Skip to content

Commit 75e1d29

Browse files
rakku-msrakku-ms
authored
[Az] Use stable apiversion for azure resource calls in registration script, fix Az token for AzureUSGovernment (#611)
* Use stable apiversion for azure resource calls * Fix Az Token for AzureUSGovernment
1 parent 66034b4 commit 75e1d29

2 files changed

Lines changed: 35 additions & 20 deletions

File tree

‎Identity/AzureStack.Identity.Common.psm1‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -201,26 +201,33 @@ function Export-AzTokenFromCache {
201201
# Resolve target account
202202
#
203203

204-
$targetAccount = $accounts | Where Username -EQ $AccountId
204+
$targetAccountIdentifier = $accounts | Where Username -EQ $AccountId | ForEach { $_.HomeAccountId.Identifier } | Select -Unique
205205

206-
if (-not $targetAccount -or $targetAccount.Count -gt 1) {
206+
if (-not $targetAccountIdentifier -and $data.Account)
207+
{
208+
# Fallback to resolve account identifier from data
209+
$targetAccountIdentifier = ($data.Account | Get-Member -MemberType NoteProperty).Name | ForEach { $data.Account."$_" } | Where Username -EQ $AccountId | Select -ExpandProperty home_account_id -Unique
210+
}
211+
212+
if (-not $targetAccountIdentifier -or $targetAccountIdentifier.Count -gt 1)
213+
{
207214
Write-Error "Unable to resolve acccount for identity '$AccountId'; available accounts: $(ConvertTo-Json $accounts.Username -Compress)"
208215
return
209216
}
210217

211-
Write-Verbose "Target account resolved to: $(ConvertTo-Json $targetAccount -Compress)"
218+
Write-Verbose "Target account resolved to: $targetAccountIdentifier"
212219

213220
#
214221
# Resolve target token(s)
215222
#
216223

217224
$resolvedRefreshToken = $data.RefreshToken."$(Get-Member -InputObject $data.RefreshToken -MemberType NoteProperty |
218-
Where { "$($_.Name)".StartsWith($targetAccount.HomeAccountId.Identifier, [System.StringComparison]::OrdinalIgnoreCase) } |
225+
Where { "$($_.Name)".StartsWith($targetAccountIdentifier, [System.StringComparison]::OrdinalIgnoreCase) } |
219226
Select -ExpandProperty Name)".secret
220227

221228
$resolvedAccessToken = Get-Member -InputObject $data.AccessToken -MemberType NoteProperty |
222229
ForEach { $data.AccessToken."$($_.Name)" } |
223-
Where home_account_id -EQ $targetAccount.HomeAccountId.Identifier |
230+
Where home_account_id -EQ $targetAccountIdentifier |
224231
Where { (-not $_.realm) -or ($_.realm -eq $TenantId) } |
225232
Where target -Like "*$Resource*" |
226233
Sort expires_on -Descending |

‎Registration/RegisterWithAzure.psm1‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ You must also have access to an account / directory that is an owner or contribu
99
1010
#>
1111

12+
[String]$azureResourceApiVersion = "2017-06-01"
13+
1214
function Initialize-AzEnvironment{
1315
[CmdletBinding()]
1416
param(
@@ -165,7 +167,7 @@ function Get-RegistrationDetailsConnected {
165167
$AzureContext = (Get-AzContext)
166168
}
167169
Log-Output "Getting existing registration resource from Azure"
168-
$regResourceAzure = Get-AzResource -ResourceId $azureRegResIden
170+
$regResourceAzure = Get-AzResource -ResourceId $azureRegResIden -ApiVersion $azureResourceApiVersion
169171
Log-Output "Existing registration resource in Azure: $($regResourceAzure | ConvertTo-Json -Depth 2)"
170172
$registrationName = $regResourceAzure.Name
171173
$resourceGroupName = $regResourceAzure.ResourceGroupName
@@ -535,7 +537,7 @@ function Remove-AzsRegistration{
535537
$registrationResource = $null
536538

