Anuj Chaudhary https://docs.microsoft.com/archive/blogs/anujchaudhary/feed.xml Software Engineering Wed, 17 Apr 2019 03:39:44 GMT en-US hourly 1 PowerShell sample for Privileged Identity Management (PIM) for Azure AD Roles https://docs.microsoft.com/archive/blogs/anujchaudhary/powershell-sample-for-privileged-identity-management-pim-for-azure-ad-roles Thu, 07 Jun 2018 18:24:13 GMT https://blogs.msdn.microsoft.com/anujchaudhary/?p=135 https://docs.microsoft.com/en-us/azure/active-directory/active-directory-privileged-identity-management-getting-started  How cool would it be if I can use the MSGraph PIM api’s to build custom applications. For example, you have multiple roles where you want to activate every day. It would be time consuming to activate them one by one. Instead, you can build a custom app using PowerShell or UI so that you can activate to all of these roles in one shot. In this blog, I will share a sample to list all your eligible roles and activate or deactivate them. You will also be able to assign someone to a role. I will share the full source code so you can customize it to suit your needs. Just save this as a .ps1 file and run it with PowerShell. Note: There is a limitation with MSGraph PIM api's that it wont work if your role requires MFA which should be fixed soon. Screenshot Setup Source code #Loads Active Directory Authentication Library function Load-ActiveDirectoryAuthenticationLibrary(){ $moduleDirPath = [Environment]::GetFolderPath("MyDocuments") + "\WindowsPowerShell\Modules" $modulePath = $moduleDirPath + "\AADGraph" if(-not (Test-Path ($modulePath+"\Nugets"))) {New-Item -Path ($modulePath+"\Nugets") -ItemType "Directory" | out-null} $adalPackageDirectories = (Get-ChildItem -Path ($modulePath+"\Nugets") -Filter "Microsoft.IdentityModel.Clients.ActiveDirectory*" -Directory) if($adalPackageDirectories.Length -eq 0){ Write-Host "Active Directory Authentication Library Nuget doesn't exist. Downloading now ..." -ForegroundColor Yellow if(-not(Test-Path ($modulePath + "\Nugets\nuget.exe"))) { Write-Host "nuget.exe not found. Downloading from https://www.nuget.org/nuget.exe ..." -ForegroundColor Yellow $wc = New-Object System.Net.WebClient $wc.DownloadFile("https://www.nuget.org/nuget.exe",$modulePath + "\Nugets\nuget.exe"); } $nugetDownloadExpression = $modulePath + "\Nugets\nuget.exe install Microsoft.IdentityModel.Clients.ActiveDirectory -Version 2.14.201151115 -OutputDirectory " + $modulePath + "\Nugets | out-null" Invoke-Expression $nugetDownloadExpression } $adalPackageDirectories = (Get-ChildItem -Path ($modulePath+"\Nugets") -Filter "Microsoft.IdentityModel.Clients.ActiveDirectory*" -Directory) $ADAL_Assembly = (Get-ChildItem "Microsoft.IdentityModel.Clients.ActiveDirectory.dll" -Path $adalPackageDirectories[$adalPackageDirectories.length-1].FullName -Recurse) $ADAL_WindowsForms_Assembly = (Get-ChildItem "Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dll" -Path $adalPackageDirectories[$adalPackageDirectories.length-1].FullName -Recurse) if($ADAL_Assembly.Length -gt 0 -and $ADAL_WindowsForms_Assembly.Length -gt 0){ Write-Host "Loading ADAL Assemblies ..." -ForegroundColor Green [System.Reflection.Assembly]::LoadFrom($ADAL_Assembly[0].FullName) | out-null [System.Reflection.Assembly]::LoadFrom($ADAL_WindowsForms_Assembly.FullName) | out-null return $true } else{ Write-Host "Fixing Active Directory Authentication Library package directories ..." -ForegroundColor Yellow $adalPackageDirectories | Remove-Item -Recurse -Force | Out-Null Write-Host "Not able to load ADAL assembly. Delete the Nugets folder under" $modulePath ", restart PowerShell session and try again ..." return $false } } #Acquire AAD token function AcquireToken($mfa){ $clientID = "dabc52c4-106b-4179-9df2-2f791f44ba14" $redirectUri = "https://pimmsgraph" $authority = "https://login.microsoftonline.com/common" $authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority,$false if($mfa) { $authResult = $authContext.AcquireToken("https://graph.microsoft.com",$ClientID,$redirectUri,[Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto, [Microsoft.IdentityModel.Clients.ActiveDirectory.UserIdentifier]::AnyUser, "amr_values=mfa") Set-Variable -Name mfaDone -Value $true -Scope Global } else { $authResult = $authContext.AcquireToken("https://graph.microsoft.com",$ClientID,$redirectUri,[Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always) } if($authResult -ne $null) { Write-Host "User logged in successfully ..." -ForegroundColor Green } Set-Variable -Name headerParams -Value @{'Authorization'="$($authResult.AccessTokenType) $($authResult.AccessToken)"} -Scope Global Set-Variable -Name assigneeId -Value $authResult.UserInfo.UniqueId -Scope Global } #Gets my jit assignments function MyJitAssignments(){ $url = $serviceRoot + "privilegedRoleAssignments/my?`$expand=roleInfo&`$filter=isElevated+eq+false" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $assignments = ConvertFrom-Json $response.Content Write-Host "" Write-Host "Role assignments..." -ForegroundColor Green $i = 0 $obj = @() foreach ($assignment in $assignments.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleAssignmentId = $assignment.id RoleId = $assignment.roleInfo.id RoleName = $assignment.roleInfo.name UserId = $assignment.userid } $obj = $obj + $item } return $obj } #Gets my active assignments function MyActivatedAssignments(){ $url = $serviceRoot + "privilegedRoleAssignments/my?`$expand=roleInfo&`$filter=isElevated+eq+true+and+expirationDateTime+ne+null" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $assignments = ConvertFrom-Json $response.Content Write-Host "" Write-Host "Role assignments..." -ForegroundColor Green $i = 0 $obj = @() foreach ($assignment in $assignments.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleAssignmentId = $assignment.id RoleId = $assignment.roleInfo.id RoleName = $assignment.roleInfo.name UserId = $assignment.userid ExpirationDateTime = $assignment.expirationDateTime } $obj = $obj + $item } return $obj } #List roles function ListRoles(){ $url = $serviceRoot + "privilegedRoles?&`$orderby=name" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $roles = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($role in $roles.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleId = $role.id RoleName = $role.name } $obj = $obj + $item } return $obj } #List Assignment function ListAssignmentsWithFilter($roleId){ $url = $serviceRoot + "privilegedRoleAssignments?`$expand=roleInfo&`$filter=roleId+eq+'" + $roleId + "'" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $roleAssignments = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($roleAssignment in $roleAssignments.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleAssignmentId = $roleAssignment.id RoleId = $roleAssignment.roleInfo.id RoleName = $roleAssignment.roleInfo.name IsElevated = $roleAssignment.isElevated ExpirationDateTime = $roleAssignment.expirationDateTime UserId = $roleAssignment.userId } $obj = $obj + $item } return $obj } #List Users function ListUsers($user_search){ $url = $MSGraphRoot + "users?`$filter=startswith(displayName,'" + $user_search + "')" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $users = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($user in $users.value) { $item = New-Object psobject -Property @{ Id = ++$i UserId = $user.id UserName = $user.DisplayName } $obj = $obj + $item } return $obj } #Activates the user function Activate($isRecursive = $false){ if($isRecursive -eq $false) { $assignments = MyJitAssignments $assignments | Format-Table -AutoSize -Wrap Id,RoleName $choice = Read-Host "Enter Id to activate" $hours = Read-Host "Enter Activation duration in hours" $reason = Read-Host "Enter Reason" } $roleId = $assignments[$choice-1].RoleId $url = $serviceRoot + "privilegedRoles('" + $roleId + "')/selfActivate" $postParams = '{"duration":"' + $hours + '","reason":"' + $reason + '"}' write-Host $postParams try { $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams Write-Host "Role activated successfully ..." -ForegroundColor