Feature: Support servicePrincipals appRoleAssignments about hamilton

[michaljirman]

@manicminer I will look into this issue. Feel free to assign it to me.

[zbergus]

Good day, upon looking at the PR #39 i noticed the addition of (List/Remove/Assign)AppRoleAssignments in service principal which is awesome. Upon reading the graph documentation I noticed the Microsoft suggests best practice for app role assignments is to use AppRoleAssignedTo. Is there a plan to add these 3 endpoints?

Using the existing code i extended the serviceprincipal struct for my current solution to add those 3 functionalities but I do not want to step on anyone's toes, here is what i user if it helps as a starting point:

// ListAppRoleAsssignedTo retrieves a list of appRoleAssignment that users, groups,
// or client service principals have been granted for the given resource service principal.
func (c *ServicePrincipalsClient) ListAppRoleAsssignedTo(ctx context.Context, id string) (*[]AppRoleAssignment, int, error) {
	resp, status, _, err := c.BaseClient.Get(ctx, GetHttpRequestInput{
		ValidStatusCodes: []int{http.StatusOK},
		Uri: Uri{
			Entity:      fmt.Sprintf("/servicePrincipals/%s/appRoleAssignedTo", id),
			Params:      url.Values{"$select": []string{"id"}},
			HasTenantId: true,
		},
	})
	if err != nil {
		return nil, status, fmt.Errorf("ServicePrincipalsClient.BaseClient.Get(): %v", err)
	}
	defer resp.Body.Close()
	respBody, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, status, fmt.Errorf("ioutil.ReadAll(): %v", err)
	}
	var data struct {
		AppRoleAssignments []AppRoleAssignment `json:"value"`
	}
	if err := json.Unmarshal(respBody, &data); err != nil {
		return nil, status, fmt.Errorf("json.Unmarshal(): %v", err)
	}
	return &data.AppRoleAssignments, status, nil
}

// AddAppRoleAssignedTo assigns an app role for a resource service principal, to a user, group, or client service principal.
func (c *ServicePrincipalsClient) AddAppRoleAssignedTo(ctx context.Context, servicePrincipalID, principalID, resourceID, appRoleID string) (*AppRoleAssignment, int, error) {
	var status int
	data := struct {
		PrincipalID string `json:"principalID"`
		ResourceID  string `json:"resourceID"`
		AppRoleID   string `json:"appRoleID"`
	}{
		PrincipalID: principalID,
		ResourceID:  resourceID,
		AppRoleID:   appRoleID,
	}

	body, err := json.Marshal(data)
	if err != nil {
		return nil, status, fmt.Errorf("json.Marshal(): %v", err)
	}
	resp, status, _, err := c.BaseClient.Post(ctx, PostHttpRequestInput{
		Body:             body,
		ValidStatusCodes: []int{http.StatusCreated},
		Uri: Uri{
			Entity:      fmt.Sprintf("/servicePrincipals/%s/appRoleAssignedTo", servicePrincipalID),
			HasTenantId: true,
		},
	})
	if err != nil {
		return nil, status, fmt.Errorf("ServicePrincipalsClient.BaseClient.Post(): %v", err)
	}
	defer resp.Body.Close()
	respBody, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return nil, status, fmt.Errorf("ioutil.ReadAll(): %v", err)
	}
	var appRoleAssignment AppRoleAssignment
	if err := json.Unmarshal(respBody, &appRoleAssignment); err != nil {
		return nil, status, fmt.Errorf("json.Unmarshal(): %v", err)
	}
	return &appRoleAssignment, status, nil
}

// DeleteAppRoleAssignedTo deletes an appRoleAssignment that a user, group, or client service principal has been granted for a resource service principal.
func (c *ServicePrincipalsClient) DeleteAppRoleAssignedTo(ctx context.Context, servicePrincipalID, appRoleAssignmentID string) (int, error) {
	_, status, _, err := c.BaseClient.Delete(ctx, DeleteHttpRequestInput{
		ValidStatusCodes: []int{http.StatusNoContent},
		Uri: Uri{
			Entity:      fmt.Sprintf("/servicePrincipals/%s/appRoleAssignedTo/%s", servicePrincipalID, appRoleAssignmentID),
			HasTenantId: true,
		},
	})
	if err != nil {
		return status, fmt.Errorf("ServicePrincipalsClient.BaseClient.Delete(): %v", err)
	}
	return status, nil
}

[michaljirman]

Hi @zbergus,
thank you for your comment and contribution. You are right about using the appRoleAssignedTo method as best practice.
It is already part of the existing PR, listing the relevant functions here below:

• func (c *ServicePrincipalsClient) ListAppRoleAssignments(){}
• func (c *ServicePrincipalsClient) AssignAppRoleForResource(){}
• func (c *ServicePrincipalsClient) RemoveAppRoleAssignment(){}

[zbergus]

hi @michaljirman I apologize!
I should have taken a look a bit more at the endpoint being used, I assumed from the method names that the other endpoints for the service principal were being used /appRoleAssignments

Very glad to find out it is the /appRoleAssignedTo endpoint being used!

[michaljirman]

no worries @zbergus!
Maybe just my choice of the method names is not clear enough.

[manicminer]

This was added in #39