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ New-AzSynapseRoleAssignment -WorkspaceObject <PSSynapseWorkspace> -RoleDefinitio
7171
## DESCRIPTION
7272
The **New-AzSynapseRoleAssignment** cmdlet creates an Azure Synapse Analytics role assignment.
7373

74+
The cmdlet may call below Microsoft Graph API according to input parameters:
75+
76+
* GET /users/{id}
77+
* GET /servicePrincipals/{id}
78+
7479
## EXAMPLES
7580

7681
### Example 1

‎src/Synapse/Synapse/help/Remove-AzSynapseRoleAssignment.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,11 @@ Remove-AzSynapseRoleAssignment -WorkspaceObject <PSSynapseWorkspace> -RoleDefini
8383
## DESCRIPTION
8484
The **Remove-AzSynapseRoleAssignment** cmdlet permanently deletes an Azure Synapse Analytics role assignment.
8585

86+
The cmdlet may call below Microsoft Graph API according to input parameters:
87+
88+
* GET /users/{id}
89+
* GET /servicePrincipals/{id}
90+
8691
## EXAMPLES
8792

8893
### Example 1

‎src/Synapse/Synapse/help/Set-AzSynapseSqlActiveDirectoryAdministrator.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,12 @@ Microsoft accounts, such as those in the Outlook.com, Hotmail.com, or Live.com d
6161
Other guest accounts, such as those in the Gmail.com or Yahoo.com domains, are not supported as administrators.
6262
We recommend that you provision a dedicated Azure AD group as an administrator.
6363

64+
The cmdlet may call below Microsoft Graph API according to input parameters:
65+
66+
* GET /users/{id}
67+
* GET /servicePrincipals/{id}
68+
* GET /groups/{id}
69+
6470
## EXAMPLES
6571

6672
### Example 1

0 commit comments

Comments
 (0)