[Synapse] Add access control cmdlets

src/Synapse/Synapse/Az.Synapse.psd1

@@ -57,7 +57,8 @@ RequiredModules = @(@{ModuleName = 'Az.Accounts'; ModuleVersion = '1.9.0'; })
 
 # Assemblies that must be loaded prior to importing this module
 RequiredAssemblies = 'Microsoft.Azure.Management.Synapse.dll', 
-               'Azure.Analytics.Synapse.Spark.dll'
+               'Azure.Analytics.Synapse.Spark.dll',
+               'Azure.Analytics.Synapse.AccessControl.dll'
 
 # Script files (.ps1) that are run in the caller's environment prior to importing this module.
 # ScriptsToProcess = @()
@@ -89,7 +90,9 @@ CmdletsToExport = 'Get-AzSynapseSparkJob', 'Stop-AzSynapseSparkJob',
                'Update-AzSynapseSqlPool', 'Test-AzSynapseWorkspace', 
                'Test-AzSynapseSparkPool', 'Test-AzSynapseSqlPool', 
                'New-AzSynapseFirewallRule', 'Remove-AzSynapseFirewallRule', 
-               'Get-AzSynapseFirewallRule', 'Update-AzSynapseFirewallRule'
+               'Get-AzSynapseFirewallRule', 'Update-AzSynapseFirewallRule',
+               'Get-AzSynapseRoleAssignment','New-AzSynapseRoleAssignment',
+               'Remove-AzSynapseRoleAssignment','Get-AzSynapseRoleDefinition'
 
 # Variables to export from this module
 # VariablesToExport = @()

src/Synapse/Synapse/ChangeLog.md

@@ -29,6 +29,11 @@
         - Change `PluginInfo` to `Plugin`
         - Change `ErrorInfo` to `Errors`
         - Change `Log` to `LogLines`
+* Added support for operation of Synapse access control
+    - Add `Get-AzSynapseRoleDefinition` cmdlet
+    - Add `New-AzSynapseRoleAssignment` cmdlet
+    - Add `Remove-AzSynapseRoleAssignment` cmdlet
+    - Add `Get-AzSynapseRoleAssignment` cmdlet
 
 ## Version 0.1.1
 

src/Synapse/Synapse/Commands/DataPlaneCommands/AccessControl/GetAzureSynapseRoleAssignment.cs

