Skip to content

Commit 90d2354

Browse files
troettingertroettinger
authored
Merge pull request #521 from Azure/users/jash/RefineGDPR
Refine Portal GDPR cmdlets
2 parents fa726bc + e25693b commit 90d2354

File tree

1 file changed

+236
-59
lines changed

1 file changed

+236
-59
lines changed

‎DatacenterIntegration/Portal/PortalUserDataGdprUtilities.psm1‎

Lines changed: 236 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -6,39 +6,27 @@
66

77
$DefaultAdminSubscriptionName = "Default Provider Subscription"
88

9-
<#
10-
.Synopsis
11-
Clear the portal user data
12-
#>
13-
function Clear-AzsUserData
9+
function Initialize-UserDataClearEnv
1410
{
1511
param
1612
(
17-
# The directory tenant identifier of Azure Stack Administrator.
13+
# The directory tenant identifier of Azure Stack.
1814
[Parameter(Mandatory=$true)]
1915
[ValidateNotNullOrEmpty()]
20-
[string] $AzsAdminDirectoryTenantId,
16+
[string] $AzsDirectoryTenantId,
2117

2218
# The Azure Stack ARM endpoint URI.
2319
[Parameter(Mandatory=$true)]
2420
[ValidateNotNullOrEmpty()]
25-
[Uri] $AzsAdminArmEndpoint,
21+
[Uri] $AzsArmEndpoint,
2622

27-
# The user principal name of the account who's user data should be cleared.
28-
[Parameter(Mandatory=$true)]
29-
[ValidateNotNullOrEmpty()]
30-
[string] $UserPrincipalName,
23+
# Optional: A credential used to authenticate with Azure Stack. Must support a non-interactive authentication flow. If not provided, the script will prompt for user credentials.
24+
[pscredential] $AutomationCredential = $null,
3125

32-
# Optional: The directory tenant identifier of account who's user data should be cleared.
33-
# If it is not specified, it will delete all the
34-
[Parameter(Mandatory=$false)]
3526
[ValidateNotNullOrEmpty()]
36-
[string] $DirectoryTenantId,
37-
38-
# Optional: A credential used to authenticate with Azure Stack. Must support a non-interactive authentication flow. If not provided, the script will prompt for user credentials.
39-
[ValidateNotNull()]
40-
[pscredential] $AutomationCredential = $null
27+
[string] $UserPrincipalName
4128
)
29+
4230
#requires -Version 4.0
4331
#requires -Module "AzureRM.Profile"
4432
#requires -Module "Azs.Subscriptions.Admin"
@@ -50,10 +38,10 @@ function Clear-AzsUserData
5038
Import-Module $PSScriptRoot\..\..\Identity\GraphAPI\GraphAPI.psm1 -Force
5139
Import-Module $PSScriptRoot\..\..\Identity\AzureStack.Identity.Common.psm1 -Force
5240

53-
Write-Verbose "Login to Azure Stack Admin ARM..." -Verbose
41+
Write-Verbose "Login to Azure Stack ARM..." -Verbose
5442
$AzsAdminEnvironmentName = "AzureStackAdmin"
5543
$params = @{
56-
ResourceManagerEndpoint = $AzsAdminArmEndpoint
44+
ResourceManagerEndpoint = $AzsArmEndpoint
5745
EnvironmentName = $AzsAdminEnvironmentName
5846
}
5947
$adminArmEnv = Initialize-AzureRmEnvironment @params
@@ -69,60 +57,153 @@ function Clear-AzsUserData
6957
$params.AutomationCredential = $AutomationCredential
7058
}
7159
$refreshToken = Initialize-AzureRmUserRefreshToken @params
72-
Write-Verbose "Login into admin ARM and got the refresh token." -Verbose
60+
Write-Verbose "Login into ARM and got the refresh token." -Verbose
7361

