Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Users/nijoy/revert spn bug #12015

Merged
merged 7 commits into from
Jan 2, 2020
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -191,8 +191,5 @@
"loc.messages.LogDeploymentName": "Deployment name is %s",
"loc.messages.ExpiredServicePrincipal": "Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.",
"loc.messages.DeploymentGroupConfigurationNotSucceeded": "Deployment group configuration did not succeed on one or more Virtual Machine(s): %s",
"loc.messages.DeploymentGroupConfigurationFailedOnVM": "Failure for Virtual Machine '%s': %s",
"loc.messages.ServicePrincipalRoleAssignmentDetails": "Please make sure the Service Principal with name %s is assigned the right roles for the Resource Group %s. Follow the link for more details: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal",
"loc.messages.ServicePrincipalFetchFailed": "Error while fetching Service Principal details: %s",
"loc.messages.FindMoreDeploymentDetailsAzurePortal": "Task successfully created an Azure Resource Manager deployment, but the deployment failed. Please see more detailed Azure resource manager deployment logs at: (Please Copy-Paste the link) %s"
"loc.messages.DeploymentGroupConfigurationFailedOnVM": "Failure for Virtual Machine '%s': %s"
}
2 changes: 0 additions & 2 deletions Tasks/AzureResourceGroupDeploymentV2/Tests/EnablePrereq.ts
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";

Expand All @@ -48,5 +47,4 @@ tr.registerMock('azure-arm-rest-v2/webRequestUtility', require('./mock_node_modu
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
tr.run();
2 changes: 0 additions & 2 deletions Tasks/AzureResourceGroupDeploymentV2/Tests/VMOperations.ts
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,10 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";

tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-task-lib/mock-toolrunner'));
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
tr.run();
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";;
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
process.env["ENDPOINT_URL_PatEndpoint"] = "https://testking123.visualstudio.com";
Expand Down Expand Up @@ -56,7 +55,6 @@ tr.registerMock('azure-arm-rest-v2/webRequestUtility', require('./mock_node_modu
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));


tr.run();
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
Expand All @@ -50,5 +49,4 @@ tr.setAnswers(a);

tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-task-lib/mock-toolrunner'));
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
tr.run();
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,10 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";

tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-task-lib/mock-toolrunner'));
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
tr.run();
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
Expand All @@ -26,5 +25,4 @@ tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
tr.run();

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_SERVICEPRINCIPALKEY"] = "key";
process.env["ENDPOINT_AUTH_PARAMETER_AzureRM_TENANTID"] = "tenant";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONID"] = "sId";
process.env["ENDPOINT_DATA_AzureRM_SUBSCRIPTIONNAME"] = "sName";
process.env["ENDPOINT_DATA_AzureRM_GRAPHURL"] = "https://graph.windows.net/";
process.env["ENDPOINT_URL_AzureRM"] = "https://management.azure.com/";
process.env["ENDPOINT_DATA_AzureRM_ENVIRONMENTAUTHORITYURL"] = "https://login.windows.net/";
process.env["ENDPOINT_DATA_AzureRM_ACTIVEDIRECTORYSERVICEENDPOINTRESOURCEID"] = "https://management.azure.com";
Expand All @@ -26,5 +25,4 @@ tr.registerMock('azure-pipelines-task-lib/toolrunner', require('azure-pipelines-
tr.registerMock('azure-arm-rest-v2/azure-arm-resource', require('./mock_node_modules/azure-arm-resource'));
tr.registerMock('azure-arm-rest-v2/azure-arm-compute', require('./mock_node_modules/azure-arm-compute'));
tr.registerMock('azure-arm-rest-v2/azure-arm-network', require('./mock_node_modules/azure-arm-network'));
tr.registerMock('azure-arm-rest-v2/azure-graph', require('./mock_node_modules/azure-graph/azure-graph'));
tr.run();
14 changes: 0 additions & 14 deletions Tasks/AzureResourceGroupDeploymentV2/models/DeployAzureRG.ts
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,6 @@ export class AzureRGTaskParameters {
public deploymentName: string;
public deploymentMode: string;
public credentials: msRestAzure.ApplicationTokenCredentials;
public graphCredentials: msRestAzure.ApplicationTokenCredentials;
public deploymentGroupProjectName = "";
public tokenCredentials: TokenCredentials;
public deploymentOutputs: string;
Expand Down Expand Up @@ -96,18 +95,6 @@ export class AzureRGTaskParameters {
throw (msg);
}
}

