azure-cli
Version:
Microsoft Azure Cross Platform Command Line tool
415 lines (172 loc) • 27 kB
JavaScript
/*** Generated by streamline 0.10.17 (callbacks) - DO NOT EDIT ***/ "use strict"; var __rt=require('streamline/lib/callbacks/runtime').runtime(__filename, false),__func=__rt.__func,__cb=__rt.__cb,__tryCatch=__rt.__tryCatch; var util = require("util");
var adUtils = require("../ad/adUtils");
var rbacClients = require("./rbacClients");
var profile = require("../../../util/profile");
var RoleAssignments = require("./roleAssignments");
var utils = require("../../../util/utils");
var $ = utils.getLocaleString;
exports.init = function(cli) {
var log = cli.output;
var role = cli.category("role");
var roleAssignment = role.category("assignment").description($("Commands to manage role assignments"));
roleAssignment.command("create [objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]").description($("Assigns the specified RBAC role to the specified principal, at the specified scope.")).usage((((((((((((((((((((((((("[objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]" + "\n") + "\n ----- Example 1 -------") + "\n azure role assignment create --resource-group testRG --signInName john.doe@contoso.com") + "\n Grant access to a user at a resource group scope.") + "\n") + "\n ----- Example 2 -------") + "\n azure ad group show --search \"Christine Koch Team\"") + "\n + Getting group list") + "\n data: Display Name: Christine Koch Team") + "\n data: ObjectId: 2f9d4375-cbf1-48e8-83c9-2a0be4cb33fb") + "\n data: Security Enabled: true") + "\n data: Mail Enabled:") + "\n") + "\n azure role assignment create --objectId 2f9d4375-cbf1-48e8-83c9-2a0be4cb33fb --roleName Contributor --resource-group testRG") + "\n Grants access to a security group.") + "\n") + "\n ----- Example 3 -------") + "\n azure role assignment create --signInName john.doe@contoso.com --roleName Owner --scope \"/subscriptions/96231a05-34ce-4eb4-aa6a-70759cbb5e83/resourcegroups/rg1/providers/Microsoft.Web/sites/site1\"") + "\n Grants access to a user at a resource 'site1' (website) scope.") + "\n") + "\n ----- Example 4 -------") + "\n azure role assignment create --objectId 5ac84765-1c8c-4994-94b2-629461bd191b --roleName \"Virtual Machine Contributor\" --resouce-name Devices-Engineering-ProjectRND --resource-type Microsoft.Network/virtualNetworks/subnets --parent virtualNetworks/VNET-EASTUS-01 --resource-group Network") + "\n Grant access to a group at a nested resource (subnet)") + "\n")).option("--objectId <objectId>", $("Azure AD Objectid of the user, group or service principal")).option("--signInName <signInName>", $("The email address or the user principal name of the user.")).option("--spn <spn>", $("The ServicePrincipalName of the Azure AD application.")).option("-o --roleName <roleName>", $("The Name of the RBAC role that needs to be assigned to the principal i.e. Reader, Contributor, Virtual Network Administrator, etc.")).option("-d --roleId <roleId>", $("The Id of the RBAC role that needs to be assigned to the principal.")).option("-c --scope <scope>", $("The Scope of the role assignment. In the format of relative URI. For e.g. \"/subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG\". If not specified, will create the role assignment at subscription level. If specified, it should start with \"/subscriptions/{id}\".")).option("-g --resource-group <resource-group>", $("The resource group name. Creates an assignment that is effective at the specified resource group. When used in conjunction with resource-name, resource-type and (optionally)parent parameters, the command constructs a hierarchical scope in the form of a relative URI that identifies a resource.")).option("-r --resource-type <resource-type>", $("The resource type. For e.g. Microsoft.Network/virtualNetworks. Should only be used in conjunction with resource-name, resource-group and (optionally)parent parameters to construct a hierarchical scope in the form of a relative URI that identifies a resource.")).option("-u --resource-name <resource-name>", $("The resource name. For e.g. storageaccountprod. Should only be used in conjunction with resource-type, resource-group and (optionally)parent parameters to construct a hierarchical scope in the form of a relative URI that identifies a resource.")).option("--parent <parent>", $("The parent resource in the hierarchy of the resource specified using resource-name parameter. Must be used in conjunction with resource-name, resource-type and resource-group parameters to construct a hierarchical scope in the form of a relative URI that identifies a resource.")).option("--subscription <subscription>", $("Name or identifier of the subscription where the role assignment will be created.")).execute(function __1(objectId, signInName, spn, roleName, roleId, scope, resourceGroup, resourceType, resourceName, options, _) { var subscription, authzClient, graphClient, helper, objectType, matchedRoles, progress, filterParameters, role, parameter, roleAssignmentNameGuid, createdAssignment, assignmentToDisplay; var __frame = { name: "__1", line: 73 }; return __func(_, this, arguments, __1, 10, __frame, function __$__1() {
adUtils.validateParameters({
roleName: roleName,
roleId: roleId });
adUtils.validateParameters({
objectId: objectId,
signInName: signInName,
spn: spn });
subscription = profile.current.getSubscription(options.subscription);
authzClient = rbacClients.getAuthzClient(subscription);
graphClient = adUtils.getADGraphClient(subscription);
helper = new RoleAssignments(authzClient, graphClient);
scope = RoleAssignments.buildScopeString({
scope: scope,
subscriptionId: subscription.id,
resourceGroup: resourceGroup,
resourceType: resourceType,
resourceName: resourceName,
parent: options.parent });
objectType = { };
return adUtils.getObjectId({
objectId: objectId,
signInName: signInName,
spn: spn
}, graphClient, true, false, objectType, __cb(_, __frame, 28, 23, function ___(__0, __1) { objectId = __1;
matchedRoles = [];
progress = cli.interaction.progress($("Finding role with specified name")); return (function ___(__then) { (function ___(_) { __tryCatch(_, function __$__1() { return (function __$__1(__then) {
if (roleName) {
filterParameters = { roleName: roleName };
return authzClient.roleDefinitions.list(scope, filterParameters, __cb(_, __frame, 40, 53, function ___(__0, __2) { matchedRoles = __2.roleDefinitions; __then(); }, true)); } else {
return authzClient.roleDefinitions.get(roleId, scope, __cb(_, __frame, 43, 56, function ___(__0, __3) { matchedRoles.push(__3.roleDefinition); __then(); }, true)); } ; })(function __$__1() { _(null, null, true); }); }); })(function ___(__e, __r, __cont) { (function ___(__then) { __tryCatch(_, function __$__1() {
progress.end(); __then(); }); })(function ___() { __tryCatch(_, function ___() { if (__cont) { __then(); } else { _(__e, __r); }; }); }); }); })(function ___() { __tryCatch(_, function __$__1() {
if (matchedRoles) {
if ((matchedRoles.length === 1)) {
role = matchedRoles[0]; } else {
if ((matchedRoles.length > 1)) {
return _(new Error(util.format($("Multiple role definitions found with name '%s'. Specify role definition using it's Id instead."), roleName))); }
else {
if (roleName) {
return _(new Error(util.format($("Role with name '%s' was not found"), roleName))); }
else {
return _(new Error(util.format($("Role with Id '%s' was not found"), roleId))); } ; } ; } ; } ;
parameter = {
properties: {
principalId: objectId,
roleDefinitionId: role.id,
scope: scope } };
roleAssignmentNameGuid = utils.uuidGen();
progress = cli.interaction.progress($("Creating role assignment"));
createdAssignment = null; return (function ___(__then) { (function ___(_) { __tryCatch(_, function __$__1() {
return authzClient.roleAssignments.create(scope, roleAssignmentNameGuid, parameter, __cb(_, __frame, 79, 54, function ___(__0, __4) { createdAssignment = __4; _(null, null, true); }, true)); }); })(function ___(__e, __r, __cont) { (function ___(__then) { __tryCatch(_, function __$__1() { return (function __$__1(__then) {