74-
$adminSubscriptionId = (Get-AzureRmSubscription -Verbose | where { $_.Name -ieq $DefaultAdminSubscriptionName }).Id
75-
Write-Verbose "Get default Admin subscription id $adminSubscriptionId." -Verbose
76-
77-
if ($DirectoryTenantId)
78-
{
79-
$directoryTenantIdsArray = [string[]]$DirectoryTenantId
80-
}
81-
else
82-
{
83-
Write-Verbose "Input parameter 'DirectoryTenantId' is empty. Retrieving all the registered tenant directory..." -Verbose
84-
$directoryTenantIdsArray = (Get-AzsDirectoryTenant -Verbose).TenantId
85-
}
86-
87-
Write-Host "Clearing the user data with input user principal name $UserPrincipalName and directory tenants '$DirectoryTenantIdsArray'..."
88-
89-
$clearUserDataResults = @() # key is directory Id, value is clear response
90-
91-
$initializeGraphEnvParams = @{
62+
$script:initializeGraphEnvParams = @{
9263
RefreshToken = $refreshToken
9364
}
9465
if ($adminArmEnv.EnableAdfsAuthentication)
9566
{
96-
$initializeGraphEnvParams.AdfsFqdn = (New-Object Uri $adminArmEnv.ActiveDirectoryAuthority).Host
97-
$initializeGraphEnvParams.GraphFqdn = (New-Object Uri $adminArmEnv.GraphUrl).Host
67+
$script:initializeGraphEnvParams.AdfsFqdn = (New-Object Uri $adminArmEnv.ActiveDirectoryAuthority).Host
68+
$script:initializeGraphEnvParams.GraphFqdn = (New-Object Uri $adminArmEnv.GraphUrl).Host
9869

99-
$QueryParameters = @{
70+
$script:queryParameters = @{
10071
'$filter' = "userPrincipalName eq '$($UserPrincipalName.ToLower())'"
10172
}
10273
}
10374
else
10475
{
10576
$graphEnvironment = Resolve-GraphEnvironment -AzureEnvironment $adminArmEnv
10677
Write-Verbose "Resolve the graph env as '$graphEnvironment '" -Verbose
107-
$initializeGraphEnvParams.Environment = $graphEnvironment
78+
$script:initializeGraphEnvParams.Environment = $graphEnvironment
10879

109-
$QueryParameters = @{
80+
$script:queryParameters = @{
11081
'$filter' = "userPrincipalName eq '$($UserPrincipalName.ToLower())' or startswith(userPrincipalName, '$($UserPrincipalName.Replace("@", "_").ToLower() + "#")')"
11182
}
11283
}
11384

