Skip to content

Commit 8eaf645

Browse files
CopilotCopilot
authored
Add commands to enable and disable SQL Server logins (#2138)
1 parent cba192e commit 8eaf645

13 files changed

+1392
-3
lines changed

‎.github/instructions/dsc-community-style-guidelines-powershell.instructions.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ function Get-Something
165165

166166
## File Rules
167167

168-
- End files with a blank line
168+
- End files with only one blank line
169169
- Use CR+LF line endings
170170
- Maximum two consecutive newlines
171171

‎CHANGELOG.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
2424
job-level env declaration.
2525
- `Assert-SqlDscLogin`
2626
- Added new public command to validate that a specified SQL Server principal
27-
exists as a login, throwing a terminating error if it doesn't exist.
27+
is a login.
28+
- `Enable-SqlDscLogin`
29+
- Added new public command to enable a SQL Server login.
30+
- `Disable-SqlDscLogin`
31+
- Added new public command to disable a SQL Server login.
32+
- `Test-SqlDscIsLoginEnabled`
33+
- Added new public command to test whether a SQL Server login is enabled.
34+
Throws a terminating error if the specified principal does not exist as a login.
2835
- Supports pipeline input and provides detailed error messages with localization.
2936
- Uses `Test-SqlDscIsLogin` command for login validation following module patterns.
3037
- Added `Get-SqlDscLogin`, `Get-SqlDscRole`, `New-SqlDscLogin`, `New-SqlDscRole`, `Remove-SqlDscRole`, and `Remove-SqlDscLogin` commands for retrieving and managing SQL Server logins and roles with support for refresh, pipeline input, and ShouldProcess.

‎azure-pipelines.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -294,11 +294,13 @@ stages:
294294
'tests/Integration/Commands/Assert-SqlDscLogin.Integration.Tests.ps1'
295295
'tests/Integration/Commands/New-SqlDscLogin.Integration.Tests.ps1'
296296
'tests/Integration/Commands/Get-SqlDscLogin.Integration.Tests.ps1'
297+
'tests/Integration/Commands/Disable-SqlDscLogin.Integration.Tests.ps1'
298+
'tests/Integration/Commands/Enable-SqlDscLogin.Integration.Tests.ps1'
299+
'tests/Integration/Commands/Test-SqlDscIsLoginEnabled.Integration.Tests.ps1'
297300
'tests/Integration/Commands/New-SqlDscRole.Integration.Tests.ps1'
298301
'tests/Integration/Commands/Get-SqlDscRole.Integration.Tests.ps1'
299302
'tests/Integration/Commands/Remove-SqlDscRole.Integration.Tests.ps1'
300303
'tests/Integration/Commands/Remove-SqlDscLogin.Integration.Tests.ps1'
301-
302304
# Group 9
303305
'tests/Integration/Commands/Uninstall-SqlDscServer.Integration.Tests.ps1'
304306
)

