Create groups for AAD app reg roles #2532

marrobi · 2022-08-30T23:34:29Z

Resolves #2480

What is being addressed

Adds groups to AAD terraform
Set workspace owner as owner of the groups.
Adds boolean to create groups to porter.yaml
Updates aad schema to provide group boolean.
Add environment variable to enable the feature
Update app reg scripts to grant required permissions to app registration
Update changelog

github-actions · 2022-08-30T23:36:36Z

Unit Test Results

503 tests +486 501 ✔️ +484 15s ⏱️ +8s
    1 suites ±    0     2 💤 +    2
    1 files ±    0     0 ❌ ±    0

Results for commit c890c1e. ± Comparison against base commit 03a3aab.

This pull request removes 17 and adds 503 tests. Note that renamed tests count towards both.

test_provisioned_health_api ‑ test_health
test_shared_service_templates ‑ test_get_shared_service_template[tre-shared-service-firewall]
test_shared_service_templates ‑ test_get_shared_service_template[tre-shared-service-gitea]
test_shared_service_templates ‑ test_get_shared_service_templates[tre-shared-service-firewall]
test_shared_service_templates ‑ test_get_shared_service_templates[tre-shared-service-gitea]
test_ui ‑ test_ui
test_workspace_service_templates ‑ test_create_workspace_service_templates
test_workspace_service_templates ‑ test_get_workspace_service_template[tre-service-azureml]
test_workspace_service_templates ‑ test_get_workspace_service_template[tre-service-guacamole]
test_workspace_service_templates ‑ test_get_workspace_service_template[tre-service-innereye]
…

tests_ma.test_api.test_errors.test_422_error ‑ test_frw_validation_error_format
tests_ma.test_api.test_errors.test_error ‑ test_frw_validation_error_format
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireAirlockManagerRights ‑ test_post_create_airlock_review_approves_airlock_request_returns_200
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireAirlockManagerRights ‑ test_post_create_airlock_review_input_is_malformed_returns_400
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireAirlockManagerRights ‑ test_post_create_airlock_review_with_event_grid_not_responding_returns_503
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireAirlockManagerRights ‑ test_post_create_airlock_review_with_illegal_status_change_returns_400
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireOwnerOrResearcherRights ‑ test_get_airlock_container_link_cancelled_request_returns_400
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireOwnerOrResearcherRights ‑ test_get_airlock_container_link_in_progress_request_returns_400
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireOwnerOrResearcherRights ‑ test_get_airlock_container_link_no_airlock_request_found_returns_404
tests_ma.test_api.test_routes.test_airlock.TestAirlockRoutesThatRequireOwnerOrResearcherRights ‑ test_get_airlock_container_link_no_workspace_request_found_returns_404
…

♻️ This comment has been updated with latest results.

tamirkamara

What about adding the groups to their respective roles in the workspace app?

api_app/schemas/azuread.json

templates/workspaces/base/terraform/aad/aad.tf

…le and assign to the app role Fixes microsoft#2480

…ipts.

marrobi · 2022-09-02T15:11:22Z

@tamirkamara became a bit more involved than I expected. Appreciate feedback, and if someone has time to test it. I have and got desired result:

marrobi · 2022-09-02T15:33:53Z

Might need to output the group IDs too, then can link to a URI such as:

https://account.activedirectory.windowsazure.com/r#/manageMembership?objectType=Group&objectId=xxxx

To manage group members.

tamirkamara

Looks good with a couple of small comments.

api_app/schemas/azuread.json

templates/workspaces/base/porter.yaml

templates/workspaces/base/template_schema.json

Co-authored-by: Tamir Kamara <26870601+tamirkamara@users.noreply.github.com>

…marrobi/issue2480

marrobi · 2022-09-06T11:11:00Z

/test

github-actions · 2022-09-06T11:11:17Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/2999673697 (with refid 9f314729)

(in response to this comment from @marrobi)

marrobi · 2022-09-07T11:18:10Z

/test

github-actions · 2022-09-07T11:18:31Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3007192495 (with refid 9f314729)

(in response to this comment from @marrobi)

marrobi · 2022-09-07T16:13:54Z

/test

github-actions · 2022-09-07T16:14:40Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3009145901 (with refid 9f314729)

(in response to this comment from @marrobi)

marrobi · 2022-09-07T16:46:33Z

/test-destroy-env

github-actions · 2022-09-07T16:47:24Z

Destroying PR test environment (RG: rg-tre9f314729)... (run: https://github.com/microsoft/AzureTRE/actions/runs/3009327735)

github-actions · 2022-09-07T17:04:32Z

PR test environment destroy complete (RG: rg-tre9f314729)

marrobi · 2022-09-07T17:09:04Z

/test

github-actions · 2022-09-07T17:09:20Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3009450629 (with refid 9f314729)

(in response to this comment from @marrobi)

marrobi · 2022-09-08T08:33:23Z

/test

github-actions · 2022-09-08T08:33:37Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3013623377 (with refid 9f314729)

(in response to this comment from @marrobi)

marrobi · 2022-09-09T09:14:48Z

/test

github-actions · 2022-09-09T09:15:04Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3021309456 (with refid 9f314729)

(in response to this comment from @marrobi)

marrobi · 2022-09-13T19:58:01Z

/test

github-actions · 2022-09-13T19:58:47Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3047996550 (with refid 9f314729)

