Skip to content

Commit bbc5924

Browse files
cormacpaynecormacpayne
authored
Merge pull request Azure#4102 from RandalliLama/email-param
Remove email addresses from UPN query in KeyVault Access Policy CmdLets.
2 parents 40206a9 + 52cedeb commit bbc5924

14 files changed

+381
-184
lines changed

‎src/ResourceManager/KeyVault/AzureRM.KeyVault.psd1

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -72,34 +72,34 @@ NestedModules = @('.\Microsoft.Azure.Commands.KeyVault.dll')
7272
FunctionsToExport = @()
7373

7474
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
75-
CmdletsToExport = 'Add-AzureKeyVaultCertificate',
76-
'Set-AzureKeyVaultCertificateAttribute',
77-
'Stop-AzureKeyVaultCertificateOperation',
78-
'Get-AzureKeyVaultCertificateOperation',
79-
'Import-AzureKeyVaultCertificate',
80-
'Add-AzureKeyVaultCertificateContact',
81-
'Get-AzureKeyVaultCertificate',
82-
'Get-AzureKeyVaultCertificateContact',
83-
'Get-AzureKeyVaultCertificateIssuer',
84-
'New-AzureKeyVaultCertificatePolicy',
85-
'Remove-AzureKeyVaultCertificate',
86-
'Remove-AzureKeyVaultCertificateContact',
87-
'Remove-AzureKeyVaultCertificateIssuer',
88-
'Remove-AzureKeyVaultCertificateOperation',
89-
'Set-AzureKeyVaultCertificateIssuer',
90-
'Set-AzureKeyVaultCertificatePolicy', 'Get-AzureRmKeyVault',
91-
'New-AzureRmKeyVault', 'Remove-AzureRmKeyVault',
92-
'Undo-AzureRmKeyVaultRemoval', 'Remove-AzureRmKeyVaultAccessPolicy',
93-
'Set-AzureRmKeyVaultAccessPolicy', 'Backup-AzureKeyVaultKey',
94-
'Get-AzureKeyVaultKey', 'Get-AzureKeyVaultSecret',
95-
'Undo-AzureKeyVaultKeyRemoval', 'Undo-AzureKeyVaultSecretRemoval',
96-
'Add-AzureKeyVaultKey', 'Remove-AzureKeyVaultKey',
97-
'Remove-AzureKeyVaultSecret', 'Restore-AzureKeyVaultKey',
98-
'Set-AzureKeyVaultKeyAttribute', 'Set-AzureKeyVaultSecret',
99-
'Set-AzureKeyVaultSecretAttribute',
100-
'Get-AzureKeyVaultCertificatePolicy',
101-
'New-AzureKeyVaultCertificateAdministratorDetails',
102-
'New-AzureKeyVaultCertificateOrganizationDetails',
75+
CmdletsToExport = 'Add-AzureKeyVaultCertificate',
76+
'Set-AzureKeyVaultCertificateAttribute',
77+
'Stop-AzureKeyVaultCertificateOperation',
78+
'Get-AzureKeyVaultCertificateOperation',
79+
'Import-AzureKeyVaultCertificate',
80+
'Add-AzureKeyVaultCertificateContact',
81+
'Get-AzureKeyVaultCertificate',
82+
'Get-AzureKeyVaultCertificateContact',
83+
'Get-AzureKeyVaultCertificateIssuer',
84+
'New-AzureKeyVaultCertificatePolicy',
85+
'Remove-AzureKeyVaultCertificate',
86+
'Remove-AzureKeyVaultCertificateContact',
87+
'Remove-AzureKeyVaultCertificateIssuer',
88+
'Remove-AzureKeyVaultCertificateOperation',
89+
'Set-AzureKeyVaultCertificateIssuer',
90+
'Set-AzureKeyVaultCertificatePolicy', 'Get-AzureRmKeyVault',
91+
'New-AzureRmKeyVault', 'Remove-AzureRmKeyVault',
92+
'Undo-AzureRmKeyVaultRemoval', 'Remove-AzureRmKeyVaultAccessPolicy',
93+
'Set-AzureRmKeyVaultAccessPolicy', 'Backup-AzureKeyVaultKey',
94+
'Get-AzureKeyVaultKey', 'Get-AzureKeyVaultSecret',
95+
'Undo-AzureKeyVaultKeyRemoval', 'Undo-AzureKeyVaultSecretRemoval',
96+
'Add-AzureKeyVaultKey', 'Remove-AzureKeyVaultKey',
97+
'Remove-AzureKeyVaultSecret', 'Restore-AzureKeyVaultKey',
98+
'Set-AzureKeyVaultKeyAttribute', 'Set-AzureKeyVaultSecret',
99+
'Set-AzureKeyVaultSecretAttribute',
100+
'Get-AzureKeyVaultCertificatePolicy',
101+
'New-AzureKeyVaultCertificateAdministratorDetails',
102+
'New-AzureKeyVaultCertificateOrganizationDetails',
103103
'Backup-AzureKeyVaultSecret', 'Restore-AzureKeyVaultSecret',
104104
'Get-AzureKeyVaultManagedStorageAccount',
105105
'Add-AzureKeyVaultManagedStorageAccount',
@@ -157,7 +157,7 @@ PrivateData = @{
157157
# ExternalModuleDependencies = ''
158158