if (createdAssignment) {
return helper.fillRoleAndPrincipalDetailsForAssignment(createdAssignment.roleAssignment, role, __cb(_, __frame, 82, 41, function ___(__0, __5) { assignmentToDisplay = __5;
if (assignmentToDisplay) {
cli.interaction.formatOutput(assignmentToDisplay, function(assignment) {
if (assignment) {
showRoleAssignment(assignment); } ; }); } ; __then(); }, true)); } else { __then(); } ; })(function __$__1() {
progress.end(); __then(); }); }); })(function ___() { __tryCatch(_, function ___() { if (__cont) { __then(); } else { _(__e, __r); }; }); }); }); })(function ___() { __tryCatch(_, function __$__1() { _(); }); }); }); }); }, true)); }); });
roleAssignment.command("list [objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]").usage(((((((((((((((((("[objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]" + "\n") + "\n ----- Example 1 -------") + "\n azure role assignment list") + "\n List all role assignments in the subscription") + "\n") + "\n ----- Example 2 -------") + "\n azure role assignment list --resource-group testRG --signInName john.doe@contoso.com -e") + "\n Gets all role assignments made to user john.doe@contoso.com, and the groups of which he is member, at the testRG scope or above.") + "\n") + "\n ----- Example 3 -------") + "\n azure role assignment list --spn \"http://testapp1.com\"") + "\n Gets all role assignments of the specified service principal.") + "\n") + "\n ----- Example 4 -------") + "\n azure role assignment list --scope \"/subscriptions/96231a05-34ce-4eb4-aa6a-70759cbb5e83/resourcegroups/rg1/providers/Microsoft.Web/sites/site1\"") + "\n Gets role assignments at the 'site1' website scope.") + "\n")).description($((("Lists Azure RBAC role assignments at the specified scope. " + "\n By default it lists all role assignments in the selected Azure subscription. Use respective parameters to list assignments to a specific user, or to list assignments on a specific resource group or resource. ") + "\n The Azure RBAC role that is assigned dictates what type of resources the user is allowed to manage in the scope, and what actions the user is allowed to perform on those resources. Use 'azure role list' or 'azure role show' commands to list actions that a given role allows. "))).option("--objectId <objectId>", $("The Azure AD ObjectId of the User, Group or Service Principal. Filters all assignments that are made to the specified principal.")).option("--signInName <signInName>", $("The email address or the user principal name of the user. Filters all assignments that are made to the specified user.")).option("--spn <spn>", $("The ServicePrincipalName of the service principal. Filters all assignments that are made to the specified Azure AD application.")).option("-o --roleName <roleName>", $("Name of the Role that is assigned to the principal i.e. Reader, Contributor, Virtual Network Administrator, etc.")).option("-d --roleId <roleId>", $("Id of the Role that is assigned to the principal")).option("-c --scope <scope>", $("The Scope of the role assignment. In the format of relative URI. For e.g. /subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG. It must start with \"/subscriptions/{id}\". The command filters all assignments that are effective at that scope.")).option("-g --resource-group <resource-group>", $("The resource group name. Lists role assignments that are effective at the specified resource group. When used in conjunction with resource-name, resource-type and (optionally)parent parameters, the command lists assignments effective at resources within the resource group.")).option("-r --resource-type <resource-type>", $("The resource type. For e.g. Microsoft.Network/virtualNetworks. Must be used in conjunction with resource-name, resource-group and (optionally)parent parameters.")).option("-u --resource-name <resource-name>", $("The resource name. For e.g. storageaccountprod. Must be used in conjunction with resource-group, resource-type and (optionally)parent