Support cross-tenant virtual network linking for Private DNS zones

[ghost]

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR has modified HISTORY.rst describing any customer-facing, functional changes. Note that this does not include changes only to help content. (see Modifying change log).

• I adhere to the Command Guidelines.

Fixes #9851

[ghost]

@zikalino This is the same change that I did for the extension in this PR. Please review and approve.

[Juliehzl]

CC @myronfanqiu, who is domain expert for Network module.

[ghost]

Hi @myronfanqiu, please add this to the sprint 75.

[mmyyrroonn]

LGTM. Just curious about new recording test files. You don't add new test and new SDK version. So you just rerun all the test with --live, am I right?

[mmyyrroonn]

@dijyotir Hello. Please rebase your branch against latest dev and modify the history. Then I will merge this PR.

[manvkaur]

Hi Team,

Can you please share the reference document or azure cli command to support cross tenant vnet linking for Private DNS Zone using two different service principals?

[jsntcy]

@msyyc, could you help on this?

[jiasli]

@manvkaur, this is definitely something that should be placed in the public doc.

You may take this script as a reference for "support cross-tenant VNET linking for Private DNS Zone using two different service principals".

We need to create 2 apps:

• appA
  • tenantA - spA - create VNET
• appB
  • tenantB - spB - create private-DNS zone and private-dns link
  • tenantA - spBA - write VNET (appB must be a guest in tenantA, and have write permission on the VNET)

Log in with a user account

# Prepare args
tenantA='ca97...'
subA="414a..."
tenantB='5482...'
subB="0b1f..."

# Login with a user account which is a tenant Application Administrator
az login

Create appA under tenantA

# Switch to subA under tenantA
az account set --subscription $subA

# Create appA and spA
spA=$(az ad sp create-for-rbac --role Contributor)

# Save the appId and password for later login
appIdA=$(echo $spA | jq --raw-output .appId)
passwordA=$(echo $spA | jq --raw-output .password)

Create appB under tenantB

# Switch to subB under tenantB
az account set --subscription $subB

# Create appB and spB
spB=$(az ad sp create-for-rbac --role Contributor)

# Save the appId and password for later login
appIdB=$(echo $spB | jq --raw-output .appId)
passwordB=$(echo $spB | jq --raw-output .password)

# Make appB multi-tenant
# --identifier-uris must be on a tenant verified domain. See https://stackoverflow.com/a/60396506/2199657
az ad app update --id $appIdB --available-to-other-tenants --identifier-uris "https://AzureSDKTeam.onmicrosoft.com/$appIdB"

Make appB a guest under tenantA

# Switch to subA under tenantA
az account set --subscription $subA

# Make appB a guest in tenantA by creating spBA
az ad sp create --id $appIdB

# Grant appB Contributor role in subA
# You may narrow the scope of the role assignment by specifying --scope
az role assignment create --assignee $appIdB --role Contributor

Create VNET in subA

# Log in with appA in tenantA
az login --service-principal --username $appIdA --password $passwordA --tenant $tenantA

# Create myResourceGroupA
az group create --name myResourceGroupA --location "East US"

# Create myVnetA
az network vnet create --resource-group myResourceGroupA --name myVnetA --location eastus --address-prefix 10.2.0.0/16 --subnet-name backendSubnet --subnet-prefixes 10.2.0.0/24

Create private DNS zone in subB

# Log in with appB in tenantB
az login --service-principal --username $appIdB --password $passwordB --tenant $tenantB

# Create myResourceGroupB
az group create --name myResourceGroupB --location "East US"

# Create private DNS private.contoso.com
az network private-dns zone create -g myResourceGroupB -n private.contoso.com

Log in with appB in tenantA (optional)

This step is optional. If not executed, az network private-dns link vnet create will show a warning that the credential under tenantA is missing. CLI will force to use the credential under tenantB in tenantA.

# Log in with appB in tenantA
az login --service-principal --username $appIdB --password $passwordB --tenant $tenantA

# Switch back to subB
az login --service-principal --username $appIdB --password $passwordB --tenant $tenantB

Create private DNS link in subB

# Create private DNS link MyDNSLink
az network private-dns link vnet create -g myResourceGroupB -n MyDNSLink -z private.contoso.com -v "/subscriptions/$subA/resourceGroups/myResourceGroupA/providers/Microsoft.Network/virtualNetworks/myVnetA" -e true

The request will contain following headers:

• Authorization: appB's access token for tenantB
• x-ms-authorization-auxiliary: appB's access token for tenantA

References

• Quickstart: Create an Azure private DNS zone using the Azure CLI
• az network private-dns link vnet create
• Authenticate requests across tenants

[jiasli]

BTW, once private DNS is migrated to Track 2, it will also be affected by Azure/azure-sdk-for-python#8313.