114-
Write-Verbose "Retrieving access token..." -Verbose
115-
Initialize-GraphEnvironment @initializeGraphEnvParams -DirectoryTenantId $AzsAdminDirectoryTenantId
116-
$accessToken = (Get-GraphToken -Resource $adminArmEnv.ActiveDirectoryServiceEndpointResourceId -UseEnvironmentData).access_token
85+
Initialize-GraphEnvironment @script:initializeGraphEnvParams -DirectoryTenantId $AzsDirectoryTenantId
86+
$script:adminArmAccessToken = (Get-GraphToken -Resource $adminArmEnv.ActiveDirectoryServiceEndpointResourceId -UseEnvironmentData).access_token
87+
}
88+
89+
<#
90+
.Synopsis
91+
Clear the portal user data
92+
#>
93+
function Clear-AzsUserDataWithUserPrincipalName
94+
{
95+
param
96+
(
97+
# The directory tenant identifier of Azure Stack Administrator.
98+
[Parameter(Mandatory=$true)]
99+
[ValidateNotNullOrEmpty()]
100+
[string] $AzsAdminDirectoryTenantId,
101+
102+
# The Azure Stack ARM endpoint URI.
103+
[Parameter(Mandatory=$true)]
104+
[ValidateNotNullOrEmpty()]
105+
[Uri] $AzsAdminArmEndpoint,
106+
107+
# The user principal name of the account whoes user data should be cleared.
108+
[Parameter(Mandatory=$true)]
109+
[ValidateNotNullOrEmpty()]
110+
[string] $UserPrincipalName,
111+
112+
# Optional: The directory tenant identifier of account whoes user data should be cleared.
113+
# If it is not specified, it will delete user with principal name under all regitered directory tenants
114+
[Parameter(Mandatory=$false)]
115+
[ValidateNotNullOrEmpty()]
116+
[string] $DirectoryTenantId,
117+
118+
# Optional: A credential used to authenticate with Azure Stack. Must support a non-interactive authentication flow. If not provided, the script will prompt for user credentials.
119+
[ValidateNotNull()]
120+
[pscredential] $AutomationCredential = $null
121+
)
122+
123+
$params = @{
124+
AzsAdminDirectoryTenantId = $AzsAdminDirectoryTenantId
125+
AzsAdminArmEndpoint = $AzsAdminArmEndpoint
126+
UserPrincipalName = $UserPrincipalName
127+
}
128+
129+
if ($DirectoryTenantId) {
130+
$params.DirectoryTenantId = $DirectoryTenantId
131+
}
132+
133+
if ($AutomationCredential) {
134+
$params.AutomationCredential = $AutomationCredential
135+
}
136+
137+
Clear-AzsUserData @params
138+
}
139+
140+
<#
141+
.Synopsis
142+
Deprecated: Clear the portal user data
143+
#>
144+
function Clear-AzsUserData
145+
{
146+
param
147+
(
148+
# The directory tenant identifier of Azure Stack Administrator.
149+
[Parameter(Mandatory=$true)]
150+
[ValidateNotNullOrEmpty()]
151+
[string] $AzsAdminDirectoryTenantId,
152+
153+
# The Azure Stack ARM endpoint URI.
154+
[Parameter(Mandatory=$true)]
155+
[ValidateNotNullOrEmpty()]
156+
[Uri] $AzsAdminArmEndpoint,
157+
158+
# The user principal name of the account whoes user data should be cleared.
159+
[Parameter(Mandatory=$true)]
160+
[ValidateNotNullOrEmpty()]
161+
[string] $UserPrincipalName,
162+
163+
# Optional: The directory tenant identifier of account whoes user data should be cleared.
164+
# If it is not specified, it will delete user with principal name under all regitered directory tenants
165+
[Parameter(Mandatory=$false)]
166+
[ValidateNotNullOrEmpty()]
167+
[string] $DirectoryTenantId,
168+
169+
# Optional: A credential used to authenticate with Azure Stack. Must support a non-interactive authentication flow. If not provided, the script will prompt for user credentials.
170+
[ValidateNotNull()]
171+
[pscredential] $AutomationCredential = $null
172+
)
173+
174+
$ErrorActionPreference = 'Stop'
175+
$VerbosePreference = 'Continue'
176+
177+
$params = @{
178+
AzsAdminDirectoryTenantId = $AzsAdminDirectoryTenantId
179+
AzsAdminArmEndpoint = $AzsAdminArmEndpoint
180+
AutomationCredential = $AutomationCredential
181+
UserPrincipalName = $UserPrincipalName
182+
}
183+
Initialize-UserDataClearEnv @params
184+
185+
if ($DirectoryTenantId)
186+
{
187+
$directoryTenantIdsArray = [string[]]$DirectoryTenantId
188+
}
189+
else
190+
{
191+
Write-Verbose "Input parameter 'DirectoryTenantId' is empty. Retrieving all the registered tenant directory..." -Verbose
192+
$directoryTenantIdsArray = (Get-AzsDirectoryTenant -Verbose).TenantId
193+
}
194+
195+
Write-Host "Clearing the user data with input user principal name $UserPrincipalName and directory tenants '$DirectoryTenantIdsArray'..."
196+
197+
$clearUserDataResults = @() # key is directory Id, value is clear response
117198