‎source/Public/Disable-SqlDscLogin.ps1‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
<#
2+
.SYNOPSIS
3+
Disables a SQL Server login.
4+
5+
.DESCRIPTION
6+
This command disables a SQL Server login in a SQL Server Database Engine instance.
7+
8+
.PARAMETER ServerObject
9+
Specifies current server connection object.
10+
11+
.PARAMETER LoginObject
12+
Specifies a login object to disable.
13+
14+
.PARAMETER Name
15+
Specifies the name of the server login to be disabled.
16+
17+
.PARAMETER Force
18+
Specifies that the login should be disabled without any confirmation.
19+
20+
.PARAMETER Refresh
21+
Specifies that the **ServerObject**'s logins should be refreshed before
22+
trying to disable the login object. This is helpful when logins could have
23+
been modified outside of the **ServerObject**, for example through T-SQL.
24+
But on instances with a large amount of logins it might be better to make
25+
sure the **ServerObject** is recent enough, or pass in **LoginObject**.
26+
27+
.EXAMPLE
28+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
29+
$loginObject = $serverObject | Get-SqlDscLogin -Name 'MyLogin'
30+
$loginObject | Disable-SqlDscLogin
31+
32+
Disables the login named **MyLogin**.
33+
34+
.EXAMPLE
35+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
36+
$serverObject | Disable-SqlDscLogin -Name 'MyLogin'
37+
38+
Disables the login named **MyLogin**.
39+
40+
.EXAMPLE
41+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
42+
$serverObject | Disable-SqlDscLogin -Name 'MyLogin' -Force
43+
44+
Disables the login without confirmation using **-Force**.
45+
46+
.EXAMPLE
47+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
48+
$serverObject | Disable-SqlDscLogin -Name 'MyLogin' -Refresh
49+
50+
Refreshes the server logins collection before disabling **MyLogin**.
51+
.INPUTS
52+
[Microsoft.SqlServer.Management.Smo.Server]
53+
54+
Server object accepted from the pipeline (ServerObject parameter set).
55+
56+
[Microsoft.SqlServer.Management.Smo.Login]
57+
58+
Login object accepted from the pipeline (LoginObject parameter set).
59+
60+
.OUTPUTS
61+
None.
62+
#>
63+
function Disable-SqlDscLogin
64+
{
65+
[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('UseSyntacticallyCorrectExamples', '', Justification = 'Because the rule does not yet support parsing the code when a parameter type is not available. The ScriptAnalyzer rule UseSyntacticallyCorrectExamples will always error in the editor due to https://github.com/indented-automation/Indented.ScriptAnalyzerRules/issues/8.')]
66+
[OutputType()]
67+
[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')]
68+
param
69+
(
70+
[Parameter(ParameterSetName = 'ServerObject', Mandatory = $true, ValueFromPipeline = $true)]
71+
[Microsoft.SqlServer.Management.Smo.Server]
72+
$ServerObject,
73+
74+
[Parameter(ParameterSetName = 'LoginObject', Mandatory = $true, ValueFromPipeline = $true)]
75+
[Microsoft.SqlServer.Management.Smo.Login]
76+
$LoginObject,
77+
78+
[Parameter(ParameterSetName = 'ServerObject', Mandatory = $true)]
79+
[System.String]
80+
$Name,
81+
82+
[Parameter()]
83+
[System.Management.Automation.SwitchParameter]
84+
$Force,
85+
86+
[Parameter(ParameterSetName = 'ServerObject')]
87+
[System.Management.Automation.SwitchParameter]
88+
$Refresh
89+
)
90+
91+
process
92+
{
93+
if ($Force.IsPresent -and -not $Confirm)
94+
{
95+
$ConfirmPreference = 'None'
96+
}
97+
98+
if ($PSCmdlet.ParameterSetName -eq 'ServerObject')
99+
{
100+
$getSqlDscLoginParameters = @{
101+
ServerObject = $ServerObject
102+
Name = $Name
103+
Refresh = $Refresh
104+
ErrorAction = 'Stop'
105+
}
106+
107+
# If this command does not find the login it will throw an exception.
108+
$LoginObject = Get-SqlDscLogin @getSqlDscLoginParameters
109+
}
110+
111+
$verboseDescriptionMessage = $script:localizedData.Login_Disable_ShouldProcessVerboseDescription -f $LoginObject.Name, $LoginObject.Parent.InstanceName
112+
$verboseWarningMessage = $script:localizedData.Login_Disable_ShouldProcessVerboseWarning -f $LoginObject.Name
113+
$captionMessage = $script:localizedData.Login_Disable_ShouldProcessCaption
114+
115+
if ($PSCmdlet.ShouldProcess($verboseDescriptionMessage, $verboseWarningMessage, $captionMessage))
116+
{
117+
$LoginObject.Disable()
118+
}
119+
}
120+
}