parameters.")).option("--parent <parent>", $("The parent resource in the hierarchy of the resource specified using --resource-name parameter. Must be used in conjunction with resource-name, resource-type and resource-group parameters.")).option("-e --expandPrincipalGroups", $("If specified, returns roles directly assigned to the user and to the groups of which the user is a member (transitively). Supported only for a user principal.")).option("-a --includeClassicAdministrators", $("If specified, also lists subscription classic administrators (co-admins, service admins, etc.) role assignments.")).option("--subscription <subscription>", $("Name or identifier of the subscription to search the role assignments.")).execute(function __2(objectId, signInName, spn, roleName, roleId, scope, resourceGroup, resourceType, resourceName, options, _) { var subscription, authzClient, graphClient, progress, assignmentCollection, subscriptionIdForScope, scopeString, assignments, expandGroups, includeAdmins, principalParameters, parameterNames; var __frame = { name: "__2", line: 203 }; return __func(_, this, arguments, __2, 10, __frame, function __$__2() {
adUtils.validateParameters({
roleName: roleName,
roleId: roleId
}, false);
adUtils.validateParameters({
objectId: objectId,
signInName: signInName,
spn: spn
}, false);
subscription = profile.current.getSubscription(options.subscription);
authzClient = rbacClients.getAuthzClient(subscription);
graphClient = adUtils.getADGraphClient(subscription);
progress = cli.interaction.progress($("Searching for role assignments"));
assignmentCollection = new RoleAssignments(authzClient, graphClient);
if (resourceGroup) {
subscriptionIdForScope = subscription.id; } ;
scopeString = RoleAssignments.buildScopeString({
scope: scope,
resourceGroup: resourceGroup,
resourceType: resourceType,
resourceName: resourceName,
parent: options.parent,
subscriptionId: subscriptionIdForScope });
expandGroups = false;
if (options.expandPrincipalGroups) {
expandGroups = true; } ;
includeAdmins = false;
if (options.includeClassicAdministrators) {
includeAdmins = true; } ;
principalParameters = {
objectId: objectId,
signInName: signInName };
if ((!assignmentCollection.optionIsSet(principalParameters) && expandGroups)) {
parameterNames = Object.keys(principalParameters);
return _(new Error(util.format(("Please provide a value to one of the parameters '%s' for using option '-e' or 'expandPrincipalGroups'"), parameterNames.join()))); } ; return (function ___(__then) { (function ___(_) { __tryCatch(_, function __$__2() {
return assignmentCollection.queryAssignmentsForList({
objectId: objectId,
signInName: signInName,
spn: spn
}, scopeString, roleName, roleId, expandGroups, includeAdmins, cli, subscription, __cb(_, __frame, 56, 43, function ___(__0, __1) { assignments = __1; _(null, null, true); }, true)); }); })(function ___(__e, __r, __cont) { (function ___(__then) { __tryCatch(_, function __$__2() {
progress.end(); __then(); }); })(function ___() { __tryCatch(_, function ___() { if (__cont) { __then(); } else { _(__e, __r); }; }); }); }); })(function ___() { __tryCatch(_, function __$__2() {
if ((assignments.length === 0)) {
log.info($("No role assignments matching the search criteria were found")); return _(null); } ;
cli.interaction.formatOutput(assignments, function(outputData) {
for (var i = 0; (i < outputData.length); i++) {
showRoleAssignment(outputData[i]); }; }); _(); }); }); }); });