Green } catch { $stream = $_.Exception.Response.GetResponseStream() $stream.Position = 0; $streamReader = New-Object System.IO.StreamReader($stream) $err = $streamReader.ReadToEnd() $streamReader.Close() $stream.Close() if($mfaDone -eq $false -and $err.Contains("MfaRule")) { Write-Host "Prompting the user for mfa ..." -ForegroundColor Green AcquireToken true Activate $true } else { Write-Host $err -ForegroundColor Red } } } #Deactivates the user function Deactivate($isRecursive = $false){ if($isRecursive -eq $false) { $assignments = MyActivatedAssignments $assignments | Format-Table -AutoSize -Wrap Id,RoleName,ExpirationDateTime $choice = Read-Host "Enter Id to deactivate" } $roleId = $assignments[$choice-1].RoleId $url = $serviceRoot + "privilegedRoles('" + $roleId + "')/selfDeactivate" $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" Write-Host "Role deactivated successfully ..." -ForegroundColor Green } #List RoleAssignment function ListAssignment(){ #List and Pick a role $roles = ListRoles $roles | Format-Table -AutoSize -Wrap Id, RoleName, RoleId $role_choice = Read-Host "Pick a role Id" $roleId = $roles[$role_choice-1].RoleId write-Host $roleId #List Member $roleAssignments = ListAssignmentsWithFilter $roleId $roleAssignments | Format-Table -AutoSize -Wrap Id, RoleName, UserId, IsElevated, ExpirationDateTime } #Assign a user to Eligible function AssignmentEligible() { #List and Pick a role $roles = ListRoles $roles | Format-Table -AutoSize -Wrap Id, RoleName $role_choice = Read-Host "Pick a role Id" $roleId = $roles[$role_choice-1].RoleId write-Host $roleId #Search user by Name, and pick a user $user_search = Read-Host "user Name start with..." $users = ListUsers($user_search) $users | Format-Table -AutoSize -Wrap Id, UserName, UserId $user_choice = Read-Host "Pick a user Id" $userId = $users[$user_choice-1].UserId   $url = $serviceRoot + "privilegedRoleAssignments" $postParams = '{"roleId":"' + $roleId + '","userId":"' + $userId + '"}' write-Host $postParams $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams Write-Host "Assignment added successfully ..." -ForegroundColor Green }   #Show menu function ShowMenu(){ Write-Host "" Write-Host "Azure AD JIT - PowerShell Menu v1.0" Write-Host " 1. List your eligible role assignments" Write-Host " 2. Activate an eligible role" Write-Host " 3. Deactivate an active role" Write-Host " 4. List Assignment against a role" Write-Host " 5. Assign a user to a role" Write-Host " 6. Exit" } ############################################################################################################################################################################ $global:serviceRoot = "https://graph.microsoft.com/beta/" $global:MSGraphRoot = "https://graph.microsoft.com/v1.0/" $global:headerParams = "" $global:assigneeId = "" $global:mfaDone = $false; Load-ActiveDirectoryAuthenticationLibrary AcquireToken do { ShowMenu #Write-Host "Enter your selection" $input = Read-Host "Enter your selection" switch ($input) { '1' { $assignments = MyJitAssignments $assignments | Format-Table -AutoSize -Wrap Id,RoleName } '2' { Activate } '3' { Deactivate } '4' { ListAssignment } '5' { AssignmentEligible } '6' { return } } } until ($input -eq '6') Write-Host ""]]> Securing Azure resources with Privileged Identity Management https://docs.microsoft.com/archive/blogs/anujchaudhary/securing-azure-resources-with-privileged-identity-management Thu, 12 Apr 2018 01:13:24 GMT https://blogs.msdn.microsoft.com/anujchaudhary/?p=65 https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/azure-pim-resource-rbac It is important to have a Just In Time (JIT) capability to JIT into an Azure subscription for few hours to investigate any issues. However, once a bad guy has access to the subscription, he can get a lot of information out (like secrets, etc.) and do bad things even after the access is lost. With PIM, you can assign JIT access not only at the subscription level but also at a specific Resource group or Resource level to prevent any information disclosure. Here is an example of how you can manage your subscription securely with PIM. Create a Resource group for all your secrets. Let’s call it SecretsResourceGroup. This resource group can have the following resources:
  • Azure Storage
  • SQL Azure
  • Cosmos DB
  • Etc.
Create a Resource group for all your deployments. Let’s call it DeploymentsResourceGroup. This resource can have the following resources:
  • Cloud Service
  • Service Fabric
  • App Service
  • Virtual Machines
  • Etc.
You will notice that almost anyone who needs access to the subscription actually needs access to a resource within DeploymentsResourceGroup. Typical scenarios include:
  • Investigating live site issue with a specific deployment
  • Restarting a VM
  • Installing a software update
  • Etc.
If they need access to multiple resources, you can assign them Eligible assignment on the Resource group. If they need access to a specific resource, you can assign them Eligible assignment on the specific resource. Now whenever, they need access, they can JIT into the specific resource at that time. You can also configure approval so that they can only JIT upon approval. Thus, due to the granularity that PIM supports, you can now prevent people from accessing your secrets but still allow them to JIT into the specific resources where they need to investigate any issues.]]> PowerShell sample for Privileged Identity Management (PIM) for Azure Resources https://docs.microsoft.com/archive/blogs/anujchaudhary/powershell-sample-for-privileged-identity-management-pim-for-azure-resources Wed, 07 Feb 2018 04:01:38 GMT https://blogs.msdn.microsoft.com/anujchaudhary/?p=36 https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/azure-pim-resource-rbac How cool would it be if I can use the MSGraph PIM api’s to build custom applications. For example, your IT Org has N different resource groups where you want to activate every day. It would be time consuming to activate them one by one. Instead, you can build a custom app using PowerShell or UI so that you can activate to all of these resource groups in one shot. In this blog, I will share a sample to list all your eligible roles and activate or deactivate them. You will also be able to assign someone to a role. I will share the full source code so you can customize it to suit your needs. Just save this as a .ps1 file and run it with PowerShell. Note: There is a limitation with MSGraph PIM api's that it wont work if your role requires MFA which should be fixed soon. Screenshot Setup Source code #Loads Active Directory Authentication Library function Load-ActiveDirectoryAuthenticationLibrary(){ $moduleDirPath = [Environment]::GetFolderPath("MyDocuments") + "\WindowsPowerShell\Modules" $modulePath = $moduleDirPath + "\AADGraph" if(-not (Test-Path ($modulePath+"\Nugets"))) {New-Item -Path ($modulePath+"\Nugets") -ItemType "Directory" | out-null} $adalPackageDirectories = (Get-ChildItem -Path ($modulePath+"\Nugets") -Filter "Microsoft.IdentityModel.Clients.ActiveDirectory*" -Directory) if($adalPackageDirectories.Length -eq 0){ Write-Host "Active Directory Authentication Library Nuget doesn't exist. Downloading now ..." -ForegroundColor Yellow if(-not(Test-Path ($modulePath + "\Nugets\nuget.exe"))) { Write-Host "nuget.exe not found. Downloading from https://www.nuget.org/nuget.exe ..." -ForegroundColor Yellow $wc = New-Object System.Net.WebClient $wc.DownloadFile("https://www.nuget.org/nuget.exe",$modulePath + "\Nugets\nuget.exe"); } $nugetDownloadExpression = $modulePath + "\Nugets\nuget.exe install Microsoft.IdentityModel.Clients.ActiveDirectory -Version 2.14.201151115 -OutputDirectory " + $modulePath + "\Nugets | out-null" Invoke-Expression $nugetDownloadExpression } $adalPackageDirectories = (Get-ChildItem -Path ($modulePath+"\Nugets") -Filter "Microsoft.IdentityModel.Clients.ActiveDirectory*" -Directory) $ADAL_Assembly = (Get-ChildItem "Microsoft.IdentityModel.Clients.ActiveDirectory.dll" -Path $adalPackageDirectories[$adalPackageDirectories.length-1].FullName -Recurse) $ADAL_WindowsForms_Assembly = (Get-ChildItem "Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dll" -Path $adalPackageDirectories[$adalPackageDirectories.length-1].FullName -Recurse) if($ADAL_Assembly.Length -gt 0 -and $ADAL_WindowsForms_Assembly.Length -gt 0){ Write-Host "Loading ADAL Assemblies ..." -ForegroundColor Green [System.Reflection.Assembly]::LoadFrom($ADAL_Assembly[0].FullName) | out-null [System.Reflection.Assembly]::LoadFrom($ADAL_WindowsForms_Assembly.FullName) | out-null return $true } else{ Write-Host "Fixing Active Directory Authentication Library package directories ..." -ForegroundColor Yellow $adalPackageDirectories | Remove-Item -Recurse -Force | Out-Null Write-Host "Not able to load ADAL assembly. Delete the Nugets folder under" $modulePath ", restart PowerShell session and try again ..." return $false } } #Acquire AAD token function AcquireToken($mfa){ $clientID = "dabc52c4-106b-4179-9df2-2f791f44ba14" $redirectUri = "https://pimmsgraph" $authority = "https://login.microsoftonline.com/common" $authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $authority,$false if($mfa) { $authResult = $authContext.AcquireToken("https://graph.microsoft.com",$ClientID,$redirectUri,[Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Auto, [Microsoft.IdentityModel.Clients.ActiveDirectory.UserIdentifier]::AnyUser, "amr_values=mfa") Set-Variable -Name mfaDone -Value $true -Scope Global } else { $authResult = $authContext.AcquireToken("https://graph.microsoft.com",$ClientID,$redirectUri,[Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always) } if($authResult -ne $null) { Write-Host "User logged in successfully ..." -ForegroundColor Green } Set-Variable -Name headerParams -Value @{'Authorization'="$($authResult.AccessTokenType) $($authResult.AccessToken)"} -Scope Global Set-Variable -Name assigneeId -Value $authResult.UserInfo.UniqueId -Scope Global } #Gets my jit assignments function MyJitAssignments(){ $urlme = $global:MSGraphRoot + "me/" $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $urlme -Method Get $me = ConvertFrom-Json $response.Content $subjectId = $me.id Write-Host $subjectId $url = $serviceRoot + "roleAssignments?`$expand=linkedEligibleRoleAssignment,subject,roleDefinition(`$expand=resource)&`$filter=(assignmentState+eq+'Eligible')+and+(subjectId+eq+'" + $subjectId + "')" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $assignments = ConvertFrom-Json $response.Content Write-Host "" Write-Host "Role assignments..." -ForegroundColor Green $i = 0 $obj = @() foreach ($assignment in $assignments.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleAssignmentId = $assignment.id ResourceId = $assignment.roleDefinition.resource.id OriginalId = $assignment.roleDefinition.resource.externalId ResourceName = $assignment.roleDefinition.resource.displayName ResourceType = $assignment.roleDefinition.resource.type RoleId = $assignment.roleDefinition.id RoleName = $assignment.roleDefinition.displayName ExpirationDate = $assignment.endDateTime SubjectId = $assignment.subject.id } $obj = $obj + $item } return $obj } #List resources function ListResources(){ $url = $serviceRoot + "resources?`$filter=(type+eq+'subscription')" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $resources = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($resource in $resources.value) { $item = New-Object psobject -Property @{ Id = ++$i ResourceId = $resource.id ResourceName = $resource.DisplayName Type = $resource.type ExternalId = $resource.externalId } $obj = $obj + $item } return $obj } #List roles function ListRoles($resourceId){ $url = $serviceRoot + "resources/" + $resourceId + "/roleDefinitions?&`$orderby=displayName" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $roles = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($role in $roles.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleDefinitionId = $role.id RoleName = $role.DisplayName } $obj = $obj + $item } return $obj } #List Assignment function ListAssignmentsWithFilter($resourceId, $roleDefinitionId){ $url = $serviceRoot + "resources/" + $resourceId + "`/roleAssignments?