‎source/Public/Enable-SqlDscLogin.ps1‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<#
2+
.SYNOPSIS
3+
Enables a SQL Server login.
4+
5+
.DESCRIPTION
6+
This command enables a SQL Server login in a SQL Server Database Engine instance.
7+
8+
.PARAMETER ServerObject
9+
Specifies current server connection object.
10+
11+
.PARAMETER LoginObject
12+
Specifies a login object to enable.
13+
14+
.PARAMETER Name
15+
Specifies the name of the server login to be enabled.
16+
17+
.PARAMETER Force
18+
Specifies that the login should be enabled without any confirmation.
19+
20+
.PARAMETER Refresh
21+
Specifies that the **ServerObject**'s logins should be refreshed before
22+
trying to enable the login object. This is helpful when logins could have
23+
been modified outside of the **ServerObject**, for example through T-SQL.
24+
But on instances with a large amount of logins it might be better to make
25+
sure the **ServerObject** is recent enough, or pass in **LoginObject**.
26+
27+
.EXAMPLE
28+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
29+
$loginObject = $serverObject | Get-SqlDscLogin -Name 'MyLogin'
30+
$loginObject | Enable-SqlDscLogin
31+
32+
Enables the login named **MyLogin**.
33+
34+
.EXAMPLE
35+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
36+
$serverObject | Enable-SqlDscLogin -Name 'MyLogin'
37+
38+
Enables the login named **MyLogin**.
39+
40+
.INPUTS
41+
Microsoft.SqlServer.Management.Smo.Server
42+
When using the ServerObject parameter set, a Server object can be piped in.
43+
44+
Microsoft.SqlServer.Management.Smo.Login
45+
When using the LoginObject parameter set, a Login object can be piped in.
46+
47+
.OUTPUTS
48+
None.
49+
#>
50+
function Enable-SqlDscLogin
51+
{
52+
[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('UseSyntacticallyCorrectExamples', '', Justification = 'Because the rule does not yet support parsing the code when a parameter type is not available. The ScriptAnalyzer rule UseSyntacticallyCorrectExamples will always error in the editor due to https://github.com/indented-automation/Indented.ScriptAnalyzerRules/issues/8.')]
53+
[OutputType()]
54+
[CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')]
55+
param
56+
(
57+
[Parameter(ParameterSetName = 'ServerObject', Mandatory = $true, ValueFromPipeline = $true)]
58+
[Microsoft.SqlServer.Management.Smo.Server]
59+
$ServerObject,
60+
61+
[Parameter(ParameterSetName = 'LoginObject', Mandatory = $true, ValueFromPipeline = $true)]
62+
[Microsoft.SqlServer.Management.Smo.Login]
63+
$LoginObject,
64+
65+
[Parameter(ParameterSetName = 'ServerObject', Mandatory = $true)]
66+
[System.String]
67+
$Name,
68+
69+
[Parameter()]
70+
[System.Management.Automation.SwitchParameter]
71+
$Force,
72+
73+
[Parameter(ParameterSetName = 'ServerObject')]
74+
[System.Management.Automation.SwitchParameter]
75+
$Refresh
76+
)
77+
78+
process
79+
{
80+
if ($Force.IsPresent -and -not $Confirm)
81+
{
82+
$ConfirmPreference = 'None'
83+
}
84+
85+
if ($PSCmdlet.ParameterSetName -eq 'ServerObject')
86+
{
87+
$getSqlDscLoginParameters = @{
88+
ServerObject = $ServerObject
89+
Name = $Name
90+
Refresh = $Refresh
91+
ErrorAction = 'Stop'
92+
}
93+
94+
# If this command does not find the login it will throw an exception.
95+
$LoginObject = Get-SqlDscLogin @getSqlDscLoginParameters
96+
}
97+
98+
$verboseDescriptionMessage = $script:localizedData.Login_Enable_ShouldProcessVerboseDescription -f $LoginObject.Name, $LoginObject.Parent.InstanceName
99+
$verboseWarningMessage = $script:localizedData.Login_Enable_ShouldProcessVerboseWarning -f $LoginObject.Name
100+
$captionMessage = $script:localizedData.Login_Enable_ShouldProcessCaption
101+
102+
if ($PSCmdlet.ShouldProcess($verboseDescriptionMessage, $verboseWarningMessage, $captionMessage))
103+
{
104+
$LoginObject.Enable()
105+
}
106+
}
107+
}

