From 545f7f94bf4a4a972df2dfb32939ebce848a608e Mon Sep 17 00:00:00 2001 From: Hong Ooi Date: Mon, 25 Mar 2019 14:25:43 +1100 Subject: [PATCH] rbac support for az_user objs, readme --- R/rbac.R | 6 +++--- README.md | 11 ++++++++--- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/R/rbac.R b/R/rbac.R index 79616f6..f3a682f 100644 --- a/R/rbac.R +++ b/R/rbac.R @@ -17,7 +17,7 @@ #' list_role_definitions(filter=NULL, as_data_frame = TRUE) #' ``` #' @section Arguments: -#' - `principal`: For `add_role_assignment`, the principal for which to assign a role. This can be a GUID, or an object of class `az_app` or `az_storage_principal` (from the AzureGraph package). +#' - `principal`: For `add_role_assignment`, the principal for which to assign a role. This can be a GUID, or an object of class `az_user`, `az_app` or `az_storage_principal` (from the AzureGraph package). #' - `role`: For `add_role_assignment`, the role to assign the principal. This can be a GUID, a string giving the role name (eg "Contributor"), or an object of class `[az_role_definition]`. #' - `scope`: For `add_role_assignment`, an optional scope for the assignment. #' - `id`: A role ID. For `get_role_assignment` and `remove_role_assignment`, this is a role assignment GUID. For `get_role_definition`, this can be a role definition GUID or a role name. @@ -55,7 +55,7 @@ #' sub$get_role_definition("Contributor") #' #' # get an app using the AzureGraph package -#' app <- az_graph$new("myaadtenant")$get_app("app_id") +#' app <- get_graph_login("myaadtenant")$get_app("app_id") #' #' # subscription level #' asn1 <- sub$add_role_assignment(app, "Reader") @@ -206,7 +206,7 @@ function(filter=NULL, as_data_frame=TRUE) add_role_assignment <- function(principal, role, scope, api_func) { # obtain object ID from a service principal or registered app - if(inherits(principal, "az_service_principal")) + if(inherits(principal, c("az_service_principal", "az_user"))) principal <- principal$properties$id else if(inherits(principal, "az_app")) principal <- principal$get_service_principal()$properties$id diff --git a/README.md b/README.md index a5dcc69..c12ed49 100644 --- a/README.md +++ b/README.md @@ -50,9 +50,14 @@ rg2 <- sub$create_resource_group("newrgname", location="westus") stor2 <- rg2$create_resource(type="Microsoft.Storage/storageAccounts", name="mystorage2", kind="Storage", sku=list(name="Standard_LRS")) -# delete them -stor2$delete(confirm=FALSE) -rg2$delete(confirm=FALSE) +# tagging +stor2$set_tags(comment="hello world!", created_by="AzureRMR") + +# role-based access control (RBAC) +# this uses the AzureGraph package to retrieve the user ID +gr <- AzureGraph::get_graph_login() +usr <- gr$get_user("username@aadtenant.com") +stor2$add_role_assignment(usr, "Storage blob data contributor") ``` ## Extending