@@ -0,0 +1,154 @@
+using Azure.Analytics.Synapse.AccessControl;
+using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
+using Microsoft.Azure.Commands.Synapse.Common;
+using Microsoft.Azure.Commands.Synapse.Models;
+using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Management.Automation;
+using System.Text;
+
+namespace Microsoft.Azure.Commands.Synapse
+{
+    [Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + SynapseConstants.SynapsePrefix + SynapseConstants.RoleAssignment,
+        DefaultParameterSetName = GetByWorkspaceNameAndNameParameterSet)]
+    [OutputType(typeof(PSRoleAssignmentDetails))]
+    public class GetAzureSynapseRoleAssignment : SynapseRoleCmdletBase
+    {
+        private const string GetByWorkspaceNameAndNameParameterSet = "GetByWorkspaceNameAndNameParameterSet";
+        private const string GetByWorkspaceNameAndIdParameterSet = "GetByWorkspaceNameAndIdParameterSet";
+        private const string GetByWorkspaceObjectAndNameParameterSet = "GetByWorkspaceObjectAndNameParameterSet";
+        private const string GetByWorkspaceObjectAndIdParameterSet = "GetByWorkspaceObjectAndIdParameterSet";
+        private const string GetByWorkspaceNameAndRoleDefinitionIdAndObjectIdParameterSet = "GetByWorkspaceNameAndRoleDefinitionIdAndObjectIdParameterSet";
+        private const string GetByWorkspaceObjectAndRoleDefinitionIdAndObjectIdParameterSet = "GetByWorkspaceObjectAndRoleDefinitionIdAndObjectIdParameterSet";
+        private const string GetByWorkspaceNameAndAssignmentIdParameterSet = "GetByWorkspaceNameAndAssignmentIdParameterSet";
+        private const string GetByWorkspaceObjectAndAssignmentIdParameterSet = "GetByWorkspaceObjectAndAssignmentIdParameterSet";
+        private const string GetByWorkspaceNameAndServicePrincipalNameParameterSet = "GetByWorkspaceNameAndServicePrincipalNameParameterSet";
+        private const string GetByWorkspaceObjectAndServicePrincipalNameParameterSet = "GetByWorkspaceObjectAndServicePrincipalNameParameterSet";
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndRoleDefinitionIdAndObjectIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndAssignmentIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndServicePrincipalNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [ResourceNameCompleter(ResourceTypes.Workspace, "ResourceGroupName")]
+        [ValidateNotNullOrEmpty]
+        public override string WorkspaceName { get; set; }
+
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndRoleDefinitionIdAndObjectIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndAssignmentIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndServicePrincipalNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [ValidateNotNull]
+        public PSSynapseWorkspace WorkspaceObject { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndAssignmentIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.RoleAssignmentId)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndAssignmentIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.RoleAssignmentId)]
+        [ValidateNotNullOrEmpty]
+        public string RoleAssignmentId { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndServicePrincipalNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndServicePrincipalNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [ValidateNotNullOrEmpty]
+        public string RoleDefinitionName { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndRoleDefinitionIdAndObjectIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.RoleDefinitionId)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndRoleDefinitionIdAndObjectIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.RoleDefinitionId)]
+        [ValidateNotNullOrEmpty]
+        public string RoleDefinitionId { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.SignInName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.SignInName)]
+        [Alias("Email", "UserPrincipalName")]
+        [ValidateNotNullOrEmpty]
+        public string SignInName { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndServicePrincipalNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.ServicePrincipalName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndServicePrincipalNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.ServicePrincipalName)]
+        [ValidateNotNullOrEmpty]
+        public string ServicePrincipalName { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.PrincipalId)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.PrincipalId)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndRoleDefinitionIdAndObjectIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.PrincipalId)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndRoleDefinitionIdAndObjectIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.PrincipalId)]
+        [Alias("Id", "PrincipalId")]
+        [ValidateNotNullOrEmpty]
+        public string ObjectId { get; set; }
+
+        public override void ExecuteCmdlet()
+        {
+            if (this.IsParameterBound(c => c.WorkspaceObject))
+            {
+                this.WorkspaceName = this.WorkspaceObject.Name;
+            }
+
+            if (this.IsParameterBound(c => c.RoleDefinitionName))
+            {
+                this.RoleDefinitionId = SynapseAnalyticsClient.GetRoleDefinitionIdFromRoleDefinitionName(this.RoleDefinitionName);
+            }
+
+            if (this.IsParameterBound(c => c.SignInName))
+            {
+                this.ObjectId = SynapseAnalyticsClient.GetObjectIdFromSignInName(this.SignInName);
+            }
+
+            if (this.IsParameterBound(c => c.ServicePrincipalName))
+            {
+                this.ObjectId = SynapseAnalyticsClient.GetObjectIdFromServicePrincipalName(this.ServicePrincipalName);
+            }
+
+            if (this.IsParameterBound(c => c.RoleAssignmentId))
+            {
+                WriteObject(new PSRoleAssignmentDetails(SynapseAnalyticsClient.GetRoleAssignmentById(this.RoleAssignmentId)));
+            }
+            else
+            {
+                var roleAssignment = SynapseAnalyticsClient.ListRoleAssignments(this.RoleDefinitionId, this.ObjectId)
+                .Select(element => new PSRoleAssignmentDetails(element));
+
+                // TODO: Currently, when only `ObjectId` is specified, the cmdlet returns incorrect result. Filter from client side as a workaround
+                if (!string.IsNullOrEmpty(this.ObjectId))
+                {
+                    roleAssignment = roleAssignment.Where(element => element.ObjectId == this.ObjectId);
+                }
+
+                WriteObject(roleAssignment, true);
+            }
+        }
+    }
+}

src/Synapse/Synapse/Commands/DataPlaneCommands/AccessControl/GetAzureSynapseRoleDefinition.cs