(in response to this comment from @marrobi)

tamirkamara · 2022-09-14T06:38:39Z

/test

github-actions · 2022-09-14T06:38:54Z

🤖 pr-bot 🤖

🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/3050648354 (with refid 9f314729)

(in response to this comment from @tamirkamara)

marrobi · 2022-09-14T15:54:09Z

/test-force-approve (passed in https://github.com/microsoft/AzureTRE/actions/runs/3050648354)

github-actions · 2022-09-14T15:54:29Z

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit c890c1e)

(in response to this comment from @marrobi)

Create groups for AAD app reg roles

c16d38c

tamirkamara requested changes Aug 31, 2022

View reviewed changes

api_app/schemas/azuread.json Outdated Show resolved Hide resolved

templates/workspaces/base/terraform/aad/aad.tf Outdated Show resolved Hide resolved

When auto creating app registrations, create a user group for each ro…

60dd43e

…le and assign to the app role Fixes microsoft#2480

marrobi mentioned this pull request Sep 2, 2022

Set auto_create and group creation config for workspace globally. #2538

Open

marrobi added 2 commits September 2, 2022 14:40

Add group assignments, update docs, and app registration creation scr…

8f4c6a6

…ipts.

Update core version and change log

6806a62

marrobi requested a review from tamirkamara September 2, 2022 15:09

marrobi marked this pull request as ready for review September 2, 2022 15:34

move ad properties to the workspace

bf5d2ec

marrobi self-assigned this Sep 5, 2022

tamirkamara approved these changes Sep 5, 2022

View reviewed changes

api_app/schemas/azuread.json Outdated Show resolved Hide resolved

templates/workspaces/base/porter.yaml Show resolved Hide resolved

templates/workspaces/base/template_schema.json Outdated Show resolved Hide resolved

marrobi mentioned this pull request Sep 6, 2022

Add/view/remove researchers and additional owners to a workspace #2045

Open

4 tasks

revert azure ad changes

6604fc7

marrobi force-pushed the marrobi/issue2480 branch from cfa16b4 to 6604fc7 Compare September 6, 2022 11:08

marrobi and others added 4 commits September 6, 2022 12:08

Update templates/workspaces/base/porter.yaml

5bc7d5a

Co-authored-by: Tamir Kamara <26870601+tamirkamara@users.noreply.github.com>

remove duplicate properties.

a1155f8

Merge branch 'marrobi/issue2480' of github.com:marrobi/AzureTRE into …

7b91461

…marrobi/issue2480

Merge branch 'main' into marrobi/issue2480

6a4856e

marrobi enabled auto-merge (squash) September 6, 2022 11:12

Merge branch 'main' into marrobi/issue2480

0067ab3

Up core version

4aaf114

Merge branch 'main' into marrobi/issue2480

e4ac873

Merge branch 'main' into marrobi/issue2480

e38843b

Merge branch 'main' into marrobi/issue2480

b62e43a

Merge branch 'main' into marrobi/issue2480

e61f41b

marrobi added 2 commits September 14, 2022 16:51

Merge branch 'main' into marrobi/issue2480

7a4a53a

Increase core version

c890c1e

marrobi merged commit caf6a9c into microsoft:main Sep 14, 2022

marrobi deleted the marrobi/issue2480 branch September 14, 2022 16:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create groups for AAD app reg roles #2532

Create groups for AAD app reg roles #2532

marrobi commented Aug 30, 2022 •

edited

Loading

github-actions bot commented Aug 30, 2022 •

edited

Loading

tamirkamara left a comment

marrobi commented Sep 2, 2022

marrobi commented Sep 2, 2022

tamirkamara left a comment

marrobi commented Sep 6, 2022

github-actions bot commented Sep 6, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 8, 2022

github-actions bot commented Sep 8, 2022

marrobi commented Sep 9, 2022

github-actions bot commented Sep 9, 2022

marrobi commented Sep 13, 2022

github-actions bot commented Sep 13, 2022

tamirkamara commented Sep 14, 2022

github-actions bot commented Sep 14, 2022

marrobi commented Sep 14, 2022

github-actions bot commented Sep 14, 2022

Create groups for AAD app reg roles #2532

Create groups for AAD app reg roles #2532

Conversation

marrobi commented Aug 30, 2022 • edited Loading

Resolves #2480

What is being addressed

github-actions bot commented Aug 30, 2022 • edited Loading

Unit Test Results

tamirkamara left a comment

Choose a reason for hiding this comment

marrobi commented Sep 2, 2022

marrobi commented Sep 2, 2022

tamirkamara left a comment

Choose a reason for hiding this comment

marrobi commented Sep 6, 2022

github-actions bot commented Sep 6, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 7, 2022

github-actions bot commented Sep 7, 2022

marrobi commented Sep 8, 2022

github-actions bot commented Sep 8, 2022

marrobi commented Sep 9, 2022

github-actions bot commented Sep 9, 2022

marrobi commented Sep 13, 2022

github-actions bot commented Sep 13, 2022

tamirkamara commented Sep 14, 2022

github-actions bot commented Sep 14, 2022

marrobi commented Sep 14, 2022

github-actions bot commented Sep 14, 2022

marrobi commented Aug 30, 2022 •

edited

Loading

github-actions bot commented Aug 30, 2022 •

edited

Loading