roleAssignment.command("delete [objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]").usage(((((((((("[objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]" + "\n") + "\n ----- Example 1 -------") + "\n azure role assignment delete --resource-group testRG --signInName john.doe@contoso.com --roleName Reader") + "\n Removes a role assignment for john.doe@contoso.com who is assigned to the Reader role at the testRG resourcegroup scope") + "\n") + "\n ----- Example 2 -------") + "\n azure role assignment delete --objectId 2f9d4375-cbf1-48e8-83c9-2a0be4cb33fb --roleName Reader") + "\n Removes the role assignment to the group principal identified by the ObjectId and assigned to the Reader role. Defaults to using the current subscription as the scope to find the assignment to be deleted.") + "\n")).description($("Removes a role assignment to the specified principal who is assigned to a particular role at a particular scope. Use the 'azure role assignment list' command to retrieve assignments under the subscription")).option("--objectId <objectId>", $("Azure AD Objectid of the user, group or service principal")).option("--signInName <signInName>", $("The email address or the user principal name of the user.")).option("--spn <spn>", $("The ServicePrincipalName of the Azure AD application.")).option("-o --roleName <roleName>", $("The Name of the RBAC role for which the assignment needs to be deleted i.e. Reader, Contributor, Virtual Network Administrator, etc.")).option("-d --roleId <roleId>", $("The Id of the RBAC role for which the assignment needs to be deleted.")).option("-c --scope <scope>", $("The Scope of the role assignment to be deleted. In the format of relative URI. For e.g. \"/subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG\". If not specified, will attempt to delete the role assignment at subscription level. If specified, it should start with \"/subscriptions/{id}\".")).option("-g --resource-group <resource-group>", $("The resource group name. Attempts to delete an assignment at the specified resource group scope. When used in conjunction with resource-name, resource-type and (optionally)parent parameters, the command constructs a hierarchical scope in the form of a relative URI that identifies a resource.")).option("-r --resource-type <resource-type>", $("The resource type. For e.g. Microsoft.Network/virtualNetworks. Should only be used in conjunction with resource-name, resource-group and (optionally)parent parameters to construct a hierarchical scope in the form of a relative URI that identifies a resource.")).option("-u --resource-name <resource-name>", $("The resource name. For e.g. storageaccountprod. Should only be used in conjunction with resource-type, resource-group and (optionally)parent parameters to construct a hierarchical scope in the form of a relative URI that identifies a resource.")).option("--parent <parent>", $("The parent resource in the hierarchy of the resource specified using --resource-name parameter, if any. Must be used in conjunction with resource-name, resource-type and resource-group parameters to construct a hierarchical scope in the form of a relative URI that identifies a resource.")).option("-q --quiet", $("If specified, the command does not prompt for a confirmation before deleting the role assignment.")).option("--passthru", $("If specified, displays the deleted role assignment")).option("--subscription <subscription>", $("Name or identifier of the subscription to delete the role assignment")).execute(function __3(objectId, signInName, spn, roleName, roleId, scope, resourceGroup, resourceType, resourceName, options, _) { var principal, subscription, authzClient, graphClient, assignmentCollection, progress, scopeString, role, assignments, i; var __frame = { name: "__3", line: 308 }; return __func(_, this, arguments, __3, 10, __frame, function __$__3() {
principal = {
objectId: objectId,
signInName: signInName,
spn: spn };
adUtils.validateParameters(principal);
adUtils.validateParameters({
roleName: roleName,
roleId: roleId });
subscription = profile.current.getSubscription(options.subscription);
authzClient = rbacClients.getAuthzClient(subscription);
graphClient = adUtils.getADGraphClient(subscription);
assignmentCollection = new RoleAssignments(authzClient, graphClient);
scopeString = RoleAssignments.buildScopeString({
scope: scope,
resourceGroup: resourceGroup,
resourceType: resourceType,
resourceName: resourceName,
parent: options.parent,
subscriptionId: subscription.id });
role = (roleName ? roleName : roleId); return (function __$__3(_) {
