Skip to content

Commit 56a6648

Browse files
issacnitinmsftissacnitinmsft
authored
Port to m161: AzureResourceGroupDeployment: Improve docs/error logs to surface SPN details to user (#11909)
* AzureResourceGroupDeployment: Improve docs/error logs to surface SPN details to user (#11860) * Init * Adding Graph calls to retrieve and filter by Service Principal * Refactoring * Removing calls to get roleAssignments * Removing debug logs * Improving error message * Removing unnecessary imports * Incrementing task version * Removing code in common folder * Adding functionality for AzureResourceGroupDeploymentV2 * Revert "Adding functionality for AzureResourceGroupDeploymentV2" This reverts commit 2400c26. * Review comments * Updating L0 tests * Updating L0 Tests * Review comments * Using tl.debug() * Fixing L0 test * Bug fix * Updating task version * Updating Graph URL in L0 tests * Debugging L0 failure * Debugging L0 * Removing debug stuff * Increasing test timeout * Test timeout back to 30 seconds * Removing ARGV2 version to see if test runs fine * Revert * Revert2 * Revert "Revert2" This reverts commit 33b894b. * Revert "Revert" This reverts commit a105046. * Revert "Removing ARGV2 version to see if test runs fine" This reverts commit 12c4e3f. * Updating task version * Adding Azure-Graph mock for L0 * Adding necessary parameters to azure-graph mock * Review comments * Adding _spnName as cache parameter
1 parent 7779763 commit 56a6648

File tree

21 files changed

+204
-6
lines changed

21 files changed

+204
-6
lines changed

‎Tasks/AzureResourceGroupDeploymentV2/Strings/resources.resjson/en-US/resources.resjson‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,5 +192,7 @@
192192
"loc.messages.ExpiredServicePrincipal": "Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.",
193193
"loc.messages.DeploymentGroupConfigurationNotSucceeded": "Deployment group configuration did not succeed on one or more Virtual Machine(s): %s",
194194
"loc.messages.DeploymentGroupConfigurationFailedOnVM": "Failure for Virtual Machine '%s': %s",
195+
"loc.messages.ServicePrincipalRoleAssignmentDetails": "Please make sure the Service Principal with name %s is assigned the right roles for the Resource Group %s. Follow the link for more details: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal",
196+
"loc.messages.ServicePrincipalFetchFailed": "Error while fetching Service Principal details: %s",
195197
"loc.messages.FindMoreDeploymentDetailsAzurePortal": "Task successfully created an Azure Resource Manager deployment, but the deployment failed. Please see more detailed Azure resource manager deployment logs at: (Please Copy-Paste the link) %s"
196198
}

‎Tasks/AzureResourceGroupDeploymentV2/Tests/EnablePrereq.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
2222
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
2323
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
2424
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
25+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
2526
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
2627
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
2728

@@ -47,4 +48,5 @@ tr.registerMock('azure-arm-rest-v2/webRequestUtility', require('./mock_node_modu
4748
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
4849
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
4950
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
51+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
5052
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/Tests/VMOperations.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,12 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
1515
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
1616
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
1717
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
18+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
1819
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
1920
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
2021
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
2122

2223
tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-task-lib/mock-toolrunner'));
2324
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
25+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
2426
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/Tests/addVSTSExtension.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
2727
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
2828
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
2929
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
30+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";;
3031
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
3132
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
3233
process.env["ENDPOINT_URL_PatEndpoint"] = "https://testking123.visualstudio.com";
@@ -55,6 +56,7 @@ tr.registerMock('azure-arm-rest-v2/webRequestUtility', require('./mock_node_modu
5556
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
5657
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
5758
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
59+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
5860

5961

6062
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/Tests/createOrUpdate.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
2323
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
2424
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
2525
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
26+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
2627
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
2728
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
2829
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
@@ -49,4 +50,5 @@ tr.setAnswers(a);
4950

5051
tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-task-lib/mock-toolrunner'));
5152
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
53+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
5254
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/Tests/deleteResourceGroup.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,12 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
1515
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
1616
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
1717
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
18+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
1819
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
1920
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
2021
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
2122

2223
tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-task-lib/mock-toolrunner'));
2324
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
25+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
2426
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/Tests/deleteVSTSExtension.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
1616
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
1717
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
1818
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
19+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
1920
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
2021
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
2122
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
@@ -25,4 +26,5 @@ tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-
2526
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
2627
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
2728
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
29+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
2830
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/Tests/mock_node_modules/azure-graph/azure-graph.js‎

Lines changed: 42 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Tasks/AzureResourceGroupDeploymentV2/Tests/selectResourceGroup.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
1717
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
1818
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
1919
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
20+
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
2021
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
2122
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
2223
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
@@ -25,4 +26,5 @@ tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-
2526
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
2627
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
2728
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
29+
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
2830
tr.run();

‎Tasks/AzureResourceGroupDeploymentV2/models/DeployAzureRG.ts‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ export class AzureRGTaskParameters {
6666
public deploymentName: string;
6767
public deploymentMode: string;
6868
public credentials: msRestAzure.ApplicationTokenCredentials;
69+
public graphCredentials: msRestAzure.ApplicationTokenCredentials;
6970
public deploymentGroupProjectName = "";
7071
public tokenCredentials: TokenCredentials;
7172
public deploymentOutputs: string;
@@ -95,6 +96,18 @@ export class AzureRGTaskParameters {
9596
throw (msg);
9697
}
9798
}
99+
100+
private _getAzureADGraphCredentials(connectedService: string): msRestAzure.ApplicationTokenCredentials {
101+
var servicePrincipalId: string = tl.getEndpointAuthorizationParameter(connectedService, "serviceprincipalid", false);
102+
var servicePrincipalKey: string = tl.getEndpointAuthorizationParameter(connectedService, "serviceprincipalkey", false);
103+
var tenantId: string = tl.getEndpointAuthorizationParameter(connectedService, "tenantid", false);
104+
var envAuthorityUrl: string = tl.getEndpointDataParameter(connectedService, 'environmentauthorityurl', false);
105+
envAuthorityUrl = (envAuthorityUrl != null) ? envAuthorityUrl : "https://login.windows.net/";
106+
var activeDirectoryResourceId: string = tl.getEndpointDataParameter(connectedService, 'graphUrl', false);
107+
activeDirectoryResourceId = (activeDirectoryResourceId != null) ? activeDirectoryResourceId : "https://graph.windows.net/";
108+
var credentials = new msRestAzure.ApplicationTokenCredentials(servicePrincipalId, tenantId, servicePrincipalKey, activeDirectoryResourceId, envAuthorityUrl, activeDirectoryResourceId, false);
109+
return credentials;
110+
}
98111

99112
private async getARMCredentials(connectedService: string): Promise<msRestAzure.ApplicationTokenCredentials> {
100113
var azureEndpoint = await new AzureRMEndpoint(connectedService).getEndpoint();
@@ -140,6 +153,7 @@ export class AzureRGTaskParameters {
140153
this.deploymentName = tl.getInput("deploymentName");
141154
this.deploymentMode = tl.getInput("deploymentMode");
142155
this.credentials = await this.getARMCredentials(this.connectedService);
156+
this.graphCredentials = this._getAzureADGraphCredentials(this.connectedService);
143157
this.deploymentGroupProjectName = tl.getInput("project");
144158
this.deploymentOutputs = tl.getInput("deploymentOutputs");
145159
this.addSpnToEnvironment = tl.getBoolInput("addSpnToEnvironment", false);

0 commit comments

Comments
 (0)