Skip to content

Commit da51d10

Browse files
msJinLeidingmeng-xue
msJinLei
and
dingmeng-xue
authored
Remove secrets in PSAzurerRmAccount from display (Azure#16449)
* Remove secrets of PSAzurerRmAccount from display Azure#15427 * Update src/Accounts/Authentication.ResourceManager/AzureRmProfile.cs Co-authored-by: Dingmeng Xue <dixue@microsoft.com> * Address review comments Co-authored-by: Dingmeng Xue <dixue@microsoft.com>
1 parent beb62f1 commit da51d10

File tree

8 files changed

+352
-1
lines changed

8 files changed

+352
-1
lines changed

‎src/Accounts/Accounts.Test/ContextCmdletTests.cs‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -792,6 +792,43 @@ public void ImportContextNoDefaultKey()
792792
}
793793
}
794794

795+
[Fact]
796+
[Trait(Category.AcceptanceType, Category.CheckIn)]
797+
public void CheckHidenServicePrincipalSecret()
798+
{
799+
var cmdlet = new GetAzureRMContextCommand();
800+
801+
// Setup
802+
cmdlet.CommandRuntime = commandRuntimeMock;
803+
var profile = new AzureRmProfile();
804+
string subscriptionName = "Contoso Subscription 1";
805+
string accountId = "7a5db92d-499a-46be-8d6e-6666eeee0000";
806+
string contextName;
807+
var contextTemp = (new AzureContext { Environment = AzureEnvironment.PublicEnvironments[EnvironmentName.AzureCloud] })
808+
.WithAccount(new AzureAccount { Id = accountId, Type = "ServicePrincipal" })
809+
.WithTenant(new AzureTenant { Id = Guid.NewGuid().ToString(), Directory = "contoso.com" })
810+
.WithSubscription(new AzureSubscription { Id = Guid.NewGuid().ToString(), Name = subscriptionName });
811+
contextTemp.Account.SetProperty(AzureAccount.Property.ServicePrincipalSecret, "5P6******************");
812+
contextTemp.Account.SetProperty(AzureAccount.Property.Subscriptions, contextTemp.Subscription.Id);
813+
contextTemp.Account.SetProperty(AzureAccount.Property.Tenants, contextTemp.Tenant.Id);
814+
profile.TryAddContext(contextTemp, out contextName);
815+
cmdlet.DefaultProfile = profile;
816+
817+
// Act
818+
cmdlet.InvokeBeginProcessing();
819+
cmdlet.ExecuteCmdlet();
820+
cmdlet.InvokeEndProcessing();
821+
822+
// Verify
823+
Assert.True(commandRuntimeMock.OutputPipeline.Count == 1);
824+
var context = (PSAzureContext)commandRuntimeMock.OutputPipeline[0];
825+
Assert.Equal(subscriptionName, context.Subscription.Name);
826+
Assert.Equal(accountId, context.Account.Id);
827+
var accountExtendedProperties = context.Account.ExtendedProperties;
828+
Assert.Equal(2, accountExtendedProperties.Count());
829+
Assert.False(accountExtendedProperties.ContainsKey(AzureAccount.Property.ServicePrincipalSecret));
830+
}
831+
795832
AzureRmProfile CreateMultipleContextProfile()
796833
{
797834
var profile = new AzureRmProfile();

‎src/Accounts/Accounts.Test/SessionRecords/Microsoft.Azure.Commands.Profile.Test.SubscriptionCmdletTests/GetSubscriptionsAfterContextRenameAndSet.json‎