159159
} # End of PSData hashtable
160-
160+
161161
} # End of PrivateData hashtable
162162

163163
# HelpInfo URI of this module

‎src/ResourceManager/KeyVault/ChangeLog.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@
1818
- Additional information about change #1
1919
-->
2020
## Current Release
21+
* Remove email address from the directory query when -UserPrincipalName is specified to the Set-AzureRMKeyVaultAccessPolicy and Remove-AzureRMKeyVaultAccessPolicy cmdlets.
22+
- Both Cmdlets now have an -EmailAddress parameter that can be used instead of the -UserPrincipalName parameter when querying for email address is appropriate. If there are more than one matching email addresses in the directory then the Cmdlet will fail.
2123

2224
## Version 3.1.0
2325
* New Cmdlets to support KeyVault Managed Storage Account Keys
@@ -38,10 +40,10 @@
3840

3941
* Backup cmdlets for Keys and Secrets now accept a corresponding object as an input parameter
4042
- The caller may chain retrieval and backup operations: Get-AzureKeyVaultKey -VaultName myVault -Name myKey | Backup-AzureKeyVaultKey
41-
43+
4244
* Backup cmdlets now support a -Force switch to overwrite an existing file
4345
- Note that attempting to overwrite an existing file will no longer throw, and will instead prompt the user for a choice on how to proceed.
44-
46+
4547
## Version 2.8.0
4648

4749
## Version 2.7.0

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Properties/AssemblyInfo.cs

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
using System.Runtime.InteropServices;
1818
using Xunit;
1919

20-
// General Information about an assembly is controlled through the following
20+
// General Information about an assembly is controlled through the following
2121
// set of attributes. Change these attribute values to modify the information
2222
// associated with an assembly.
2323
[assembly: AssemblyTitle( "Microsoft.Azure.Commands.KeyVault.Test" )]
@@ -29,8 +29,8 @@
2929
[assembly: AssemblyTrademark( "" )]
3030
[assembly: AssemblyCulture( "" )]
3131

32-
// Setting ComVisible to false makes the types in this assembly not visible
33-
// to COM components. If you need to access a type in this assembly from
32+
// Setting ComVisible to false makes the types in this assembly not visible
33+
// to COM components. If you need to access a type in this assembly from
3434
// COM, set the ComVisible attribute to true on that type.
3535
[assembly: ComVisible( false )]
3636

@@ -40,11 +40,11 @@
4040
// Version information for an assembly consists of the following four values:
4141
//
4242
// Major Version
43-
// Minor Version
43+
// Minor Version
4444
// Build Number
4545
// Revision
4646
//
47-
// You can specify all the values or you can default the Build and Revision Numbers
47+
// You can specify all the values or you can default the Build and Revision Numbers
4848
// by using the '*' as shown below:
4949

5050
[assembly: AssemblyVersion( "3.0.0.0" )]