`$expand=subject,roleDefinition(`$expand=resource)&`$filter=(roleDefinition/id+eq+'" + $roleDefinitionId + "')" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $roleAssignments = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($roleAssignment in $roleAssignments.value) { $item = New-Object psobject -Property @{ Id = ++$i RoleAssignmentId = $roleAssignment.id ResourceId = $roleAssignment.roleDefinition.resource.id OriginalId = $roleAssignment.roleDefinition.resource.externalId ResourceName = $roleAssignment.roleDefinition.resource.displayName ResourceType = $roleAssignment.roleDefinition.resource.type RoleId = $roleAssignment.roleDefinition.id RoleName = $roleAssignment.roleDefinition.displayName ExpirationDate = $roleAssignment.endDateTime SubjectId = $roleAssignment.subject.id UserName = $roleAssignment.subject.displayName AssignmentState = $roleAssignment.AssignmentState } $obj = $obj + $item } return $obj } #List Users function ListUsers($user_search){ $url = $MSGraphRoot + "users?`$filter=startswith(displayName,'" + $user_search + "')" Write-Host $url $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Get $users = ConvertFrom-Json $response.Content $i = 0 $obj = @() foreach ($user in $users.value) { $item = New-Object psobject -Property @{ Id = ++$i UserId = $user.id UserName = $user.DisplayName } $obj = $obj + $item } return $obj } #Activates the user function Activate($isRecursive = $false){ if($isRecursive -eq $false) { $assignments = MyJitAssignments $assignments | Format-Table -AutoSize -Wrap Id,RoleName,ResourceName,ResourceType,ExpirationDate $choice = Read-Host "Enter Id to activate" [int]$hours = Read-Host "Enter Activation duration in hours" $reason = Read-Host "Enter Reason" } $id = $assignments[$choice-1].RoleAssignmentId $resourceId = $assignments[$choice-1].ResourceId $roleDefinitionId = $assignments[$choice-1].RoleId $subjectId = $assignments[$choice-1].SubjectId $url = $serviceRoot + "roleAssignmentRequests" $postParams = '{"id":"00000000-0000-0000-0000-000000000000","assignmentState":"Active","type":"UserAdd","reason":"' + $reason + '","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '","schedule":{"duration":"PT' + $hours + 'H","startDateTime":"' + (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","type":"Once"},"linkedEligibleRoleAssignmentId":"' + $id + '"}' write-Host $postParams try { $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams Write-Host "Activation request queued successfully ..." -ForegroundColor Green } catch { $stream = $_.Exception.Response.GetResponseStream() $stream.Position = 0; $streamReader = New-Object System.IO.StreamReader($stream) $err = $streamReader.ReadToEnd() $streamReader.Close() $stream.Close() if($mfaDone -eq $false -and $err.Contains("MfaRule")) { Write-Host "Prompting the user for mfa ..." -ForegroundColor Green AcquireToken true Activate $true } else { Write-Host $err -ForegroundColor Red } } } #Deactivates the user function Deactivate($isRecursive = $false){ if($isRecursive -eq $false) { $assignments = MyJitAssignments $assignments | Format-Table -AutoSize -Wrap id,RoleName,ResourceName,ResourceType,ExpirationDate $choice = Read-Host "Enter Id to deactivate" } $id = $assignments[$choice-1].RoleAssignmentId $resourceId = $assignments[$choice-1].ResourceId $roleDefinitionId = $assignments[$choice-1].RoleId $subjectId = $assignments[$choice-1].SubjectId $url = $serviceRoot + "roleAssignmentRequests" $postParams = '{"assignmentState":"Active","type":"UserRemove","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '"}' $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams Write-Host "Role deactivated successfully ..." -ForegroundColor Green } #List RoleAssignment function ListAssignment(){ #List and Pick resource $resources = ListResources $resources | Format-Table -AutoSize -Wrap Id, ResourceName, Type, ExternalId $res_choice = Read-Host "Pick an resource Id for