118199
foreach ($dirId in $directoryTenantIdsArray)
119200
{
120201
Write-Verbose "Intializing graph env..." -Verbose
121-
Initialize-GraphEnvironment @initializeGraphEnvParams -DirectoryTenantId $dirId
202+
Initialize-GraphEnvironment @script:initializeGraphEnvParams -DirectoryTenantId $dirId
122203
Write-Verbose "Intialized graph env" -Verbose
123204

124205
Write-Verbose "Querying all users..." -Verbose
125-
$usersResponse = Invoke-GraphApi -ApiPath "/users" -QueryParameters $QueryParameters
206+
$usersResponse = Invoke-GraphApi -ApiPath "/users" -QueryParameters $script:queryParameters
126207
Write-Verbose "Retrieved user object as $(ConvertTo-JSON $usersResponse.value)" -Verbose
127208

128209
$userObjectId = $usersResponse.value.objectId
@@ -150,10 +231,9 @@ function Clear-AzsUserData
150231
else
151232
{
152233
$params = @{
153-
AccessToken = $accessToken
234+
AccessToken = $script:adminArmAccessToken
154235
UserObjectId = $userObjectId
155236
DirectoryTenantId = $dirId
156-
AdminSubscriptionId = $adminSubscriptionId
157237
AzsAdminArmEndpoint = $AzsAdminArmEndpoint
158238
}
159239
$curResult = Clear-SinglePortalUserData @params
@@ -164,6 +244,101 @@ function Clear-AzsUserData
164244
return $clearUserDataResult
165245
}
166246

247+
<#
248+
.Synopsis
249+
Clear the portal user data
250+
#>
251+
function Clear-AzsUserDataWithUserObjectId
252+
{
253+
param
254+
(
255+
# The directory tenant identifier of Azure Stack Administrator.
256+
[Parameter(Mandatory=$true)]
257+
[ValidateNotNullOrEmpty()]
258+
[string] $AzsAdminDirectoryTenantId,
259+
260+
# The Azure Stack ARM endpoint URI.
261+
[Parameter(Mandatory=$true)]
262+
[ValidateNotNullOrEmpty()]
263+
[Uri] $AzsAdminArmEndpoint,
264+
265+
# The user object Id of the account whoes user data should be cleared.
266+
[Parameter(Mandatory=$true)]
267+
[ValidateNotNullOrEmpty()]
268+
[string] $UserObjectId,
269+
270+
# The directory tenant identifier of account whoes user data should be cleared.
271+
[Parameter(Mandatory=$true)]
272+
[ValidateNotNullOrEmpty()]
273+
[string] $DirectoryTenantId,
274+
275+
# Optional: A credential used to authenticate with Azure Stack. Must support a non-interactive authentication flow. If not provided, the script will prompt for user credentials.
276+
[ValidateNotNull()]
277+
[pscredential] $AutomationCredential = $null
278+
)
279+
280+
$ErrorActionPreference = 'Stop'
281+
$VerbosePreference = 'Continue'
282+
283+
$params = @{
284+
AzsAdminDirectoryTenantId = $AzsAdminDirectoryTenantId
285+
AzsAdminArmEndpoint = $AzsAdminArmEndpoint
286+
AutomationCredential = $AutomationCredential
287+
}
288+
Initialize-UserDataClearEnv @params
289+
290+
$params = @{
291+
AccessToken = $script:adminArmAccessToken
292+
UserObjectId = $UserObjectId
293+
DirectoryTenantId = $DirectoryTenantId
294+
AzsAdminArmEndpoint = $AzsAdminArmEndpoint
295+
}
296+
Clear-SinglePortalUserData @params
297+
}
298+
299+
function Get-UserObjectId
300+
{
301+
param
302+
(
303+
# The directory tenant identifier of user account
304+
[Parameter(Mandatory=$true)]
305+
[ValidateNotNullOrEmpty()]
306+
[string] $DirectoryTenantId,
307+
308+
# The Azure Stack ARM endpoint URI.
309+
[Parameter(Mandatory=$true)]
310+
[ValidateNotNullOrEmpty()]
311+
[Uri] $AzsArmEndpoint,
312+
313+
# The user principal name of the account whoes user data should be cleared.
314+
[Parameter(Mandatory=$true)]
315+
[ValidateNotNullOrEmpty()]
316+
[string] $UserPrincipalName,
317+
318+
# Optional: A credential used to authenticate with Azure Stack. Must support a non-interactive authentication flow. If not provided, the script will prompt for user credentials.
319+
[ValidateNotNull()]
320+
[pscredential] $AutomationCredential = $null
321+
)
322+
323+
$params = @{
324+
AzsAdminDirectoryTenantId = $DirectoryTenantId
325+
AzsAdminArmEndpoint = $AzsArmEndpoint
326+
AutomationCredential = $AutomationCredential
327+
UserPrincipalName = $UserPrincipalName
328+
}
329+
Initialize-UserDataClearEnv @params
330+
331+
Write-Verbose "Intializing graph env..." -Verbose
332+
Initialize-GraphEnvironment @script:initializeGraphEnvParams -DirectoryTenantId $DirectoryTenantId
333+
Write-Verbose "Intialized graph env" -Verbose
334+
335+
Write-Verbose "Querying all users..." -Verbose
336+
$usersResponse = Invoke-GraphApi -ApiPath "/users" -QueryParameters $script:queryParameters
337+
Write-Verbose "Retrieved user object as $(ConvertTo-JSON $usersResponse.value)" -Verbose
338+
339+
return $usersResponse.value.objectId
340+
}
341+
167342
function Clear-SinglePortalUserData
168343
{
169344
param
@@ -181,10 +356,6 @@ function Clear-SinglePortalUserData
181356
[ValidateNotNull()]
182357
[string] $DirectoryTenantId,
183358

