Skip to content

Commit e20463c

Browse files
bluewwerich-wang
blueww
authored and
erich-wang
committed
[Storage] Support Idenity SAS (Azure#10542)
1 parent 5a642a5 commit e20463c

File tree

18 files changed

+1668
-19
lines changed

18 files changed

+1668
-19
lines changed

‎src/Storage/Storage.Management.Test/ScenarioTests/StorageAccountTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,13 @@ public void TestSetCurrentStorageAccount()
9393
TestRunner.RunTestScript("Test-SetAzureRmCurrentStorageAccount");
9494
}
9595

96+
[Fact]
97+
[Trait(Category.AcceptanceType, Category.CheckIn)]
98+
public void TestRevokeAzStorageAccountUserDelegationKeys()
99+
{
100+
TestRunner.RunTestScript("Test-RevokeAzStorageAccountUserDelegationKeys");
101+
}
102+
96103
[Fact]
97104
[Trait(Category.AcceptanceType, Category.CheckIn)]
98105
public void TestSetAzureRmStorageAccountKeySource()

‎src/Storage/Storage.Management.Test/ScenarioTests/StorageAccountTests.ps1

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -507,6 +507,41 @@ function Test-SetAzureRmCurrentStorageAccount
507507
}
508508
}
509509

510+
<#
511+
.SYNOPSIS
512+
Test Revoke-AzStorageAccountUserDelegationKeys
513+
.DESCRIPTION
514+
SmokeTest
515+
#>
516+
function Test-RevokeAzStorageAccountUserDelegationKeys
517+
{
518+
# Setup
519+
$rgname = Get-StorageManagementTestResourceName
520+
521+
try
522+
{
523+
# Test
524+
$stoname = 'sto' + $rgname
525+
$stotype = 'Standard_LRS'
526+
$loc = Get-ProviderLocation ResourceManagement
527+
528+
New-AzResourceGroup -Name $rgname -Location $loc
529+
New-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -Location $loc -Type $stotype
530+
531+
# revoke with storage account name and resoruce group name
532+
Revoke-AzStorageAccountUserDelegationKeys -ResourceGroupName $rgname -Name $stoname
533+
534+
# revoke with pipeline
535+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname }
536+
$global:sto | Revoke-AzStorageAccountUserDelegationKeys
537+
}
538+
finally
539+
{
540+
# Cleanup
541+
Clean-ResourceGroup $rgname
542+
}
543+
}
544+
510545
<#
511546
.SYNOPSIS
512547
Test NetworkRule

‎src/Storage/Storage.Management.Test/SessionRecords/Microsoft.Azure.Commands.Management.Storage.Test.ScenarioTests.StorageAccountTests/TestRevokeAzStorageAccountUserDelegationKeys.json

Lines changed: 1098 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Storage/Storage.Management/Az.Storage.psd1

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ CmdletsToExport = 'Get-AzStorageAccount', 'Get-AzStorageAccountKey',
155155
'Get-AzStorageBlobServiceProperty',
156156
'Enable-AzStorageBlobDeleteRetentionPolicy',
157157
'Disable-AzStorageBlobDeleteRetentionPolicy',
158+
'Revoke-AzStorageAccountUserDelegationKeys',
158159
'Get-AzStorageFileHandle', 'Close-AzStorageFileHandle',
159160
'New-AzRmStorageShare', 'Remove-AzRmStorageShare',
160161
'Get-AzRmStorageShare', 'Update-AzRmStorageShare'
@@ -194,12 +195,11 @@ PrivateData = @{
194195
# IconUri = ''
195196

196197
# ReleaseNotes of this module
197-
ReleaseNotes = '* Support enable Large File share when create or update Storage account
198-
- New-AzStorageAccount
199-
- Set-AzStorageAccount
200-
* When close/get File handle, skip check the input path is File directory or File, to avoid failure with object in DeletePending status
201-
- Get-AzStorageFileHandle
202-
- Close-AzStorageFileHandle'
198+
ReleaseNotes = '* Support generate Blob/Constainer Idenity based SAS token with Storage Context based on Oauth authentication
199+
- New-AzStorageContainerSASToken
200+
- New-AzStorageBlobSASToken
201+
* Support revoke Storage Account User Delegation Keys, so all Idenity SAS tokens are revoked
202+
- Revoke-AzStorageAccountUserDelegationKeys'
203203

204204
# Prerelease string of this module
205205
# Prerelease = ''

‎src/Storage/Storage.Management/ChangeLog.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Support generate Blob/Constainer Idenity based SAS token with Storage Context based on Oauth authentication
22+
- New-AzStorageContainerSASToken
23+
- New-AzStorageBlobSASToken
24+
* Support revoke Storage Account User Delegation Keys, so all Idenity SAS tokens are revoked
25+
- Revoke-AzStorageAccountUserDelegationKeys
2126

2227
## Version 1.9.0
2328
* Support enable Large File share when create or update Storage account