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/ControlPlane/KeyVaultManagementTests.ps1

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,26 @@ function Test-SetRemoveAccessPolicyByUPN
440440
Assert-AreEqual 0 $vault.AccessPolicies.Count
441441
}
442442

443+
function Test-SetRemoveAccessPolicyByEmailAddress
444+
{
445+
Param($existingVaultName, $rgName, $email, $upn)
446+
447+
$PermToKeys = @("encrypt", "decrypt", "unwrapKey", "wrapKey", "verify", "sign", "get", "list", "update", "create", "import", "delete", "backup", "restore")
448+
$PermToSecrets = @("get", "list", "set", "delete")
449+
$PermToCertificates = @("get", "list", "create", "delete")
450+
$PermToStorage = @("get", "list", "delete")
451+
452+
$vault = Set-AzureRmKeyVaultAccessPolicy -VaultName $existingVaultName -ResourceGroupName $rgName -EmailAddress $email -PermissionsToKeys $PermToKeys -PermissionsToSecrets $PermToSecrets -PermissionsToCertificates $PermToCertificates -PermissionsToStorage $PermToStorage -PassThru
453+
454+
CheckVaultAccessPolicy $vault $PermToKeys $PermToSecrets $PermToCertificates $PermToStorage
455+
if (-not $global:noADCmdLetMode) {
456+
Assert-AreEqual $vault.AccessPolicies[0].ObjectId (Get-AzureRmADUser -Mail $upn).Id
457+
}
458+
459+
$vault = Remove-AzureRmKeyVaultAccessPolicy -VaultName $existingVaultName -ResourceGroupName $rgName -EmailAddress $email -PassThru
460+
Assert-AreEqual 0 $vault.AccessPolicies.Count
461+
}
462+
443463
function Test-SetRemoveAccessPolicyBySPN
444464
{
445465
Param($existingVaultName, $rgName, $spn)

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/RunKeyVaultTests.ps1

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,7 @@ function Run-AllControlPlaneTests
183183
{
184184
Run-TestProtected { Run-VaultTest { Test_CreateNewPremiumVaultEnabledForDeployment } "Test_CreateNewPremiumVaultEnabledForDeployment" } "Test_CreateNewPremiumVaultEnabledForDeployment"
185185
}
186+
186187
Run-TestProtected { Run-VaultTest { Test_CreateNewVault } "Test_CreateNewVault" } "Test_CreateNewVault"
187188
Run-TestProtected { Run-VaultTest { Test_RecreateVaultFails } "Test_RecreateVaultFails" } "Test_RecreateVaultFails"
188189
Run-TestProtected { Run-VaultTest { Test_CreateVaultInUnknownResGrpFails } "Test_CreateVaultInUnknownResGrpFails" } "Test_CreateVaultInUnknownResGrpFails"
@@ -211,6 +212,10 @@ function Run-AllControlPlaneTests
211212

212213
# Set-AzureRmKeyVaultAccessPolicy & Remove-AzureRmKeyVaultAccessPolicy tests.
213214
Run-TestProtected { Run-VaultTest { Test_SetRemoveAccessPolicyByUPN } "Test_SetRemoveAccessPolicyByUPN" } "Test_SetRemoveAccessPolicyByUPN"
215+
216+
# This test will fail for users that do not have the same email address as their UPN.
217+
Run-TestProtected { Run-VaultTest { Test_SetRemoveAccessPolicyByEmailAddress } "Test_SetRemoveAccessPolicyByEmailAddress" } "Test_SetRemoveAccessPolicyByEmailAddress"
218+
214219
Run-TestProtected { Run-VaultTest { Test_SetRemoveAccessPolicyBySPN } "Test_SetRemoveAccessPolicyBySPN" } "Test_SetRemoveAccessPolicyBySPN"
215220
Run-TestProtected { Run-VaultTest { Test_SetRemoveAccessPolicyByObjectId } "Test_SetRemoveAccessPolicyByObjectId" } "Test_SetRemoveAccessPolicyByObjectId"
216221
Run-TestProtected { Run-VaultTest { Test_SetRemoveAccessPolicyByBypassObjectIdValidation } "Test_SetRemoveAccessPolicyByBypassObjectIdValidation" } "Test_SetRemoveAccessPolicyByBypassObjectIdValidation"
@@ -222,7 +227,7 @@ function Run-AllControlPlaneTests
222227
Run-TestProtected { Run-VaultTest { Test_ModifyAccessPolicyNegativeCases } "Test_ModifyAccessPolicyNegativeCases" } "Test_ModifyAccessPolicyNegativeCases"
223228
Run-TestProtected { Run-VaultTest { Test_RemoveNonExistentAccessPolicyDoesNotThrow } "Test_RemoveNonExistentAccessPolicyDoesNotThrow" } "Test_RemoveNonExistentAccessPolicyDoesNotThrow"
224229
Run-TestProtected { Run-VaultTest { Test_AllPermissionExpansion } "Test_AllPermissionExpansion" } "Test_AllPermissionExpansion"
225-
230+
226231

