Skip to content

Commit 0acb1cf

Browse files
committed
Revert default role assignment in New-AzureRmADServicePrincipal, update help with examples
1 parent 3400374 commit 0acb1cf

File tree

3 files changed

+116
-19
lines changed

3 files changed

+116
-19
lines changed

src/ResourceManager/Resources/ChangeLog.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@
1818
- Additional information about change #1
1919
-->
2020
## Current Release
21+
* Revert change to `New-AzureRmADServicePrincipal` that gave service principals "Contributor" permissions over the current subscription if no values were provided for the `Role` or `Scope` parameters
22+
- If no values are provided for `Role` or `Scope`, the service principal is created with no permissions
23+
- If a `Role` is provided, but no `Scope`, the service principal is created with the specified `Role` permissions over the current subscription
24+
- If a `Scope` is provided, but no `Contributor`, the service principal is created with `Contributor` permissions over the specified `Scope`
25+
- If both `Role` and `Scope` are provided, the service principal is created with the specified `Role` permissions over the specified `Scope`
2126

2227
## Version 6.0.0
2328
* Set minimum dependency of module to PowerShell 5.0

src/ResourceManager/Resources/Commands.Resources/ActiveDirectory/NewAzureADServicePrincipalCommand.cs

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,8 @@ public class NewAzureADServicePrincipalCommand : ActiveDirectoryBaseCmdlet
5656
HelpMessage = "The display name for the application.")]
5757
[Parameter(Mandatory = true, ValueFromPipelineByPropertyName = true, ParameterSetName = ParameterSet.DisplayNameWithKeyCredential,
5858
HelpMessage = "The display name for the application.")]
59-
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The display name for the application.")]
59+
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The display name for the application. If a display name is not provided, " +
60+
"this value will default to 'azure-powershell-MM-dd-yyyy-HH-mm-ss', where the suffix is the time of application creation.")]
6061
[ValidateNotNullOrEmpty]
6162
public string DisplayName { get; set; }
6263

@@ -96,7 +97,8 @@ public class NewAzureADServicePrincipalCommand : ActiveDirectoryBaseCmdlet
9697
HelpMessage = "The value for the password credential associated with the application that will be valid for one year by default.")]
9798
[Parameter(Mandatory = true, ParameterSetName = ParameterSet.ApplicationObjectWithPasswordPlain,
9899
HelpMessage = "The value for the password credential associated with the application that will be valid for one year by default.")]
99-
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The value for the password credential associated with the application.")]
100+
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The value for the password credential associated with the application. If a " +
101+
"password is not provided, a random GUID will be generated and used as the password.")]
100102
[ValidateNotNullOrEmpty]
101103
public SecureString Password { get; set; }
102104

@@ -141,11 +143,14 @@ public class NewAzureADServicePrincipalCommand : ActiveDirectoryBaseCmdlet
141143
HelpMessage = "The end date till which password or key is valid. Default value is one year after the start date.")]
142144
public DateTime EndDate { get; set; }
143145

144-
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The scope that the service principal has permissions on.")]
146+
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The scope that the service principal has permissions on. If a value for Role is provided, but " +
147+
"no value is provided for Scope, then Scope will default to the current subscription.")]
145148
[ScopeCompleter]
146149
public string Scope { get; set; }
147150

148-
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The role that the service principal has over the scope.")]
151+
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "The role that the service principal has over the scope. If a value for Scope is provided, but " +
152+
"no value is provided for Role, then Role will default to the 'Contributor' role.")]
153+
[PSArgumentCompleter("Reader", "Contributor", "Owner")]
149154
public string Role { get; set; }
150155

151156
[Parameter(Mandatory = false, ParameterSetName = SimpleParameterSet, HelpMessage = "If set, will skip creating the default role assignment for the service principal.")]
@@ -345,16 +350,22 @@ private void CreateSimpleServicePrincipal()
345350
}
346351
};
347352

348-
if (ShouldProcess(target: createParameters.ApplicationId.ToString(), action: string.Format("Adding a new service principal to be associated with an application having AppId '{0}'", createParameters.ApplicationId)))
353+
var shouldProcessMessage = SkipRoleAssignment() ?
354+
string.Format("Adding a new service principal to be associated with an application " +
355+
"having AppId '{0}' with no permissions.", createParameters.ApplicationId) :
356+
string.Format("Adding a new service principal to be associated with an application " +
357+
"having AppId '{0}' with '{1}' role over scope '{2}'.", createParameters.ApplicationId, this.Role, this.Scope);
358+
if (ShouldProcess(target: createParameters.ApplicationId.ToString(), action: shouldProcessMessage))
349359
{
350360
var servicePrincipal = ActiveDirectoryClient.CreateServicePrincipal(createParameters);
351361
WriteObject(servicePrincipal);
352-
if (this.IsParameterBound(c => c.SkipAssignment))
362+
if (SkipRoleAssignment())
353363
{
354364
WriteVerbose("Skipping role assignment for the service principal.");
355365
return;
356366
}
357367