private _getAzureADGraphCredentials(connectedService: string): msRestAzure.ApplicationTokenCredentials {
var servicePrincipalId: string = tl.getEndpointAuthorizationParameter(connectedService, "serviceprincipalid", false);
var servicePrincipalKey: string = tl.getEndpointAuthorizationParameter(connectedService, "serviceprincipalkey", false);
var tenantId: string = tl.getEndpointAuthorizationParameter(connectedService, "tenantid", false);
var envAuthorityUrl: string = tl.getEndpointDataParameter(connectedService, 'environmentauthorityurl', false);
envAuthorityUrl = (envAuthorityUrl != null) ? envAuthorityUrl : "https://login.windows.net/";
var activeDirectoryResourceId: string = tl.getEndpointDataParameter(connectedService, 'graphUrl', false);
activeDirectoryResourceId = (activeDirectoryResourceId != null) ? activeDirectoryResourceId : "https://graph.windows.net/";
var credentials = new msRestAzure.ApplicationTokenCredentials(servicePrincipalId, tenantId, servicePrincipalKey, activeDirectoryResourceId, envAuthorityUrl, activeDirectoryResourceId, false);
return credentials;
}

private async getARMCredentials(connectedService: string): Promise<msRestAzure.ApplicationTokenCredentials> {
var azureEndpoint = await new AzureRMEndpoint(connectedService).getEndpoint();
Expand Down Expand Up @@ -153,7 +140,6 @@ export class AzureRGTaskParameters {
this.deploymentName = tl.getInput("deploymentName");
this.deploymentMode = tl.getInput("deploymentMode");
this.credentials = await this.getARMCredentials(this.connectedService);
this.graphCredentials = this._getAzureADGraphCredentials(this.connectedService);
this.deploymentGroupProjectName = tl.getInput("project");
this.deploymentOutputs = tl.getInput("deploymentOutputs");
this.addSpnToEnvironment = tl.getBoolInput("addSpnToEnvironment", false);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import path = require("path");
import tl = require("azure-pipelines-task-lib/task");
import fs = require("fs");
import util = require("util");
import azureGraph = require("azure-arm-rest-v2/azure-graph");

import env = require("./Environment");
import deployAzureRG = require("../models/DeployAzureRG");
import armResource = require("azure-arm-rest-v2/azure-arm-resource");
Expand Down Expand Up @@ -119,14 +119,12 @@ export class ResourceGroup {
private winRMExtensionHelper: winRM.WinRMExtensionHelper;
private deploymentGroupExtensionHelper: dgExtensionHelper.DeploymentGroupExtensionHelper;
private environmentHelper: env.EnvironmentHelper;
private _spnName: string;

constructor(taskParameters: deployAzureRG.AzureRGTaskParameters) {
this.taskParameters = taskParameters;
this.winRMExtensionHelper = new winRM.WinRMExtensionHelper(this.taskParameters);
this.deploymentGroupExtensionHelper = new dgExtensionHelper.DeploymentGroupExtensionHelper(this.taskParameters);
this.environmentHelper = new env.EnvironmentHelper(this.taskParameters);
this._spnName = null;
}

public async createOrUpdateResourceGroup(): Promise<void> {
Expand Down Expand Up @@ -516,7 +514,6 @@ export class ResourceGroup {
}
if (result.error) {
this.writeDeploymentErrors(result.error);
tl.error(tl.loc("FindMoreDeploymentDetailsAzurePortal", this.getAzurePortalDeploymentURL()));
return reject(tl.loc("CreateTemplateDeploymentFailed"));
} else {
console.log(tl.loc("ValidDeployment"));
Expand All @@ -527,10 +524,6 @@ export class ResourceGroup {
}

private async performAzureDeployment(armClient: armResource.ResourceManagementClient, deployment: Deployment, retryCount = 0): Promise<void> {
if(!this._spnName) {
this._spnName = await this.getServicePrincipalName();
}

if (deployment.properties["mode"] === "Validation") {
return this.validateDeployment(armClient, deployment);
} else {
Expand All @@ -544,8 +537,6 @@ export class ResourceGroup {
return this.waitAndPerformAzureDeployment(armClient, deployment, retryCount);
}
this.writeDeploymentErrors(error);
this.printServicePrincipalRoleAssignmentError(error);
this.checkAndPrintPortalDeploymentURL(error);
return reject(tl.loc("CreateTemplateDeploymentFailed"));
}
if (result && result["properties"] && result["properties"]["outputs"] && utils.isNonEmpty(this.taskParameters.deploymentOutputs)) {
Expand All @@ -560,18 +551,6 @@ export class ResourceGroup {
}
}

private printServicePrincipalRoleAssignmentError(error: any) {
if(!!error && error.statusCode == 403) {
tl.error(tl.loc("ServicePrincipalRoleAssignmentDetails", this._spnName, this.taskParameters.resourceGroupName));
}
}

