Skip to content

Commit 0b16a63

Browse files
markcowlmarkcowl
committed
Merge pull request #930 from namratab/bugfix
Authorization: Inline the code in helper methods in the Get-AzureRMAuthorizationChangeLog script commandlet since those helper methods are also showing up as powershell commands
2 parents 7e59cda + c68d6d8 commit 0b16a63

File tree

1 file changed

+58
-62
lines changed

1 file changed

+58
-62
lines changed

‎src/ResourceManager/Resources/Commands.Resources/ResourceManagerStartup.ps1‎

Lines changed: 58 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@ function Get-AzureRMAuthorizationChangeLog {
7474

7575
# Create the output structure
7676
$out = "" | select Timestamp, Caller, Action, PrincipalId, PrincipalName, PrincipalType, Scope, ScopeName, ScopeType, RoleDefinitionId, RoleName
77-
$out.Timestamp = $endEvent.EventTimestamp
77+
78+
$out.Timestamp = Get-Date -Date $endEvent.EventTimestamp -Format u
7879
$out.Caller = $_.Caller
7980
if ($_.HttpRequest.Method -ieq "PUT") {
8081
$out.Action = "Granted"
@@ -92,21 +93,72 @@ function Get-AzureRMAuthorizationChangeLog {
9293
}
9394

9495
if ($messageBody) {
95-
96+
# Process principal details
9697
$out.PrincipalId = $messageBody.properties.principalId
9798
if ($out.PrincipalId -ne $null) {
98-
$principalDetails = Get-PrincipalDetails $out.PrincipalId ([REF]$principalDetailsCache)
99+
# Get principal details by querying Graph. Cache principal details and read from cache if present
100+
$principalId = $out.PrincipalId
101+
102+
if($principalDetailsCache.ContainsKey($principalId)) {
103+
# Found in cache
104+
$principalDetails = $principalDetailsCache[$principalId]
105+
} else { # not in cache
106+
$principalDetails = "" | select Name, Type
107+
$user = Get-AzureRMADUser -ObjectId $principalId
108+
if ($user) {
109+
$principalDetails.Name = $user.DisplayName
110+
$principalDetails.Type = "User"
111+
} else {
112+
$group = Get-AzureRMADGroup -ObjectId $principalId
113+
if ($group) {
114+
$principalDetails.Name = $group.DisplayName
115+
$principalDetails.Type = "Group"
116+
} else {
117+
$servicePrincipal = Get-AzureRMADServicePrincipal -objectId $principalId
118+
if ($servicePrincipal) {
119+
$principalDetails.Name = $servicePrincipal.DisplayName
120+
$principalDetails.Type = "Service Principal"
121+
}
122+
}
123+
}
124+
# add principal details to cache
125+
$principalDetailsCache.Add($principalId, $principalDetails);
126+
}
127+
99128
$out.PrincipalName = $principalDetails.Name
100129
$out.PrincipalType = $principalDetails.Type
101130
}
102131

132+
# Process scope details
103133
if ([string]::IsNullOrEmpty($out.Scope)) { $out.Scope = $messageBody.properties.Scope }
104134
if ($out.Scope -ne $null) {
105-
$resourceDetails = Get-ResourceDetails $out.Scope
106-
$out.ScopeName = $resourceDetails.Name
135+
# Remove the authorization provider details from the scope, if present
136+
if ($out.Scope.ToLower().Contains("/providers/microsoft.authorization")) {
137+
$index = $out.Scope.ToLower().IndexOf("/providers/microsoft.authorization")
138+
$out.Scope = $out.Scope.Substring(0, $index)
139+
}
140+
141+
$scope = $out.Scope
142+
$resourceDetails = "" | select Name, Type
143+
$scopeParts = $scope.Split('/', [System.StringSplitOptions]::RemoveEmptyEntries)
144+
$len = $scopeParts.Length
145+
146+
if ($len -gt 0 -and $len -le 2 -and $scope.ToLower().Contains("subscriptions")) {
147+
$resourceDetails.Type = "Subscription"
148+
$resourceDetails.Name = $scopeParts[1]
149+
} elseif ($len -gt 0 -and $len -le 4 -and $scope.ToLower().Contains("resourcegroups")) {
150+
$resourceDetails.Type = "Resource Group"
151+
$resourceDetails.Name = $scopeParts[3]
152+
} elseif ($len -ge 6 -and $scope.ToLower().Contains("providers")) {
153+
$resourceDetails.Type = "Resource"
154+
$resourceDetails.Name = $scopeParts[$len -1]
155+
}
156+
157+
$out.ScopeName = $resourceDetails.Name
107158
$out.ScopeType = $resourceDetails.Type
108159
}
109160