var __1 = !options.quiet; if (!__1) { return _(null, __1); } ; return cli.interaction.confirm(util.format($("Delete role assignment for AD object \"%s\" at scope \"%s\" assigned to role \"%s\"? [y/n] "), assignmentCollection.activeFilterADObject(principal), scopeString, role), __cb(_, __frame, 32, 45, function ___(__0, __3) { var __2 = !__3; return _(null, __2); }, true)); })(__cb(_, __frame, -307, 17, function ___(__0, __2) { return (function __$__3(__then) { if (__2) { return _(null); } else { __then(); } ; })(function __$__3() {
return assignmentCollection.queryAssignmentsForDelete(principal, scopeString, roleName, roleId, cli, subscription, __cb(_, __frame, 37, 45, function ___(__0, __3) { assignments = __3;
if (roleId) {
assignments = assignments.filter(function(a) {
return utils.ignoreCaseEquals(a.properties.roleDefinitionId, roleId); }); } ; return (function __$__3(__then) {
if ((assignments.length === 1)) {
progress = cli.interaction.progress($("Deleting role assignment")); return (function ___(__then) { (function ___(_) { __tryCatch(_, function __$__3() {
return authzClient.roleAssignments.deleteById(assignments[0].id, __cb(_, __frame, 51, 38, function __$__3() { _(null, null, true); }, true)); }); })(function ___(__e, __r, __cont) { (function ___(__then) { __tryCatch(_, function __$__3() {
progress.end(); __then(); }); })(function ___() { __tryCatch(_, function ___() { if (__cont) { __then(); } else { _(__e, __r); }; }); }); }); })(function ___() { __tryCatch(_, function __$__3() {
if (options.passthru) {
cli.interaction.formatOutput(assignments[0], function(assignment) {
showRoleAssignment(assignment); }); } ; __then(); }); }); } else { return (function __$__3(__then) {
if ((assignments.length === 0)) {
return _(new Error($("No role assignment matching the search criteria was found"))); } else { return (function __$__3(__then) {
if (assignments.every(function(a) {
return utils.ignoreCaseEquals(a.properties.roleDefinitionId, assignments[0].properties.roleDefinitionId); })) {
progress = cli.interaction.progress($("Deleting role assignments")); return (function ___(__then) { (function ___(_) { __tryCatch(_, function __$__3() {
i = 0; var __8 = false; return (function ___(__break) { var __more; var __loop = __cb(_, __frame, 0, 0, function __$__3() { __more = false; if (__8) { i++; } else { __8 = true; } ; var __7 = (i < assignments.length); if (__7) {
return authzClient.roleAssignments.deleteById(assignments[i].id, __cb(_, __frame, 76, 42, function __$__3() { while (__more) { __loop(); }; __more = true; }, true)); } else { __break(); } ; }); do { __loop(); } while (__more); __more = true; })(function __$__3() { _(null, null, true); }); }); })(function ___(__e, __r, __cont) { (function ___(__then) { __tryCatch(_, function __$__3() {
progress.end(); __then(); }); })(function ___() { __tryCatch(_, function ___() { if (__cont) { __then(); } else { _(__e, __r); }; }); }); }); })(function ___() { __tryCatch(_, function __$__3() {
if (options.passthru) {
cli.interaction.formatOutput(assignments, function(data) {
data.forEach(function(assignment) {
showRoleAssignment(assignment); }); }); } ; __then(); }); }); } else {
return _(new Error(util.format($("Multiple role definitions found with name '%s'. Specify role definition using it's Id instead."), roleName))); } ; })(__then); } ; })(__then); } ; })(_); }, true)); }); }, true)); }); });
function showRoleAssignment(roleAssignment) {
log.data($("RoleAssignmentId :"), roleAssignment.id);
log.data($("RoleDefinitionName :"), roleAssignment.properties.roleName);
log.data($("RoleDefinitionId :"), roleAssignment.properties.roleDefinitionId);
log.data($("Scope :"), roleAssignment.properties.scope);
log.data($("Display Name :"), roleAssignment.properties.aADObject.displayName);
log.data($("SignInName :"), roleAssignment.properties.aADObject.userPrincipalName);
log.data($("ObjectId :"), roleAssignment.properties.aADObject.objectId);
log.data($("ObjectType :"), roleAssignment.properties.aADObject.objectType);
log.data(""); };};