Skip to content

Commit 1110653

Browse files
johljujohlju
authored
SqlPermission: Added integration tests for server role permissions (#2362)
1 parent 0037064 commit 1110653

File tree

4 files changed

+426
-5
lines changed

4 files changed

+426
-5
lines changed

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
### Added
99

10+
- `SqlPermission`
11+
- Added integration tests for server role permissions to complement the
12+
existing login permission tests.
1013
- `New-SqlDscDatabase`
1114
- Added comprehensive set of settable database properties that were previously
1215
only available in `Set-SqlDscDatabaseProperty`
@@ -27,6 +30,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
2730
`Revoke-SqlDscServerPermission`, and `Get-SqlDscServerPermission`)
2831
instead of the deprecated `Set-SqlDscServerPermission` command
2932
([issue #2159](https://github.com/dsccommunity/SqlServerDsc/issues/2159)).
33+
- Updated documentation to clarify that the resource supports both logins
34+
and server roles as principals.
35+
- Added a note in documentation clarifying that if a name exists as both
36+
a login and a server role, the login will take precedence.
3037
- Updated comment-based help `.INPUTS` and `.OUTPUTS` sections across all public
3138
commands and private functions to comply with DSC community style guidelines
3239
([issue #2103](https://github.com/dsccommunity/SqlServerDsc/issues/2103)).