assigment" $resourceId = $resources[$res_choice-1].ResourceId #List and Pick a role $roles = ListRoles($resourceId) $roles | Format-Table -AutoSize -Wrap Id, RoleName, RoleDefinitionId $role_choice = Read-Host "Pick a role Id" $roleDefinitionId = $roles[$role_choice-1].RoleDefinitionId write-Host $roleDefinitionId #List Member $roleAssignments = ListAssignmentsWithFilter $resourceId $roleDefinitionId $roleAssignments | Format-Table -AutoSize -Wrap Id, ResourceName, ResourceType, RoleName, UserName, AssignmentState, ExpirationDate } #Assign a user to Eligible function AssignmentEligible() { #List and Pick resource $resources = ListResources $resources | Format-Table -AutoSize -Wrap Id, ResourceName, Type, ExternalId $res_choice = Read-Host "Pick an resource Id for assigment" $resourceId = $resources[$res_choice-1].ResourceId #List and Pick a role $roles = ListRoles($resourceId) $roles | Format-Table -AutoSize -Wrap Id, RoleName, RoleDefinitionId $role_choice = Read-Host "Pick a role Id" $roleDefinitionId = $roles[$role_choice-1].RoleDefinitionId write-Host $roleDefinitionId #Search user by Name, and pick a user $user_search = Read-Host "user Name start with..." $users = ListUsers($user_search) $users | Format-Table -AutoSize -Wrap Id, UserName, UserId $user_choice = Read-Host "Pick a user Id" $subjectId = $users[$user_choice-1].UserId   $url = $serviceRoot + "roleAssignmentRequests" # Update end time $ts = New-TimeSpan -Days 30 $postParams = '{"assignmentState":"Eligible","type":"AdminAdd","reason":"Assign","roleDefinitionId":"' + $roleDefinitionId + '","resourceId":"' + $resourceId + '","subjectId":"' + $subjectId + '","schedule":{"startDateTime":"' + (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","endDateTime":"' + ((get-date) + $ts).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ") + '","type":"Once"}}' write-Host $postParams try { $response = Invoke-WebRequest -UseBasicParsing -Headers $headerParams -Uri $url -Method Post -ContentType "application/json" -Body $postParams Write-Host "Assignment request queued successfully ..." -ForegroundColor Green } catch { $stream = $_.Exception.Response.GetResponseStream() $stream.Position = 0; $streamReader = New-Object System.IO.StreamReader($stream) $err = $streamReader.ReadToEnd() $streamReader.Close() $stream.Close() if($mfaDone -eq $false -and $err.Contains("MfaRule")) { Write-Host "Prompting the user for mfa ..." -ForegroundColor Green AcquireToken true Activate $true } else { Write-Host $err -ForegroundColor Red } } } #Show menu function ShowMenu(){ Write-Host "" Write-Host "Azure RBAC JIT - PowerShell Menu v1.0" Write-Host " 1. List your eligible role assignments" Write-Host " 2. Activate an eligible role" Write-Host " 3. Deactivate an active role" Write-Host " 4. List Assignment against a resource" Write-Host " 5. Assign a user to a role" Write-Host " 6. Exit" } ############################################################################################################################################################################ $global:serviceRoot = "https://graph.microsoft.com/beta/privilegedAccess/azureResources/" $global:MSGraphRoot = "https://graph.microsoft.com/v1.0/" $global:headerParams = "" $global:assigneeId = "" $global:mfaDone = $false; Load-ActiveDirectoryAuthenticationLibrary AcquireToken do { ShowMenu #Write-Host "Enter your selection" $input = Read-Host "Enter your selection" switch ($input) { '1' { $assignments = MyJitAssignments $assignments | Format-Table -AutoSize -Wrap id,RoleName,ResourceName,ResourceType,ExpirationDate } '2' { Activate } '3' { Deactivate } '4' { ListAssignment } '5' { AssignmentEligible } '6' { return } } } until ($input -eq '6') Write-Host ""  ]]> Windows Azure: Automated UI testing using the power of cloud https://docs.microsoft.com/archive/blogs/anujchaudhary/windows-azure-automated-ui-testing-using-the-power-of-cloud Fri, 02 Nov 2012 15:43:00 GMT https://blogs.msdn.microsoft.com/anujchaudhary/2012/11/02/windows-azure-automated-ui-testing-using-the-power-of-cloud/