161+
# Process Role definition details
110162
$out.RoleDefinitionId = $messageBody.properties.roleDefinitionId
111163
if ($out.RoleDefinitionId -ne $null) {
112164
if ($azureRoleDefinitionCache[$out.RoleDefinitionId]) {
@@ -124,7 +176,7 @@ function Get-AzureRMAuthorizationChangeLog {
124176
if($_.Status -ne $null -and $_.Status -ieq "Succeeded" -and $_.OperationName -ne $null -and $_.operationName.StartsWith("Microsoft.Authorization/ClassicAdministrators", [System.StringComparison]::OrdinalIgnoreCase)) {
125177

126178
$out = "" | select Timestamp, Caller, Action, PrincipalId, PrincipalName, PrincipalType, Scope, ScopeName, ScopeType, RoleDefinitionId, RoleName
127-
$out.Timestamp = $_.EventTimestamp
179+
$out.Timestamp = Get-Date -Date $_.EventTimestamp -Format u
128180
$out.Caller = "Subscription Admin"
129181

130182
if($_.operationName -ieq "Microsoft.Authorization/ClassicAdministrators/write"){
@@ -153,60 +205,4 @@ function Get-AzureRMAuthorizationChangeLog {
153205
$output | Sort Timestamp
154206
}
155207
} # End commandlet
156-
157-
# Helper functions
158-
# Resolve a principal. If the principal's object id was encountered in the principals resolved so far, return principalDetails from the cache.
159-
# Else make a Grpah call and add that principal to cache of known principals
160-
function Get-PrincipalDetails($principalId, [REF]$principalDetailsCache)
161-
{
162-
if($principalDetailsCache.Value.ContainsKey($principalId)) {
163-
return $principalDetailsCache.Value[$principalId]
164-
}
165-
166-
$principalDetails = "" | select Name, Type
167-
$user = Get-AzureRMADUser -ObjectId $principalId
168-
if ($user) {
169-
$principalDetails.Name = $user.DisplayName
170-
$principalDetails.Type = "User"
171-
} else {
172-
$group = Get-AzureRMADGroup -ObjectId $principalId
173-
if ($group) {
174-
$principalDetails.Name = $group.DisplayName
175-
$principalDetails.Type = "Group"
176-
} else {
177-
$servicePrincipal = Get-AzureRMADServicePrincipal -objectId $principalId
178-
if ($servicePrincipal) {
179-
$principalDetails.Name = $servicePrincipal.DisplayName
180-
$principalDetails.Type = "Service Principal"
181-
}
182-
}
183-
}
184-
185-
$principalDetailsCache.Value.Add($principalId, $principalDetails);
186-
187-
$principalDetails
188-
}
189-
190-
# Get resource details from scope
191-
function Get-ResourceDetails($scope)
192-
{
193-
$resourceDetails = "" | select Name, Type
194-
$scopeParts = $scope.Split('/', [System.StringSplitOptions]::RemoveEmptyEntries)
195-
$len = $scopeParts.Length
196-
197-
if ($len -gt 0 -and $len -le 2 -and $scope.ToLower().Contains("subscriptions")) {
198-
$resourceDetails.Type = "Subscription"
199-
$resourceDetails.Name = $scopeParts[1]
200-
}
201-
elseif ($len -gt 0 -and $len -le 4 -and $scope.ToLower().Contains("resourcegroups")) {
202-
$resourceDetails.Type = "Resource Group"
203-
$resourceDetails.Name = $scopeParts[3]
204-
}
205-
elseif ($len -ge 6 -and $scope.ToLower().Contains("providers")) {
206-
$resourceDetails.Type = "Resource"
207-
$resourceDetails.Name = $scopeParts[$len -1]
208-
}
209-
210-
$resourceDetails
211-
}
212208

0 commit comments

Comments
 (0)