368+
WriteWarning(string.Format("Assigning role '{0}' over scope '{1}' to the new service principal.", this.Role, this.Scope));
358369
FilterRoleAssignmentsOptions parameters = new FilterRoleAssignmentsOptions()
359370
{
360371
Scope = this.Scope,
@@ -391,5 +402,10 @@ private void CreateSimpleServicePrincipal()
391402
}
392403
}
393404
}
405+
406+
private bool SkipRoleAssignment()
407+
{
408+
return this.IsParameterBound(c => c.SkipAssignment) || (!this.IsParameterBound(c => c.Role) && !this.IsParameterBound(c => c.Scope));
409+
}
394410
}
395411
}

src/ResourceManager/Resources/Commands.Resources/help/New-AzureRmADServicePrincipal.md

Lines changed: 89 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -113,31 +113,107 @@ New-AzureRmADServicePrincipal -ApplicationObject <PSADApplication> -KeyCredentia
113113
```
114114

115115
## DESCRIPTION
116-
Creates a new azure active directory service principal.
116+
Creates a new azure active directory service principal. The default parameter set uses default values for parameters if the user does not provide one for them. For more information on the default values used, please see the description for the given parameters below.
117+
118+
This cmdlet has the ability to assign a role to the service principal with the `Role` and `Scope` parameters; if neither of these parameters are provided, no role will be assigned to the service principal. The default values for the `Role` and `Scope` parameters are "Contributor" and the current subscription, respectively (_note_: the defaults are only used when the user provides a value for one of the two parameters, but not the other).
117119

118-
Note: The cmdlet also implicitly creates an application and sets its properties (if the ApplicationId is not provided).
119-
In order to update the application specific parameters please use Set-AzureRmADApplication cmdlet.
120+
The cmdlet also implicitly creates an application and sets its properties (if the ApplicationId is not provided). In order to update the application specific parameters please use Set-AzureRmADApplication cmdlet.
120121

121122
## EXAMPLES
122123

123-
### Example 1 - Create a new AD service principal using application id
124+
### Example 1 - Simple AD service principal creation
125+
126+
```
127+
PS C:\> New-AzureRmADServicePrincipal
128+
129+
ServicePrincipalNames : {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, http://azure-powershell-05-22-2018-18-23-43}
130+
ApplicationId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
131+
DisplayName : azure-powershell-05-22-2018-18-23-43
132+
Id : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
133+
Type : ServicePrincipal
134+
```
135+
136+
The above command creates an AD service principal using default values for parameters not provided. Since an application id was not provided, an application was created for the service principal. Since no values were provided for `Role` or `Scope`, the created service principal does not have any permissions.
137+
138+
### Example 2 - Simple AD service principal creation with a specified role and default scope
139+
140+
```
141+
PS C:\> New-AzureRmADServicePrincipal -Role Reader
142+
143+
ServicePrincipalNames : {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, http://azure-powershell-05-22-2018-18-23-43}
144+
ApplicationId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
145+
DisplayName : azure-powershell-05-22-2018-18-23-43
146+
Id : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
147+
Type : ServicePrincipal
148+
149+
WARNING: Assigning role 'Reader' over scope '/subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz' to the new service principal.
150+
```
151+
152+
The above command creates an AD service principal using the default values for parameters not provided. Since the application id was not provided, an application was created for the service principal. The service principal was created with "Reader" permissions over the current subscription (since no value was provided for the `Scope` parameter).
153+
154+
155+
### Example 3 - Simple AD service principal creation with a specified scope and default role
156+
157+
```
158+
PS C:\> New-AzureRmADServicePrincipal -Scope /subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz/resourceGroups/myResourceGroup
159+
160+
ServicePrincipalNames : {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, http://azure-powershell-05-22-2018-18-23-43}
161+
ApplicationId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
162+
DisplayName : azure-powershell-05-22-2018-18-23-43
163+
Id : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
164+
Type : ServicePrincipal
165+
166+
WARNING: Assigning role 'Contributor' over scope '/subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz/resourceGroups/myResourceGroup' to the new service principal.
167+
```
168+
169+
The above command creates an AD service principal using the default values for parameters not provided. Since the application id was not provided, an application was created for the service principal. The service principal was created with "Contributor" permissions (since no value was provided for the `Role` parameter) over the provided resource group scope.