227232
# Piping tests.
228233
Run-TestProtected { Run-VaultTest { Test_CreateDeleteVaultWithPiping } "Test_CreateDeleteVaultWithPiping" } "Test_CreateDeleteVaultWithPiping"
@@ -237,7 +242,7 @@ function Run-AllDataPlaneTests
237242
Write-Host "Starting the data plane tests..."
238243

239244
# All operations that invlove soft delete
240-
if($global:softDeleteEnabled -eq $true)
245+
if($global:softDeleteEnabled -eq $true)
241246
{
242247
# Key soft delete tests
243248
Run-TestProtected { Run-KeyTest {Test_GetDeletedKey} "Test_GetDeletedKey" } "Test_GetDeletedKey"
@@ -268,7 +273,7 @@ function Run-AllDataPlaneTests
268273
Run-TestProtected { Run-KeyTest {Test_ImportPfxAsHsmWithDefaultAttributes} "Test_ImportPfxAsHsmWithDefaultAttributes" } "Test_ImportPfxAsHsmWithDefaultAttributes"
269274
Run-TestProtected { Run-KeyTest {Test_ImportPfxAsHsmWithCustomAttributes} "Test_ImportPfxAsHsmWithCustomAttributes" } "Test_ImportPfxAsHsmWithCustomAttributes"
270275

271-
# All operations involving BYOK keys. For these tests to run correctly, the user running the tests
276+
# All operations involving BYOK keys. For these tests to run correctly, the user running the tests
272277
# must have a subscription ID that matches the subscription ID of the person who initially
273278
# generated the dummy *.byok files located in the proddata folder.
274279
#
@@ -478,7 +483,7 @@ try
478483
Restore-VaultResource $oldVaultResource
479484
}
480485
}
481-
486+
482487
if (@('DataPlane', 'All') -contains $TestMode)
483488
{
484489
$oldVaultResource = Get-VaultResource

‎src/ResourceManager/KeyVault/Commands.KeyVault.Test/Scripts/VaultManagementTests.ps1

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,14 @@ function Test_SetRemoveAccessPolicyByUPN
126126
Test-SetRemoveAccessPolicyByUPN $global:testVault $global:resourceGroupName $user
127127
}
128128

129+
function Test_SetRemoveAccessPolicyByEmailAddress
130+
{
131+
# ASSUMPTION: The logged in users UPN is the same as their email address.
132+
$user = (Get-AzureRmContext).Account.Id
133+
Reset-PreCreatedVault
134+
Test-SetRemoveAccessPolicyByEmailAddress $global:testVault $global:resourceGroupName $user $user
135+
}
136+
129137
function Test_SetRemoveAccessPolicyBySPN
130138
{
131139
Reset-PreCreatedVault
@@ -230,7 +238,7 @@ function Test_AllPermissionExpansion
230238
{
231239
Reset-PreCreatedVault
232240
$user = (Get-AzureRmContext).Account.Id
233-
Test-AllPermissionExpansion $global:testVault $global:resourceGroupName $user
241+
Test-AllPermissionExpansion $global:testVault $global:resourceGroupName $user
234242
}
235243