‎source/Classes/020.SqlPermission.ps1‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,24 @@
11
<#
22
.SYNOPSIS
33
The `SqlPermission` DSC resource is used to grant, deny or revoke
4-
server permissions for a login.
4+
server permissions for a login or server role.
55
66
.DESCRIPTION
77
The `SqlPermission` DSC resource is used to grant, deny or revoke
8-
Server permissions for a login. For more information about permissions,
9-
please read the article [Permissions (Database Engine)](https://docs.microsoft.com/en-us/sql/relational-databases/security/permissions-database-engine).
8+
server permissions for a login or server role. For more information about
9+
permissions, please read the article [Permissions (Database Engine)](https://docs.microsoft.com/en-us/sql/relational-databases/security/permissions-database-engine).
1010
1111
> [!CAUTION]
1212
> When revoking permission with PermissionState 'GrantWithGrant', both the
1313
> grantee and _all the other users the grantee has granted the same permission_
1414
> _to_, will also get their permission revoked.
1515
16+
> [!NOTE]
17+
> The parameter **Name** can specify either a login or a server role. If
18+
> a name exists as both a login and a server role, the login will take
19+
> precedence. To avoid ambiguity, use unique names for logins and server
20+
> roles.
21+
1622
## Requirements
1723
1824
* Target machine must be running Windows Server 2012 or later.
@@ -61,7 +67,8 @@
6167
```
6268
6369
.PARAMETER Name
64-
The name of the user that should be granted or denied the permission.
70+
The name of the principal (login or server role) that should be granted
71+
or denied the permission.
6572
6673
.PARAMETER Permission
6774
An array of server permissions to enforce. Any permission that is not
@@ -360,7 +367,13 @@ class SqlPermission : SqlResourceBase
360367

361368
# This will test whether the principal exist.
362369
$isLogin = Test-SqlDscIsLogin @testSqlDscIsPrincipalParameters
363-
$isRole = Test-SqlDscIsRole @testSqlDscIsPrincipalParameters
370+
$isRole = $false
371+
372+
# Only test for role if not already found as a login.
373+
if (-not $isLogin)
374+
{
375+
$isRole = Test-SqlDscIsRole @testSqlDscIsPrincipalParameters
376+
}
364377

365378
if (-not $isLogin -and -not $isRole)
366379
{

‎tests/Integration/Resources/DSC_SqlPermission.Integration.Tests.ps1‎

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,253 @@ Describe "$($script:dscResourceName)_Integration" -Tag @('Integration_SQL2016',
318318
These tests assumes that only permission left for test user 'User1' is
319319
a grant for permission 'ConnectSql'.
320320
#>
321+
322+
Context ('When using configuration <_>') -ForEach @(
323+
"$($script:dscResourceName)_Role_Grant_Config"
324+
) {
325+
BeforeAll {
326+
$configurationName = $_
327+
}
328+
329+
AfterEach {
330+
Wait-ForIdleLcm
331+
}
332+
333+
It 'Should compile and apply the MOF without throwing' {
334+
$configurationParameters = @{
335+
OutputPath = $TestDrive
336+
# The variable $ConfigurationData was dot-sourced above.
337+
ConfigurationData = $ConfigurationData
338+
}
339+
340+
$null = & $configurationName @configurationParameters
341+
342+
$startDscConfigurationParameters = @{
343+
Path = $TestDrive
344+
ComputerName = 'localhost'
345+
Wait = $true
346+
Verbose = $true
347+
Force = $true
348+
ErrorAction = 'Stop'
349+
}
350+
351+
$null = Start-DscConfiguration @startDscConfigurationParameters
352+
}
353+
354+
It 'Should be able to call Get-DscConfiguration without throwing' {
355+
$script:currentConfiguration = Get-DscConfiguration -Verbose -ErrorAction 'Stop'
356+
}
357+
358+
It 'Should have set the resource and all the parameters should match' {
359+
$resourceCurrentState = $script:currentConfiguration | Where-Object -FilterScript {
360+
$_.ConfigurationName -eq $configurationName `
361+
-and $_.ResourceId -eq $resourceId
362+
}
363+
364+
$resourceCurrentState.ServerName | Should -Be $ConfigurationData.AllNodes.ServerName
365+
$resourceCurrentState.InstanceName | Should -Be $ConfigurationData.AllNodes.InstanceName
366+
$resourceCurrentState.Name | Should -Be $ConfigurationData.AllNodes.Role1_Name
367+
$resourceCurrentState.Permission | Should -HaveCount 3
368+
369+
$grantState = $resourceCurrentState.Permission.Where({ $_.State -eq 'Grant' })
370+
371+
$grantState.State | Should -Be 'Grant'
372+
$grantState.Permission | Should -HaveCount 2
373+
$grantState.Permission | Should -Contain 'ViewServerState'
374+
$grantState.Permission | Should -Contain 'AlterAnyEndpoint'
375+
}
376+
377+
It 'Should return $true when Test-DscConfiguration is run' {
378+
Test-DscConfiguration -Verbose -ErrorAction 'Stop' | Should -Be 'True'
379+
}
380+
}
381+
382+
Context ('When using configuration <_>') -ForEach @(
383+
"$($script:dscResourceName)_Role_RemoveGrant_Config"
384+
) {
385+
BeforeAll {
386+
$configurationName = $_
387+
}
388+
389+
AfterEach {
390+
Wait-ForIdleLcm
391+
}
392+
393+
It 'Should compile and apply the MOF without throwing' {
394+
$configurationParameters = @{
395+
OutputPath = $TestDrive
396+
# The variable $ConfigurationData was dot-sourced above.
397+
ConfigurationData = $ConfigurationData
398+
}
399+
400+
$null = & $configurationName @configurationParameters
401+
402+
$startDscConfigurationParameters = @{
403+
Path = $TestDrive
404+
ComputerName = 'localhost'
405+
Wait = $true
406+
Verbose = $true
407+
Force = $true
408+
ErrorAction = 'Stop'
409+
}
410+
411+
$null = Start-DscConfiguration @startDscConfigurationParameters
412+
}
413+
414+
It 'Should be able to call Get-DscConfiguration without throwing' {