‎src/Storage/Storage.Management/StorageAccount/RevokeAzStorageAccountUserDelegationKeys.cs

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.Management.Storage.Models;
16+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
17+
using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
18+
using Microsoft.Azure.Management.Storage;
19+
using Microsoft.Azure.Management.Storage.Models;
20+
using System.Management.Automation;
21+
22+
namespace Microsoft.Azure.Commands.Management.Storage
23+
{
24+
[Cmdlet("Revoke", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "StorageAccountUserDelegationKeys", SupportsShouldProcess = true, DefaultParameterSetName = AccountNameParameterSet), OutputType(typeof(bool))]
25+
public class RevokeAzureStorageAccountUserDelegationKeysCommand : StorageAccountBaseCmdlet
26+
{
27+
/// <summary>
28+
/// AccountName Parameter Set
29+
/// </summary>
30+
private const string AccountNameParameterSet = "AccountName";
31+
32+
/// <summary>
33+
/// Account object parameter set
34+
/// </summary>
35+
private const string AccountObjectParameterSet = "AccountObject";
36+
37+
/// <summary>
38+
/// Account ResourceId parameter set
39+
/// </summary>
40+
private const string AccountResourceIdParameterSet = "AccountResourceId";
41+
42+
[Parameter(
43+
Position = 0,
44+
Mandatory = true,
45+
HelpMessage = "The resource group name containing the storage account resource.",
46+
ParameterSetName = AccountNameParameterSet)]
47+
[ResourceGroupCompleter]
48+
[ValidateNotNullOrEmpty]
49+
public string ResourceGroupName { get; set; }
50+
51+
[Parameter(
52+
Position = 1,
53+
Mandatory = true,
54+
HelpMessage = "The name of the storage account resource.",
55+
ParameterSetName = AccountNameParameterSet)]
56+
[ResourceNameCompleter("Microsoft.Storage/storageAccounts", nameof(ResourceGroupName))]
57+
[Alias(AccountNameAlias, NameAlias)]
58+
[ValidateNotNullOrEmpty]
59+
public string StorageAccountName { get; set; }
60+
61+
[Parameter(Mandatory = true,
62+
HelpMessage = "A storage account object, returned by Get_AzStorageAccount, New-AzStorageAccount.",
63+
ValueFromPipeline = true,
64+
ParameterSetName = AccountObjectParameterSet)]
65+
[Alias("StorageAccount")]
66+
[ValidateNotNullOrEmpty]
67+
public PSStorageAccount InputObject { get; set; }
68+
69+
[Parameter(
70+
Position = 0,
71+
Mandatory = true,
72+
ValueFromPipelineByPropertyName = true,
73+
HelpMessage = "Storage Account Resource Id.",
74+
ParameterSetName = AccountResourceIdParameterSet)]
75+
[Alias("StorageAccountResourceId")]
76+
[ValidateNotNullOrEmpty]
77+
public string ResourceId { get; set; }
78+
79+
[Parameter(Mandatory = false)]
80+
public SwitchParameter PassThru { get; set; }
81+
82+
public override void ExecuteCmdlet()
83+
{
84+
base.ExecuteCmdlet();
85+
if (ShouldProcess(this.StorageAccountName, "Remove Storage Account user delegation keys"))
86+
{
87+
switch (ParameterSetName)
88+
{
89+
case AccountObjectParameterSet:
90+
this.ResourceGroupName = InputObject.ResourceGroupName;
91+
this.StorageAccountName = InputObject.StorageAccountName;
92+
break;
93+
case AccountResourceIdParameterSet:
94+
ResourceIdentifier accountResource = new ResourceIdentifier(ResourceId);
95+
this.ResourceGroupName = accountResource.ResourceGroupName;
96+
this.StorageAccountName = accountResource.ResourceName;
97+
break;
98+
default:
99+
// For AccountNameParameterSet, the ResourceGroupName and StorageAccountName can get from input directly
100+
break;
101+
}
102+
103+
this.StorageClient.StorageAccounts.RevokeUserDelegationKeys(
104+
this.ResourceGroupName,
105+
this.StorageAccountName);
106+
107+
if (PassThru.IsPresent)
108+
{
109+
WriteObject(true);
110+
}
111+
}
112+
}
113+
}
114+
}

‎src/Storage/Storage.Management/StorageAccount/StorageAccountBaseCmdlet.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ public abstract class StorageAccountBaseCmdlet : AzureRMCmdlet
3434

3535
protected const string StorageAccountNameAlias = "StorageAccountName";
3636
protected const string AccountNameAlias = "AccountName";
37+
protected const string NameAlias = "Name";
3738

3839
protected const string StorageAccountTypeAlias = "StorageAccountType";
3940
protected const string AccountTypeAlias = "AccountType";

‎src/Storage/Storage.Management/help/Az.Storage.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,9 @@ Removes a storage table.
257257
### [Remove-AzStorageTableStoredAccessPolicy](Remove-AzStorageTableStoredAccessPolicy.md)
258258
Removes a stored access policy from an Azure storage table.
259259