protected checkAndPrintPortalDeploymentURL(error: any) {
if(!!error && (error.statusCode < 400 || error.statusCode >= 500)) {
tl.error(tl.loc("FindMoreDeploymentDetailsAzurePortal", this.getAzurePortalDeploymentURL()));
}
}

private async waitAndPerformAzureDeployment(armClient: armResource.ResourceManagementClient, deployment: Deployment, retryCount): Promise<void> {
await sleepFor(3);
return this.performAzureDeployment(armClient, deployment, retryCount - 1);
Expand All @@ -590,29 +569,6 @@ export class ResourceGroup {
await this.performAzureDeployment(armClient, deployment, 3);
}

protected async getServicePrincipalName(): Promise<string> {
try {
var graphClient: azureGraph.GraphManagementClient = new azureGraph.GraphManagementClient(this.taskParameters.graphCredentials);
var servicePrincipalObject = await graphClient.servicePrincipals.GetServicePrincipal(null);
return !!servicePrincipalObject ? servicePrincipalObject.appDisplayName : "";
} catch (error) {
tl.debug(tl.loc("ServicePrincipalFetchFailed", error));
return "";
}
}

private getAzurePortalDeploymentURL() {
try {
let portalUrl = this.taskParameters.endpointPortalUrl ? this.taskParameters.endpointPortalUrl : "https://portal.azure.com";
portalUrl += "/#blade/HubsExtension/DeploymentDetailsBlade/overview/id/";
let subscriptionSpecificURL = "/subscriptions/" + this.taskParameters.subscriptionId + "/resourceGroups/" + this.taskParameters.resourceGroupName + "/providers/Microsoft.Resources/deployments/" + this.taskParameters.deploymentName;
return portalUrl + subscriptionSpecificURL.replace(/\//g, '%2F');
} catch (error) {
tl.error(error);
return error;
}
}

private escapeBlockCharacters(str: string): string {
return str.replace(/[\[]/g, '$&[]');
}
Expand Down
7 changes: 2 additions & 5 deletions Tasks/AzureResourceGroupDeploymentV2/task.json
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"version": {
"Major": 2,
"Minor": 163,
"Patch": 0
"Patch": 2
},
"demands": [],
"minimumAgentVersion": "2.119.1",
Expand Down Expand Up @@ -480,9 +480,6 @@
"LogDeploymentName": "Deployment name is %s",
"ExpiredServicePrincipal": "Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.",
"DeploymentGroupConfigurationNotSucceeded": "Deployment group configuration did not succeed on one or more Virtual Machine(s): %s",
"DeploymentGroupConfigurationFailedOnVM": "Failure for Virtual Machine '%s': %s",
"ServicePrincipalRoleAssignmentDetails": "Please make sure the Service Principal with name %s is assigned the right roles for the Resource Group %s. Follow the link for more details: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal",
"ServicePrincipalFetchFailed": "Error while fetching Service Principal details: %s",
"FindMoreDeploymentDetailsAzurePortal": "Task successfully created an Azure Resource Manager deployment, but the deployment failed. Please see more detailed Azure resource manager deployment logs at: (Please Copy-Paste the link) %s"
"DeploymentGroupConfigurationFailedOnVM": "Failure for Virtual Machine '%s': %s"
}
}
7 changes: 2 additions & 5 deletions Tasks/AzureResourceGroupDeploymentV2/task.loc.json
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
"version": {
"Major": 2,
"Minor": 163,
"Patch": 0
"Patch": 2
},
"demands": [],
"minimumAgentVersion": "2.119.1",
Expand Down Expand Up @@ -480,9 +480,6 @@
"LogDeploymentName": "ms-resource:loc.messages.LogDeploymentName",
"ExpiredServicePrincipal": "ms-resource:loc.messages.ExpiredServicePrincipal",
"DeploymentGroupConfigurationNotSucceeded": "ms-resource:loc.messages.DeploymentGroupConfigurationNotSucceeded",
"DeploymentGroupConfigurationFailedOnVM": "ms-resource:loc.messages.DeploymentGroupConfigurationFailedOnVM",
"ServicePrincipalRoleAssignmentDetails": "ms-resource:loc.messages.ServicePrincipalRoleAssignmentDetails",
"ServicePrincipalFetchFailed": "ms-resource:loc.messages.ServicePrincipalFetchFailed",
"FindMoreDeploymentDetailsAzurePortal": "ms-resource:loc.messages.FindMoreDeploymentDetailsAzurePortal"
"DeploymentGroupConfigurationFailedOnVM": "ms-resource:loc.messages.DeploymentGroupConfigurationFailedOnVM"
}
}
Loading