@@ -0,0 +1,85 @@
+using Azure.Analytics.Synapse.AccessControl.Models;
+using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
+using Microsoft.Azure.Commands.Synapse.Common;
+using Microsoft.Azure.Commands.Synapse.Models;
+using Microsoft.Azure.Commands.Synapse.Properties;
+using Microsoft.WindowsAzure.Commands.Utilities.Common;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Management.Automation;
+using System.Text;
+
+namespace Microsoft.Azure.Commands.Synapse
+{
+    [Cmdlet(VerbsCommon.Get, ResourceManager.Common.AzureRMConstants.AzureRMPrefix + SynapseConstants.SynapsePrefix + SynapseConstants.RoleDefinition,
+        DefaultParameterSetName = GetByWorkspaceNameAndIdParameterSet)]
+    [OutputType(typeof(PSSynapseRole))]
+    public class GetAzureSynapseRoleDefinition : SynapseRoleCmdletBase
+    {
+        private const string GetByWorkspaceNameAndIdParameterSet = "GetByWorkspaceNameAndIdParameterSet";
+        private const string GetByWorkspaceObjectAndIdParameterSet = "GetByWorkspaceObjectAndIdParameterSet";
+        private const string GetByWorkspaceNameAndNameParameterSet = "GetByWorkspaceNameAndNameParameterSet";
+        private const string GetByWorkspaceObjectAndNameParameterSet = "GetByWorkspaceObjectAndNameParameterSet";
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceName)]
+        [ResourceNameCompleter(ResourceTypes.Workspace, "ResourceGroupName")]
+        [ValidateNotNullOrEmpty]
+        public override string WorkspaceName { get; set; }
+
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [Parameter(ValueFromPipeline = true, ParameterSetName = GetByWorkspaceObjectAndNameParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.WorkspaceObject)]
+        [ValidateNotNull]
+        public PSSynapseWorkspace WorkspaceObject { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndIdParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionId)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndIdParameterSet,
+            Mandatory = true, HelpMessage = HelpMessages.RoleDefinitionId)]
+        [ValidateNotNullOrEmpty]
+        public string Id { get; set; }
+
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceNameAndNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [Parameter(ValueFromPipelineByPropertyName = false, ParameterSetName = GetByWorkspaceObjectAndNameParameterSet,
+            Mandatory = false, HelpMessage = HelpMessages.RoleDefinitionName)]
+        [ValidateNotNullOrEmpty]
+        public string Name { get; set; }
+
+        public override void ExecuteCmdlet()
+        {
+            if (this.IsParameterBound(c => c.WorkspaceObject))
+            {
+                this.WorkspaceName = this.WorkspaceObject.Name;
+            }
+
+            if (this.IsParameterBound(c => c.Id))
+            {
+                WriteObject(new PSSynapseRole(SynapseAnalyticsClient.GetRoleDefinitionById(this.Id)));
+            }
+            else
+            {
+                var roleDefinitions = SynapseAnalyticsClient.GetRoleDefinitions()
+                    .Select(element => new PSSynapseRole(element));
+                if (this.IsParameterBound(c => c.Name))
+                {
+                    PSSynapseRole role = roleDefinitions.SingleOrDefault(element => element.Name == this.Name);
+                    if (role == null)
+                    {
+                        throw new InvalidOperationException(String.Format(Resources.RoleDefinitionNameDoesNotExist, this.Name));
+                    }
+                    WriteObject(role);
+                }
+                else
+                {
+                    WriteObject(roleDefinitions, true);
+                }
+            } 
+        }
+    }
+}