260+
### [Revoke-AzStorageAccountUserDelegationKeys](Revoke-AzStorageAccountUserDelegationKeys.md)
261+
Revoke all User Delegation keys of a Storage account.
262+
260263
### [Set-AzCurrentStorageAccount](Set-AzCurrentStorageAccount.md)
261264
Modifies the current Storage account of the specified subscription.
262265

‎src/Storage/Storage.Management/help/New-AzStorageBlobSASToken.md

Lines changed: 48 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,29 +18,31 @@ Generates a SAS token for an Azure storage blob.
1818
New-AzStorageBlobSASToken [-Container] <String> [-Blob] <String> [-Permission <String>]
1919
[-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
2020
[-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
21-
[<CommonParameters>]
21+
[-WhatIf] [-Confirm] [<CommonParameters>]
2222
```
2323

2424
### BlobPipelineWithPolicy
2525
```
2626
New-AzStorageBlobSASToken -CloudBlob <CloudBlob> -Policy <String> [-Protocol <SharedAccessProtocol>]
2727
[-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
28-
[-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
28+
[-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
29+
[<CommonParameters>]
2930
```
3031

3132
### BlobPipelineWithPermission
3233
```
3334
New-AzStorageBlobSASToken -CloudBlob <CloudBlob> [-Permission <String>] [-Protocol <SharedAccessProtocol>]
3435
[-IPAddressOrRange <String>] [-StartTime <DateTime>] [-ExpiryTime <DateTime>] [-FullUri]
35-
[-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [<CommonParameters>]
36+
[-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
37+
[<CommonParameters>]
3638
```
3739

3840
### BlobNameWithPolicy
3941
```
4042
New-AzStorageBlobSASToken [-Container] <String> [-Blob] <String> -Policy <String>
4143
[-Protocol <SharedAccessProtocol>] [-IPAddressOrRange <String>] [-StartTime <DateTime>]
4244
[-ExpiryTime <DateTime>] [-FullUri] [-Context <IStorageContext>] [-DefaultProfile <IAzureContextContainer>]
43-
[<CommonParameters>]
45+
[-WhatIf] [-Confirm] [<CommonParameters>]
4446
```
4547

4648
## DESCRIPTION
@@ -64,6 +66,16 @@ PS C:\> New-AzStorageBlobSASToken -Container "ContainerName" -Blob "BlobName" -P
6466

6567
This example generates a blob SAS token with life time.
6668

69+
### Example 3: Generate a User Identity SAS token with storage context based on OAuth authentication
70+
```
71+
PS C:\> $ctx = New-AzStorageContext -StorageAccountName $accountName -UseConnectedAccount
72+
PS C:\> $StartTime = Get-Date
73+
PS C:\> $EndTime = $startTime.AddDays(6)
74+
PS C:\> New-AzStorageBlobSASToken -Container "ContainerName" -Blob "BlobName" -Permission rwd -StartTime $StartTime -ExpiryTime $EndTime -context $ctx
75+
```
76+
77+
This example generates a User Identity blob SAS token with storage context based on OAuth authentication
78+
6779
## PARAMETERS
6880

6981
### -Blob
@@ -114,6 +126,7 @@ Accept wildcard characters: False
114126
115127
### -Context
116128
Specifies the storage context.
129+
When the storage context is based on OAuth authentication, will generates a User Identity blob SAS token.
117130
118131
```yaml
119132
Type: Microsoft.Azure.Commands.Common.Authentication.Abstractions.IStorageContext
@@ -144,6 +157,7 @@ Accept wildcard characters: False
144157
145158
### -ExpiryTime
146159
Specifies when the shared access signature expires.
160+
When the storage context is based on OAuth authentication, the expire time must be in 7 days from current time, and must not be earlier than current time.
147161
148162
```yaml
149163
Type: System.Nullable`1[System.DateTime]
@@ -254,6 +268,36 @@ Accept pipeline input: False
254268
Accept wildcard characters: False
255269
```
256270
271+
### -Confirm
272+
Prompts you for confirmation before running the cmdlet.
273+
274+
```yaml
275+
Type: System.Management.Automation.SwitchParameter
276+
Parameter Sets: (All)
277+
Aliases: cf
278+
279+
Required: False
280+
Position: Named
281+
Default value: None
282+
Accept pipeline input: False
283+
Accept wildcard characters: False
284+
```
285+
286+
### -WhatIf
287+
Shows what would happen if the cmdlet runs. The cmdlet is not run.
288+
289+
```yaml
290+
Type: System.Management.Automation.SwitchParameter
291+
Parameter Sets: (All)
292+
Aliases: wi
293+
294+
Required: False
295+
Position: Named
296+
Default value: None
297+
Accept pipeline input: False
298+
Accept wildcard characters: False
299+
```
300+
257301
### CommonParameters
258302
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).
259303

0 commit comments

Comments
 (0)