236244
#-------------------------------------------------------------------------------------
@@ -330,7 +338,7 @@ function Initialize-TemporaryState
330338
{
331339
Write-Host "Skipping resource group creation since the resource group $global:resourceGroupName is already provided."
332340
}
333-
341+
334342
if ($global:testVault -ne "" -and $global:testVault -ne $null)
335343
{
336344
Write-Host "Skipping vault creation since the vault $global:testVault is already provided."
@@ -339,7 +347,7 @@ function Initialize-TemporaryState
339347

340348
# Create a vault using ARM.
341349
$vaultName = Get-VaultName $suffix
342-
$tenantId = (Get-AzureRmContext).Tenant.TenantId
350+
$tenantId = (Get-AzureRmContext).Tenant.Id
343351
$sku = "premium"
344352
if ($global:standardVaultOnly)
345353
{
@@ -446,7 +454,7 @@ function Cleanup-TemporaryState([bool]$tempResourceGroup, [bool]$tempVault)
446454
elseif ($tempVault)
447455
{
448456
Write-Host "Starting the deletion of the temporary vault. This can take a minute or so..."
449-
$vaultRemoved = Remove-AzureRmKeyVault -VaultName $global:testVault -Force -Confirm:$false
457+
$vaultRemoved = Remove-AzureRmKeyVault -VaultName $global:testVault -ResourceGroupName $global:resourceGroupname -Force -Confirm:$false
450458
if ($vaultRemoved)
451459
{
452460
$global:testVault = ""

‎src/ResourceManager/KeyVault/Commands.KeyVault/Commands/RemoveAzureKeyVaultAccessPolicy.cs

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ public class RemoveAzureKeyVaultAccessPolicy : KeyVaultManagementCmdletBase
3131
private const string ByObjectId = "ByObjectId";
3232
private const string ByServicePrincipalName = "ByServicePrincipalName";
3333
private const string ByUserPrincipalName = "ByUserPrincipalName";
34+
private const string ByEmail = "ByEmail";
3435
private const string ForVault = "ForVault";
3536

3637
#endregion
@@ -89,6 +90,16 @@ public class RemoveAzureKeyVaultAccessPolicy : KeyVaultManagementCmdletBase
8990
[ValidateNotNullOrEmpty()]
9091
public string ObjectId { get; set; }
9192

93+
/// <summary>
94+
/// Email address
95+
/// </summary>
96+
[Parameter(Mandatory = true,
97+
ParameterSetName = ByEmail,
98+
ValueFromPipelineByPropertyName = true,
99+
HelpMessage = "Specifies the email address of the user in Azure Active Directory for which to grant permissions.")]
100+
[ValidateNotNullOrEmpty()]
101+
public string EmailAddress { get; set; }
102+
92103
/// <summary>
93104
/// Id of the application to which a user delegate to
94105
/// </summary>
@@ -160,11 +171,14 @@ public override void ExecuteCmdlet()
160171

161172
// Update vault policies
162173
var updatedPolicies = existingVault.AccessPolicies;
163-
if (!string.IsNullOrEmpty(UserPrincipalName) || !string.IsNullOrEmpty(ServicePrincipalName) || !string.IsNullOrWhiteSpace(this.ObjectId))
174+
if (!string.IsNullOrEmpty(UserPrincipalName)
175+
|| !string.IsNullOrEmpty(ServicePrincipalName)
176+
|| !string.IsNullOrWhiteSpace(this.ObjectId)
177+
|| !string.IsNullOrWhiteSpace(this.EmailAddress))
164178
{
165179
if (string.IsNullOrWhiteSpace(this.ObjectId))
166180
{
167-
ObjectId = GetObjectId(this.ObjectId, this.UserPrincipalName, this.ServicePrincipalName);
181+
ObjectId = GetObjectId(this.ObjectId, this.UserPrincipalName, this.EmailAddress, this.ServicePrincipalName);
168182
}
169183
updatedPolicies = existingVault.AccessPolicies.Where(ap => !ShallBeRemoved(ap, ObjectId, this.ApplicationId)).ToArray();
170184
}

0 commit comments

Comments
 (0)