184-
[Parameter(Mandatory=$true)]
185-
[ValidateNotNull()]
186-
[string] $AdminSubscriptionId,
187-
188359
# The Azure Stack ARM endpoint URI.
189360
[Parameter(Mandatory=$true)]
190361
[ValidateNotNull()]
@@ -193,7 +364,10 @@ function Clear-SinglePortalUserData
193364

194365
try
195366
{
196-
$clearUserDataEndpoint = "$AzsAdminArmEndpoint/subscriptions/$AdminSubscriptionId/providers/Microsoft.PortalExtensionHost.Providers/ClearUserSettings?api-version=2017-09-01-preview"
367+
$adminSubscriptionId = (Get-AzureRmSubscription -Verbose | where { $_.Name -ieq $DefaultAdminSubscriptionName }).Id
368+
Write-Verbose "Get default Admin subscription id $adminSubscriptionId." -Verbose
369+
370+
$clearUserDataEndpoint = "$AzsAdminArmEndpoint/subscriptions/$adminSubscriptionId/providers/Microsoft.PortalExtensionHost.Providers/ClearUserSettings?api-version=2017-09-01-preview"
197371
$headers = @{
198372
Authorization = "Bearer $accessToken"
199373
"Content-Type" = "application/json"
@@ -236,4 +410,7 @@ function Clear-SinglePortalUserData
236410
}
237411
}
238412

239-
Export-ModuleMember -Function Clear-AzsUserData
413+
Export-ModuleMember -Function Get-UserObjectId
414+
Export-ModuleMember -Function Clear-AzsUserData
415+
Export-ModuleMember -Function Clear-AzsUserDataWithUserPrincipalName
416+
Export-ModuleMember -Function Clear-AzsUserDataWithUserObjectId

0 commit comments

Comments
 (0)