537539
$registrationResourceId = "/subscriptions/$($AzureContext.Subscription.SubscriptionId)/resourceGroups/$ResourceGroupName/providers/Microsoft.AzureStack/registrations/$registrationName"
538-
$registrationResource = Get-AzResource -ResourceId $registrationResourceId -ErrorAction Ignore
540+
$registrationResource = Get-AzResource -ResourceId $registrationResourceId -ApiVersion $azureResourceApiVersion -ErrorAction Ignore
539541
if ($registrationResource.Properties.cloudId -eq $stampInfo.CloudId)
540542
{
541543
Log-Output "Registration resource found: $($registrationResource.ResourceId)"
@@ -920,7 +922,7 @@ Function UnRegister-AzsEnvironment{
920922
if ($RegistrationName)
921923
{
922924
$registrationResourceId = "/subscriptions/$($AzureContext.Subscription.SubscriptionId)/resourceGroups/$ResourceGroupName/providers/Microsoft.AzureStack/registrations/$registrationName"
923-
$registrationResource = Get-AzResource -ResourceId $registrationResourceId -ErrorAction Ignore
925+
$registrationResource = Get-AzResource -ResourceId $registrationResourceId -ApiVersion $azureResourceApiVersion -ErrorAction Ignore
924926
}
925927
elseif ($CloudId)
926928
{
@@ -940,7 +942,7 @@ Function UnRegister-AzsEnvironment{
940942
try
941943
{
942944
Log-Output "Attempting to retrieve resources using command: 'Get-AzResource -ResourceType microsoft.azurestack/registrations -ResourceGroupName $ResourceGroupName'"
943-
$registrationresources = Get-AzResource -ResourceType microsoft.azurestack/registrations -ResourceGroupName $ResourceGroupName
945+
$registrationresources = Get-AzResource -ResourceType microsoft.azurestack/registrations -ResourceGroupName $ResourceGroupName -ApiVersion $azureResourceApiVersion
944946
}
945947
catch
946948
{
@@ -951,7 +953,7 @@ Function UnRegister-AzsEnvironment{
951953
Log-Output "Found $($registrationResources.Count) registration resources. Finding a matching CloudId may take some time."
952954
foreach ($resource in $registrationResources)
953955
{
954-
$resourceObject = Get-AzResource -ResourceId "/subscriptions/$($AzureContext.Subscription.SubscriptionId)/resourceGroups/$ResourceGroupName/providers/Microsoft.AzureStack/registrations/$($resource.name)"
956+
$resourceObject = Get-AzResource -ResourceId "/subscriptions/$($AzureContext.Subscription.SubscriptionId)/resourceGroups/$ResourceGroupName/providers/Microsoft.AzureStack/registrations/$($resource.name)" -ApiVersion $azureResourceApiVersion
955957
$resourceCloudId = $resourceObject.Properties.CloudId
956958
if ($resourceCloudId -eq $stampInfo.CloudId)
957959
{
@@ -1340,7 +1342,7 @@ function New-RegistrationResource{
13401342
Location = 'Global'
13411343
ResourceName = $RegistrationName
13421344
ResourceType = "Microsoft.AzureStack/registrations"
1343-
ApiVersion = "2017-06-01"
1345+
ApiVersion = $azureResourceApiVersion
13441346
Properties = @{ registrationToken = "$registrationToken" }
13451347
}
13461348

@@ -1492,7 +1494,7 @@ function New-RBACAssignment{
14921494
{
14931495
try
14941496
{
1495-
$registrationResource = Get-AzResource -ResourceId "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.AzureStack/registrations/$RegistrationName"
1497+
$registrationResource = Get-AzResource -ResourceId "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroupName/providers/Microsoft.AzureStack/registrations/$RegistrationName" -ApiVersion $azureResourceApiVersion
14961498

14971499
$RoleAssigned = $false
14981500
$RoleName = "Azure Stack Registration Owner"
@@ -1698,27 +1700,33 @@ function Export-AzRefreshToken
16981700
# Resolve target account
16991701
#
17001702

1701-
$targetAccount = $accounts | Where Username -EQ $AccountId
1703+
$targetAccountIdentifier = $accounts | Where Username -EQ $AccountId | ForEach { $_.HomeAccountId.Identifier } | Select -Unique
1704+
1705+
if (-not $targetAccountIdentifier -and $data.Account)
1706+
{
1707+
# Fallback to resolve account identifier from data
1708+
$targetAccountIdentifier = ($data.Account | Get-Member -MemberType NoteProperty).Name | ForEach { $data.Account."$_" } | Where Username -EQ $AccountId | Select -ExpandProperty home_account_id -Unique
1709+
}
17021710

1703-
if (-not $targetAccount -or $targetAccount.Count -gt 1)
1711+
if (-not $targetAccountIdentifier -or $targetAccountIdentifier.Count -gt 1)
17041712
{
17051713
Write-Error "Unable to resolve acccount for identity '$AccountId'; available accounts: $(ConvertTo-Json $accounts.Username -Compress)"
17061714
return
17071715
}
17081716

1709-
Write-Verbose "Target account resolved to: $(ConvertTo-Json $targetAccount -Compress)"
1717+
Write-Verbose "Target account resolved to: $targetAccountIdentifier"
17101718

17111719
#
17121720
# Resolve target token(s)
17131721
#
17141722

17151723
$resolvedRefreshToken = $data.RefreshToken."$(Get-Member -InputObject $data.RefreshToken -MemberType NoteProperty |
1716-
Where { "$($_.Name)".StartsWith($targetAccount.HomeAccountId.Identifier, [System.StringComparison]::OrdinalIgnoreCase) } |
1717-
Select -ExpandProperty Name)".secret
1724+
Where { "$($_.Name)".StartsWith($targetAccountIdentifier, [System.StringComparison]::OrdinalIgnoreCase) } |
1725+
Select -ExpandProperty Name)".secret
17181726

17191727
if (-not $resolvedRefreshToken)
17201728
{
1721-
Write-Error "Unable to resolve a refresh token for identity '$identityId' with the specified properties..."
1729+
Write-Error "Unable to resolve a refresh token for identity '$AccountId' with the specified properties..."
17221730
return
17231731
}
17241732

@@ -1877,7 +1885,7 @@ function Remove-RegistrationResource{
18771885
try
18781886
{
18791887
## Remove any existing Resource level lock before deleting the resource
1880-
$existingRegistrationResource = Get-AzResource -ResourceId $ResourceId
1888+
$existingRegistrationResource = Get-AzResource -ResourceId $ResourceId -ApiVersion $azureResourceApiVersion
18811889
$resourceName = $existingRegistrationResource.Name
18821890

18831891
$resourceType = 'Microsoft.Azurestack/registrations'
@@ -1888,7 +1896,7 @@ function Remove-RegistrationResource{
18881896
Remove-AzResourceLock -LockId $lock.LockId -Force
18891897
}
18901898

1891-
Remove-AzResource -ResourceId $ResourceId -Force -Verbose
1899+
Remove-AzResource -ResourceId $ResourceId -ApiVersion $azureResourceApiVersion -Force -Verbose
18921900
break
18931901
}
18941902
catch

0 commit comments

Comments
 (0)