‎source/Public/Test-SqlDscIsLoginEnabled.ps1‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
<#
2+
.SYNOPSIS
3+
Returns whether the server login is enabled or disabled.
4+
5+
.DESCRIPTION
6+
Tests the state of a SQL Server login and returns a Boolean result.
7+
When a Server object is provided, the login is resolved using
8+
Get-SqlDscLogin (optionally refreshing the server logins first).
9+
When a Login object is provided, its current state is evaluated directly.
10+
.PARAMETER ServerObject
11+
Specifies current server connection object.
12+
13+
.PARAMETER LoginObject
14+
Specifies a login object to test.
15+
16+
.PARAMETER Name
17+
Specifies the name of the server login to test.
18+
19+
.PARAMETER Refresh
20+
Specifies that the **ServerObject**'s logins should be refreshed before
21+
trying to test the login object. This is helpful when logins could have
22+
been modified outside of the **ServerObject**, for example through T-SQL.
23+
But on instances with a large amount of logins it might be better to make
24+
sure the **ServerObject** is recent enough, or pass in **LoginObject**.
25+
26+
.INPUTS
27+
[Microsoft.SqlServer.Management.Smo.Server]
28+
29+
Server object accepted from the pipeline.
30+
31+
[Microsoft.SqlServer.Management.Smo.Login]
32+
33+
Login object accepted from the pipeline.
34+
35+
.OUTPUTS
36+
[System.Boolean]
37+
38+
Returns $true if the login is enabled, $false if the login is disabled.
39+
40+
.EXAMPLE
41+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
42+
Test-SqlDscIsLoginEnabled -ServerObject $serverObject -Name 'MyLogin'
43+
44+
Returns $true if the login is enabled, if not $false is returned.
45+
46+
.EXAMPLE
47+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
48+
$loginObject = $serverObject | Get-SqlDscLogin -Name 'MyLogin'
49+
Test-SqlDscIsLoginEnabled -LoginObject $loginObject
50+
51+
Returns $true if the login is enabled, if not $false is returned.
52+
53+
.EXAMPLE
54+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
55+
$result = $serverObject | Test-SqlDscIsLoginEnabled -Name 'MyLogin'
56+
57+
Demonstrates pipeline usage with ServerObject. Returns $true if the login is enabled, if not $false is returned.
58+
59+
.EXAMPLE
60+
$serverObject = Connect-SqlDscDatabaseEngine -InstanceName 'MyInstance'
61+
$loginObject = $serverObject | Get-SqlDscLogin -Name 'MyLogin'
62+
$result = $loginObject | Test-SqlDscIsLoginEnabled
63+
64+
Demonstrates pipeline usage with LoginObject. Returns $true if the login is enabled, if not $false is returned.
65+
#>
66+
function Test-SqlDscIsLoginEnabled
67+
{
68+
[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('UseSyntacticallyCorrectExamples', '', Justification = 'Because the rule does not yet support parsing the code when a parameter type is not available. The ScriptAnalyzer rule UseSyntacticallyCorrectExamples will always error in the editor due to https://github.com/indented-automation/Indented.ScriptAnalyzerRules/issues/8.')]
69+
[CmdletBinding()]
70+
[OutputType([System.Boolean])]
71+
param
72+
(
73+
[Parameter(ParameterSetName = 'ServerObject', Mandatory = $true, ValueFromPipeline = $true)]
74+
[Microsoft.SqlServer.Management.Smo.Server]
75+
$ServerObject,
76+
77+
[Parameter(ParameterSetName = 'LoginObject', Mandatory = $true, ValueFromPipeline = $true)]
78+
[Microsoft.SqlServer.Management.Smo.Login]
79+
$LoginObject,
80+
81+
[Parameter(ParameterSetName = 'ServerObject', Mandatory = $true)]
82+
[System.String]
83+
$Name,
84+
85+
[Parameter(ParameterSetName = 'ServerObject')]
86+
[System.Management.Automation.SwitchParameter]
87+
$Refresh
88+
)
89+
90+
process
91+
{
92+
if ($PSCmdlet.ParameterSetName -eq 'ServerObject')
93+
{
94+
$getSqlDscLoginParameters = @{
95+
ServerObject = $ServerObject
96+
Name = $Name
97+
Refresh = $Refresh
98+
ErrorAction = 'Stop'
99+
}
100+
101+
# If this command does not find the login it will throw an exception.
102+
$loginObjectArray = Get-SqlDscLogin @getSqlDscLoginParameters
103+
104+
# Pick the only object in the array.
105+
$LoginObject = $loginObjectArray
106+
}
107+
108+
$loginEnabled = -not $LoginObject.IsDisabled
109+
110+
return $loginEnabled
111+
}
112+
}

0 commit comments

Comments
 (0)