170+
171+
### Example 4 - Simple AD service principal creation with a specified scope and role
172+
173+
```
174+
PS C:\> New-AzureRmADServicePrincipal -Role Reader -Scope /subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz/resourceGroups/myResourceGroup
175+
176+
ServicePrincipalNames : {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, http://azure-powershell-05-22-2018-18-23-43}
177+
ApplicationId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
178+
DisplayName : azure-powershell-05-22-2018-18-23-43
179+
Id : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
180+
Type : ServicePrincipal
181+
182+
WARNING: Assigning role 'Reader' over scope '/subscriptions/zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz/resourceGroups/myResourceGroup' to the new service principal.
183+
```
184+
185+
The above command creates an AD service principal using the default values for parameters not provided. Since the application id was not provided, an application was created for the service principal. The service principal was created with "Reader" permissions over the provided resource group scope.
186+
187+
### Example 5 - Create a new AD service principal using application id with role assignment
124188

125189
```
126190
PS C:\> New-AzureRmADServicePrincipal -ApplicationId 34a28ad2-dec4-4a41-bc3b-d22ddf90000e
191+
192+
ServicePrincipalNames : {34a28ad2-dec4-4a41-bc3b-d22ddf90000e, http://my-temp-app}
193+
ApplicationId : 34a28ad2-dec4-4a41-bc3b-d22ddf90000e
194+
DisplayName : my-temp-app
195+
Id : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
196+
Type : ServicePrincipal
127197
```
128198

129-
Creates a new AD service principal for the application with application id '34a28ad2-dec4-4a41-bc3b-d22ddf90000e'.
199+
Creates a new AD service principal for the application with application id '34a28ad2-dec4-4a41-bc3b-d22ddf90000e'. Since no values were provided for `Role` or `Scope`, the created service principal does not have any permissions.
130200

131-
### Example 2 - Create a new AD service principal for no appplication
201+
### Example 6 - Create a new AD service principal for no appplication
132202

133203
```
134204
PS C:\> $SecureStringPassword = ConvertTo-SecureString -String "password" -AsPlainText -Force
135-
PS C:\> New-AzureRmADServicePrincipal -DisplayName SPForNoExistingApp -Password $SecureStringPassword
205+
PS C:\> New-AzureRmADServicePrincipal -DisplayName SPForNoApp -Password $SecureStringPassword
206+
207+
ServicePrincipalNames : {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, http://SPForNoApp}
208+
ApplicationId : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
209+
DisplayName : SPForNoApp
210+
Id : yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
211+
Type : ServicePrincipal
136212
```
137213

138-
Creates a new AD service principal without needing an existing application. This will implicitly create an application since one is not provided.
214+
Creates a new AD service principal without needing an existing application. This will implicitly create an application since one is not provided. Since no values were provided for `Role` or `Scope`, the created service principal does not have any permissions.
139215

140-
### Example 3 - Create a new AD service principal using piping
216+
### Example 7 - Create a new AD service principal using piping
141217

142218
```
143219
PS C:\> Get-AzureRmADApplication -ObjectId 3ede3c26-b443-4e0b-9efc-b05e68338dc3 | New-AzureRmADServicePrincipal
@@ -235,7 +311,7 @@ Accept wildcard characters: False
235311
```
236312
237313
### -DisplayName
238-
The friendly name of the service principal.
314+
The friendly name of the service principal. If a display name is not provided, this value will default to 'azure-powershell-MM-dd-yyyy-HH-mm-ss', where the suffix is the time of application creation.
239315
240316
```yaml
241317
Type: String
@@ -318,7 +394,7 @@ Accept wildcard characters: False
318394
```
319395
320396
### -Password
321-
The password to be associated with the service principal.
397+
The password to be associated with the service principal. If a password is not provided, a random GUID will be generated and used as the password.
322398
323399
```yaml
324400
Type: SecureString
@@ -384,7 +460,7 @@ Accept wildcard characters: False
384460
```
385461
386462
### -Role
387-
The role that the service principal has over the scope.
463+
The role that the service principal has over the scope. If a value for `Scope` is provided, but no value is provided for `Role`, then `Role` will default to the 'Contributor' role.
388464

389465
```yaml
390466
Type: String
@@ -399,7 +475,7 @@ Accept wildcard characters: False
399475
```
400476

401477
### -Scope
402-
The scope that the service principal has permissions on.
478+
The scope that the service principal has permissions on. If a value for `Role` is provided, but no value is provided for `Scope`, then `Scope` will default to the current subscription.
403479

404480
```yaml
405481
Type: String

0 commit comments

Comments
 (0)