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
{
2+
"Entries": [
3+
{
4+
"RequestUri": "/tenants?api-version=2021-01-01",
5+
"EncodedRequestUri": "L3RlbmFudHM/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==",
6+
"RequestMethod": "GET",
7+
"RequestBody": "",
8+
"RequestHeaders": {
9+
"x-ms-client-request-id": [
10+
"8d43ac0a-3efd-447f-bc3e-c55c24b26d05"
11+
],
12+
"Accept-Language": [
13+
"en-US"
14+
],
15+
"User-Agent": [
16+
"FxVersion/4.6.28207.03",
17+
"OSName/Windows",
18+
"OSVersion/Microsoft.Windows.10.0.22000.",
19+
"Microsoft.Azure.Management.ResourceManager.Version2021.01.01.SubscriptionClient/1.3.53"
20+
]
21+
},
22+
"ResponseHeaders": {
23+
"Cache-Control": [
24+
"no-cache"
25+
],
26+
"Pragma": [
27+
"no-cache"
28+
],
29+
"x-ms-ratelimit-remaining-tenant-reads": [
30+
"11998"
31+
],
32+
"x-ms-request-id": [
33+
"ba026bf5-402f-4498-9473-04638da0cd01"
34+
],
35+
"x-ms-correlation-request-id": [
36+
"ba026bf5-402f-4498-9473-04638da0cd01"
37+
],
38+
"x-ms-routing-request-id": [
39+
"SOUTHEASTASIA:20211124T091556Z:ba026bf5-402f-4498-9473-04638da0cd01"
40+
],
41+
"Strict-Transport-Security": [
42+
"max-age=31536000; includeSubDomains"
43+
],
44+
"X-Content-Type-Options": [
45+
"nosniff"
46+
],
47+
"Date": [
48+
"Wed, 24 Nov 2021 09:15:55 GMT"
49+
],
50+
"Content-Type": [
51+
"application/json; charset=utf-8"
52+
],
53+
"Expires": [
54+
"-1"
55+
],
56+
"Content-Length": [
57+
"140"
58+
]
59+
},
60+
"ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/tenants/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a\",\r\n \"tenantId\": \"54826b22-38d6-4fb2-bad9-b7b93a3e9c5a\",\r\n \"tenantCategory\": \"Home\"\r\n }\r\n ]\r\n}",
61+
"StatusCode": 200
62+
},
63+
{
64+
"RequestUri": "/tenants?api-version=2021-01-01",
65+
"EncodedRequestUri": "L3RlbmFudHM/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==",
66+
"RequestMethod": "GET",
67+
"RequestBody": "",
68+
"RequestHeaders": {
69+
"x-ms-client-request-id": [
70+
"10c2752e-0e68-4ad2-ba4c-cd295d89d3d7"
71+
],
72+
"Accept-Language": [
73+
"en-US"
74+
],
75+
"User-Agent": [
76+
"FxVersion/4.6.28207.03",
77+
"OSName/Windows",
78+
"OSVersion/Microsoft.Windows.10.0.22000.",
79+
"Microsoft.Azure.Management.ResourceManager.Version2021.01.01.SubscriptionClient/1.3.53"
80+
]
81+
},
82+
"ResponseHeaders": {
83+
"Cache-Control": [
84+
"no-cache"
85+
],
86+
"Pragma": [
87+
"no-cache"
88+
],
89+
"x-ms-ratelimit-remaining-tenant-reads": [
90+
"11998"
91+
],
92+
"x-ms-request-id": [
93+
"06c9f7c2-d452-4d99-841a-2ad4a7cf4948"
94+
],
95+
"x-ms-correlation-request-id": [
96+
"06c9f7c2-d452-4d99-841a-2ad4a7cf4948"
97+
],
98+
"x-ms-routing-request-id": [
99+
"SOUTHEASTASIA:20211124T091557Z:06c9f7c2-d452-4d99-841a-2ad4a7cf4948"
100+
],
101+
"Strict-Transport-Security": [
102+
"max-age=31536000; includeSubDomains"
103+
],
104+
"X-Content-Type-Options": [
105+
"nosniff"
106+
],
107+
"Date": [
108+
"Wed, 24 Nov 2021 09:15:56 GMT"
109+
],
110+
"Content-Type": [
111+
"application/json; charset=utf-8"
112+
],
113+
"Expires": [
114+
"-1"
115+
],
116+
"Content-Length": [
117+
"140"
118+
]
119+
},
120+
"ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/tenants/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a\",\r\n \"tenantId\": \"54826b22-38d6-4fb2-bad9-b7b93a3e9c5a\",\r\n \"tenantCategory\": \"Home\"\r\n }\r\n ]\r\n}",
121+
"StatusCode": 200
122+
},
123+
{
124+
"RequestUri": "/subscriptions?api-version=2021-01-01",
125+
"EncodedRequestUri": "L3N1YnNjcmlwdGlvbnM/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==",
126+
"RequestMethod": "GET",
127+
"RequestBody": "",
128+
"RequestHeaders": {
129+
"x-ms-client-request-id": [
130+
"8d43ac0a-3efd-447f-bc3e-c55c24b26d05"
131+
],
132+
"Accept-Language": [
133+
"en-US"
134+
],
135+
"User-Agent": [
136+
"FxVersion/4.6.28207.03",
137+
"OSName/Windows",
138+
"OSVersion/Microsoft.Windows.10.0.22000.",
139+