Problem Statement

Automated UI testing needs to be performed from different parts of the world.

The tests can validate various UI behaviors from different geo locations e.g. behavior of JavaScript which makes service calls.

Background

As we have seen in my previous post on Performance testing using the power of cloud, it is possible to install test agents around the globe and run Load Tests from the agents. The same setup can be used to run unit tests or web tests by distributing them across different agents.

Challenge

The challenging part is to run UI tests (e.g. Coded UI) from the agents in cloud. This is because we will always need to have an active desktop session for the tests to interact with the UI. One option would be to have dedicated hardware on premise from where active remote desktop session is always maintained for all the agents in the cloud. The other option is to tweak the configuration a little as described below without requiring any additional hardware.

Solution

Perform the same steps which were done for the setting up the environment to run load tests i.e. Installing Test Controller on Premise and Setting up Windows Azure Connect.

Now below are the changes that the needed to specifically run Automated UI Tests

  • Instead of having just one user on the Azure VM’s, we will need to have two users. One of them is used for Remote Desktop and the other one is used to Run Tests.
  • The Remote Desktop user needs to be specified in the configuration file (.cscfg)

<Setting name="Microsoft.WindowsAzure.Plugins.RemoteAccess.AccountUsername" value="remoteuser" />

  •  The Test Agent user needs to be created in setup.cmd (This user name and password should be the same as the one configured on Test Controller)

REM Create user vstestagent as an administrator

net user vstestagent <<password>> /expires:never /add

net localgroup administrators vstestagent /Add

  •  Deploy the worker role and add it to the Local Endpoint Group for Windows Azure Connect as before.
  • Now Remote Desktop to the Azure VM from the Azure Portal using the Remote Desktop user.
  • Once connected, get the machine name of the VM from Computer->Properties.
  • Go to Run and type mstsc and connect to the same VM using the machine name. While connecting this time, type the credentials of the Test Agent user.
  • Configure the test agent with the test controller in Interactive mode.

 

  • Finally, a script needs to be run to turn off IE ESC, set default IE settings, turn off Phishing filter and disable Auto Lock. A command file can be added which does the following:

REM Configure IE ESC to Off

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f

REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f

Rundll32 iesetup.dll, IEHardenLMSettings

Rundll32 iesetup.dll, IEHardenUser

Rundll32 iesetup.dll, IEHardenAdmin

REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /f /va

REG DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /f /va

REM Set Default IE Settings

REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "First Home Page" /f

REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "about:blank" /f

REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "about:blank" /f

REM Disable Phishing Filter

REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter" /v "ShownVerifyBalloon" /t REG_DWORD /d 3 /f

REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PhishingFilter" /v "Enabled" /t REG_DWORD /d 0 /f

REM Disable Auto Lock

REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableLockWorkstation" /t REG_DWORD /d 1 /f

  • Now don’t minimize any remote desktop windows and simply close the remote desktop window of the Remote Desktop user. This way the Remote Desktop window of the Test Agent user will be always active and the UI Tests can interact with the desktop.

Result

Now you can run your tests using the Test Controller. The Agent running as an interactive Process should be shown with an asterisk (*)

 

The Automated UI Test runs on the Test Agent

To confirm that the desktop doesn’t get locked, wait for 10-15 minutes, rerun the automated UI test and verify that it passes.

 

]]>