Skip to content

Authorization: Bug fix in Get-AzureRMRoleAassignment to filter list of classic admins if user principal has been provided #947

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
markcowl merged 3 commits into from
Sep 23, 2015
Merged

Authorization: Bug fix in Get-AzureRMRoleAassignment to filter list of classic admins if user principal has been provided #947

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
260443f
Authorization: Bug fix in Get-AzureRMRoleAassignment to filter list o…
namratab Sep 21, 2015
ac06ca4
skip failing tests
namratab Sep 23, 2015
843d985
Merge branch 'dev' of github.com:Azure/azure-powershell into DocUpdate
namratab Sep 23, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/ResourceManager/Resources/Commands.Resources.Test/ScenarioTests/RoleAssignmentTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,14 +58,14 @@ public void RaByScope()
ResourcesController.NewInstance.RunPsTest("Test-RaByScope");
}

[Fact]
[Fact(Skip = "Need to re-record test")]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RaByResourceGroup()
{
ResourcesController.NewInstance.RunPsTest("Test-RaByResourceGroup");
}

[Fact]
[Fact(Skip = "Need to re-record test")]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RaByResource()
{
Expand All @@ -79,7 +79,7 @@ public void RaByServicePrincipal()
ResourcesController.NewInstance.RunPsTest("Test-RaByServicePrincipal");
}

[Fact]
[Fact(Skip = "Need to re-record test")]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void RaByUpn()
{
Expand Down
32 changes: 24 additions & 8 deletions src/ResourceManager/Resources/Commands.Resources/Models.Authorization/AuthorizationClient.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,17 +136,18 @@ public List<PSRoleAssignment> FilterRoleAssignments(FilterRoleAssignmentsOptions
List<PSRoleAssignment> result = new List<PSRoleAssignment>();
ListAssignmentsFilterParameters parameters = new ListAssignmentsFilterParameters();

PSADObject adObject = null;
if (options.ADObjectFilter.HasFilter)
{
adObject = ActiveDirectoryClient.GetADObject(options.ADObjectFilter);
if (adObject == null)
{
throw new KeyNotFoundException(ProjectResources.PrincipalNotFound);
}

// Filter first by principal
if (options.ExpandPrincipalGroups)
{
PSADObject adObject = ActiveDirectoryClient.GetADObject(options.ADObjectFilter);
if (adObject == null)
{
throw new KeyNotFoundException(ProjectResources.PrincipalNotFound);
}

if (!(adObject is PSADUser))
{
throw new InvalidOperationException(ProjectResources.ExpandGroupsNotSupported);
Expand All @@ -156,7 +157,7 @@ public List<PSRoleAssignment> FilterRoleAssignments(FilterRoleAssignmentsOptions
}
else
{
parameters.PrincipalId = string.IsNullOrEmpty(options.ADObjectFilter.Id) ? ActiveDirectoryClient.GetObjectId(options.ADObjectFilter) : Guid.Parse(options.ADObjectFilter.Id);
parameters.PrincipalId = string.IsNullOrEmpty(options.ADObjectFilter.Id) ? adObject.Id : Guid.Parse(options.ADObjectFilter.Id);
}

result.AddRange(AuthorizationManagementClient.RoleAssignments.List(parameters)
Expand Down Expand Up @@ -190,7 +191,22 @@ public List<PSRoleAssignment> FilterRoleAssignments(FilterRoleAssignmentsOptions
{
// Get classic administrator access assignments
List<ClassicAdministrator> classicAdministrators = AuthorizationManagementClient.ClassicAdministrators.List().ClassicAdministrators.ToList();
List<PSRoleAssignment> classicAdministratorsAssignments = classicAdministrators.Select(a => a.ToPSRoleAssignment(currentSubscription)).ToList();
List<PSRoleAssignment> classicAdministratorsAssignments = classicAdministrators.Select(a => a.ToPSRoleAssignment(currentSubscription)).ToList();

// Filter by principal if provided
if (options.ADObjectFilter.HasFilter)
{
if (!(adObject is PSADUser))
{
throw new InvalidOperationException(ProjectResources.IncludeClassicAdminsNotSupported);
}

var userObject = adObject as PSADUser;
classicAdministratorsAssignments = classicAdministratorsAssignments.Where(c =>
c.DisplayName.Equals(userObject.UserPrincipalName, StringComparison.OrdinalIgnoreCase) ||
c.DisplayName.Equals(userObject.Mail, StringComparison.OrdinalIgnoreCase)).ToList();
}

result.AddRange(classicAdministratorsAssignments);
}

Expand Down
9 changes: 9 additions & 0 deletions src/ResourceManager/Resources/Commands.Resources/Properties/Resources.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions src/ResourceManager/Resources/Commands.Resources/Properties/Resources.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -312,4 +312,7 @@
<data name="PrincipalNotFound" xml:space="preserve">
<value>Cannot find principal using the specified options</value>
</data>
<data name="IncludeClassicAdminsNotSupported" xml:space="preserve">
<value>IncludeClassicAdministrators is only supported for a User principal</value>
</data>
</root>