"Microsoft.Azure.Management.ResourceManager.Version2021.01.01.SubscriptionClient/1.3.53"
140+
]
141+
},
142+
"ResponseHeaders": {
143+
"Cache-Control": [
144+
"no-cache"
145+
],
146+
"Pragma": [
147+
"no-cache"
148+
],
149+
"x-ms-ratelimit-remaining-tenant-reads": [
150+
"11999"
151+
],
152+
"x-ms-request-id": [
153+
"3f4e2063-6e65-4009-b5cf-5b29d0f85cca"
154+
],
155+
"x-ms-correlation-request-id": [
156+
"3f4e2063-6e65-4009-b5cf-5b29d0f85cca"
157+
],
158+
"x-ms-routing-request-id": [
159+
"SOUTHEASTASIA:20211124T091556Z:3f4e2063-6e65-4009-b5cf-5b29d0f85cca"
160+
],
161+
"Strict-Transport-Security": [
162+
"max-age=31536000; includeSubDomains"
163+
],
164+
"X-Content-Type-Options": [
165+
"nosniff"
166+
],
167+
"Date": [
168+
"Wed, 24 Nov 2021 09:15:56 GMT"
169+
],
170+
"Content-Type": [
171+
"application/json; charset=utf-8"
172+
],
173+
"Expires": [
174+
"-1"
175+
],
176+
"Content-Length": [
177+
"500"
178+
]
179+
},
180+
"ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590\",\r\n \"authorizationSource\": \"RoleBased\",\r\n \"managedByTenants\": [\r\n {\r\n \"tenantId\": \"2f4a9838-26b7-47ee-be60-ccc1fdec5953\"\r\n }\r\n ],\r\n \"tags\": {},\r\n \"subscriptionId\": \"0b1f6471-1bf0-4dda-aec3-cb9272f09590\",\r\n \"tenantId\": \"54826b22-38d6-4fb2-bad9-b7b93a3e9c5a\",\r\n \"displayName\": \"AzureSDKTest\",\r\n \"state\": \"Enabled\",\r\n \"subscriptionPolicies\": {\r\n \"locationPlacementId\": \"Internal_2014-09-01\",\r\n \"quotaId\": \"Internal_2014-09-01\",\r\n \"spendingLimit\": \"Off\"\r\n }\r\n }\r\n ],\r\n \"count\": {\r\n \"type\": \"Total\",\r\n \"value\": 1\r\n }\r\n}",
181+
"StatusCode": 200
182+
},
183+
{
184+
"RequestUri": "/subscriptions?api-version=2021-01-01",
185+
"EncodedRequestUri": "L3N1YnNjcmlwdGlvbnM/YXBpLXZlcnNpb249MjAyMS0wMS0wMQ==",
186+
"RequestMethod": "GET",
187+
"RequestBody": "",
188+
"RequestHeaders": {
189+
"x-ms-client-request-id": [
190+
"10c2752e-0e68-4ad2-ba4c-cd295d89d3d7"
191+
],
192+
"Accept-Language": [
193+
"en-US"
194+
],
195+
"User-Agent": [
196+
"FxVersion/4.6.28207.03",
197+
"OSName/Windows",
198+
"OSVersion/Microsoft.Windows.10.0.22000.",
199+
"Microsoft.Azure.Management.ResourceManager.Version2021.01.01.SubscriptionClient/1.3.53"
200+
]
201+
},
202+
"ResponseHeaders": {
203+
"Cache-Control": [
204+
"no-cache"
205+
],
206+
"Pragma": [
207+
"no-cache"
208+
],
209+
"x-ms-ratelimit-remaining-tenant-reads": [
210+
"11998"
211+
],
212+
"x-ms-request-id": [
213+
"e64b3b70-a911-42d0-85d3-55cb35a791fd"
214+
],
215+
"x-ms-correlation-request-id": [
216+
"e64b3b70-a911-42d0-85d3-55cb35a791fd"
217+
],
218+
"x-ms-routing-request-id": [
219+
"SOUTHEASTASIA:20211124T091557Z:e64b3b70-a911-42d0-85d3-55cb35a791fd"
220+
],
221+
"Strict-Transport-Security": [
222+
"max-age=31536000; includeSubDomains"
223+
],
224+
"X-Content-Type-Options": [
225+
"nosniff"
226+
],
227+
"Date": [
228+
"Wed, 24 Nov 2021 09:15:57 GMT"
229+
],
230+
"Content-Type": [
231+
"application/json; charset=utf-8"
232+
],
233+
"Expires": [
234+
"-1"
235+
],
236+
"Content-Length": [
237+
"500"
238+
]
239+
},
240+
"ResponseBody": "{\r\n \"value\": [\r\n {\r\n \"id\": \"/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590\",\r\n \"authorizationSource\": \"RoleBased\",\r\n \"managedByTenants\": [\r\n {\r\n \"tenantId\": \"2f4a9838-26b7-47ee-be60-ccc1fdec5953\"\r\n }\r\n ],\r\n \"tags\": {},\r\n \"subscriptionId\": \"0b1f6471-1bf0-4dda-aec3-cb9272f09590\",\r\n \"tenantId\": \"54826b22-38d6-4fb2-bad9-b7b93a3e9c5a\",\r\n \"displayName\": \"AzureSDKTest\",\r\n \"state\": \"Enabled\",\r\n \"subscriptionPolicies\": {\r\n \"locationPlacementId\": \"Internal_2014-09-01\",\r\n \"quotaId\": \"Internal_2014-09-01\",\r\n \"spendingLimit\": \"Off\"\r\n }\r\n }\r\n ],\r\n \"count\": {\r\n \"type\": \"Total\",\r\n \"value\": 1\r\n }\r\n}",
241+
"StatusCode": 200
242+
}
243+
],
244+
"Names": {},
245+
"Variables": {
246+
"SubscriptionId": "0b1f6471-1bf0-4dda-aec3-cb9272f09590"
247+
}
248+
}