415+
$script:currentConfiguration = Get-DscConfiguration -Verbose -ErrorAction 'Stop'
416+
}
417+
418+
It 'Should have set the resource and all the parameters should match' {
419+
$resourceCurrentState = $script:currentConfiguration | Where-Object -FilterScript {
420+
$_.ConfigurationName -eq $configurationName `
421+
-and $_.ResourceId -eq $resourceId
422+
}
423+
424+
$resourceCurrentState.ServerName | Should -Be $ConfigurationData.AllNodes.ServerName
425+
$resourceCurrentState.InstanceName | Should -Be $ConfigurationData.AllNodes.InstanceName
426+
$resourceCurrentState.Name | Should -Be $ConfigurationData.AllNodes.Role1_Name
427+
$resourceCurrentState.Permission | Should -HaveCount 3
428+
429+
$grantState = $resourceCurrentState.Permission.Where({ $_.State -eq 'Grant' })
430+
431+
$grantState.State | Should -Be 'Grant'
432+
$grantState.Permission | Should -BeNullOrEmpty
433+
}
434+
435+
It 'Should return $true when Test-DscConfiguration is run' {
436+
Test-DscConfiguration -Verbose -ErrorAction 'Stop' | Should -Be 'True'
437+
}
438+
}
439+
440+
Context ('When using configuration <_>') -ForEach @(
441+
"$($script:dscResourceName)_Role_Deny_Config"
442+
) {
443+
BeforeAll {
444+
$configurationName = $_
445+
}
446+
447+
AfterEach {
448+
Wait-ForIdleLcm
449+
}
450+
451+
It 'Should compile and apply the MOF without throwing' {
452+
$configurationParameters = @{
453+
OutputPath = $TestDrive
454+
# The variable $ConfigurationData was dot-sourced above.
455+
ConfigurationData = $ConfigurationData
456+
}
457+
458+
$null = & $configurationName @configurationParameters
459+
460+
$startDscConfigurationParameters = @{
461+
Path = $TestDrive
462+
ComputerName = 'localhost'
463+
Wait = $true
464+
Verbose = $true
465+
Force = $true
466+
ErrorAction = 'Stop'
467+
}
468+
469+
$null = Start-DscConfiguration @startDscConfigurationParameters
470+
}
471+
472+
It 'Should be able to call Get-DscConfiguration without throwing' {
473+
$script:currentConfiguration = Get-DscConfiguration -Verbose -ErrorAction 'Stop'
474+
}
475+
476+
It 'Should have set the resource and all the parameters should match' {
477+
$resourceCurrentState = $script:currentConfiguration | Where-Object -FilterScript {
478+
$_.ConfigurationName -eq $configurationName `
479+
-and $_.ResourceId -eq $resourceId
480+
}
481+
482+
$resourceCurrentState.ServerName | Should -Be $ConfigurationData.AllNodes.ServerName
483+
$resourceCurrentState.InstanceName | Should -Be $ConfigurationData.AllNodes.InstanceName
484+
$resourceCurrentState.Name | Should -Be $ConfigurationData.AllNodes.Role1_Name
485+
$resourceCurrentState.Permission | Should -HaveCount 3
486+
487+
$grantState = $resourceCurrentState.Permission.Where({ $_.State -eq 'Grant' })
488+
489+
$grantState.State | Should -Be 'Grant'
490+
$grantState.Permission | Should -BeNullOrEmpty
491+
492+
$denyState = $resourceCurrentState.Permission.Where({ $_.State -eq 'Deny' })
493+
494+
$denyState.State | Should -Be 'Deny'
495+
$denyState.Permission | Should -HaveCount 2
496+
$denyState.Permission | Should -Contain 'ViewServerState'
497+
$denyState.Permission | Should -Contain 'AlterAnyEndpoint'
498+
}
499+
500+
It 'Should return $true when Test-DscConfiguration is run' {
501+
Test-DscConfiguration -Verbose -ErrorAction 'Stop' | Should -Be 'True'
502+
}
503+
}
504+
505+
Context ('When using configuration <_>') -ForEach @(
506+
"$($script:dscResourceName)_Role_RemoveDeny_Config"
507+
) {
508+
BeforeAll {
509+
$configurationName = $_
510+
}
511+
512+
AfterEach {
513+
Wait-ForIdleLcm
514+
}
515+
516+
It 'Should compile and apply the MOF without throwing' {
517+
$configurationParameters = @{
518+
OutputPath = $TestDrive
519+
# The variable $ConfigurationData was dot-sourced above.
520+
ConfigurationData = $ConfigurationData
521+
}
522+
523+
$null = & $configurationName @configurationParameters
524+
525+
$startDscConfigurationParameters = @{
526+
Path = $TestDrive
527+
ComputerName = 'localhost'
528+
Wait = $true
529+
Verbose = $true
530+
Force = $true
531+
ErrorAction = 'Stop'
532+
}
533+
534+
$null = Start-DscConfiguration @startDscConfigurationParameters
535+
}
536+
537+
It 'Should be able to call Get-DscConfiguration without throwing' {
538+
$script:currentConfiguration = Get-DscConfiguration -Verbose -ErrorAction 'Stop'
539+
}
540+
541+
It 'Should have set the resource and all the parameters should match' {
542+
$resourceCurrentState = $script:currentConfiguration | Where-Object -FilterScript {
543+
$_.ConfigurationName -eq $configurationName `
544+
-and $_.ResourceId -eq $resourceId
545+
}
546+
547+
$resourceCurrentState.ServerName | Should -Be $ConfigurationData.AllNodes.ServerName
548+
$resourceCurrentState.InstanceName | Should -Be $ConfigurationData.AllNodes.InstanceName
549+
$resourceCurrentState.Name | Should -Be $ConfigurationData.AllNodes.Role1_Name
550+
$resourceCurrentState.Permission | Should -HaveCount 3
551+
552+
$grantState = $resourceCurrentState.Permission.Where({ $_.State -eq 'Grant' })
553+
554+
$grantState.State | Should -Be 'Grant'
555+
$grantState.Permission | Should -BeNullOrEmpty
556+
557+
$denyState = $resourceCurrentState.Permission.Where({ $_.State -eq 'Deny' })
558+
559+
$denyState.State | Should -Be 'Deny'
560+
$denyState.Permission | Should -BeNullOrEmpty
561+
}
562+
563+
It 'Should return $true when Test-DscConfiguration is run' {
564+
Test-DscConfiguration -Verbose -ErrorAction 'Stop' | Should -Be 'True'
565+
}
566+
}
567+
321568
Context 'When using Invoke-DscResource' {
322569
BeforeAll {
323570
<#

0 commit comments

Comments
 (0)