‎src/Accounts/Accounts.Test/SubscriptionCmdletTests.cs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,5 +59,12 @@ public void GetSubscriptionsWithTags()
5959
{
6060
TestRunner.RunTestScript("Test-GetSubscriptionsWithTags");
6161
}
62+
63+
[Fact]
64+
[Trait(Category.AcceptanceType, Category.CheckIn)]
65+
public void GetSubscriptionsAfterContextRenameAndSet()
66+
{
67+
TestRunner.RunTestScript("Test-GetSubscriptionsAfterContextRenameAndSet");
68+
}
6269
}
6370
}

‎src/Accounts/Accounts.Test/SubscriptionCmdletTests.ps1‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,3 +133,24 @@ function Test-GetSubscriptionsWithTags
133133
$allSubscriptions = Get-AzSubscription
134134
Assert-True {($allSubscriptions | Where-Object { $_.Tags -ne $null}).Count -gt 0}
135135
}
136+
137+
<#
138+
.SYNOPSIS
139+
Tests whether subscripitions before and after context rename and set are equal.
140+
.DESCRIPTION
141+
SmokeTest
142+
#>
143+
function Test-GetSubscriptionsAfterContextRenameAndSet
144+
{
145+
$subscriptionExp = Get-AzSubscription
146+
147+
$contextWithOutSecret = Get-AzContext
148+
Assert-False {$contextWithOutSecret.Account.ExtendedProperties.Keys -Contains 'ServicePrincipalSecret'}
149+
$newContextName = "ContextWithoutSecret"
150+
Set-AzContext -Context $contextWithOutSecret -Name $newContextName
151+
Assert-AreEqual $newContextName (Get-AzContext).Name
152+
Assert-False {(Get-AzContext).Account.ExtendedProperties.Keys -Contains 'ServicePrincipalSecret'}
153+
154+
$subscriptionActual = Get-AzSubscription
155+
Assert-AreEqualObjectProperties $subscriptionExp $subscriptionActual
156+
}

‎src/Accounts/Accounts/Accounts.format.ps1xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -269,7 +269,7 @@
269269
</ListItem>
270270
<ListItem>
271271
<Label>ExtendedProperties</Label>
272-
<ScriptBlock>$_.ExtendedProperties.GetEnumerator() | Where-Object { $_.Key -ne "ServicePrincipalSecret" }</ScriptBlock>
272+
<ScriptBlock>$_.ExtendedProperties.GetEnumerator()</ScriptBlock>
273273
</ListItem>
274274
</ListItems>
275275
</ListEntry>

‎src/Accounts/Accounts/ChangeLog.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Removed `ServicePrincipalSecret` and `CertificatePassword` in `PSAzureRmAccount` [#15427]
2223
* Added optional parameter `MicrosoftGraphAccessToken` to `Connect-AzAccount`
2324
* Added optional parameters `MicrosoftGraphEndpointResourceId`, `MicrosoftGraphUrl` to `Add-AzEnvironment` and `Set-AzEnvironment`
2425
* Added `-AccountId` property to `UserWithSubscriptionId` parameter set of `Connect-AzAccount` which allows a user name to be pre-selected for interactive logins

‎src/Accounts/Authentication.ResourceManager/AzureRmProfile.cs‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -488,11 +488,24 @@ public bool TryRenameContext(string sourceName, string targetName)
488488
return result;
489489
}
490490

491+
/// <summary>
492+
/// Add the input context with the specified name.
493+
/// If the context with the same tenant, subscription, accountId does not exist, add the input into context list.
494+
/// If the context with the same tenant, subscription, accountId already exist, merge 2 contexes and add the merged context to the context list.
495+
/// </summary>
496+
/// <param name="name">The specified new name of the context.</param>
497+
/// <param name="context">The new context to set as default.</param>
491498
public bool TrySetContext(string name, IAzureContext context)
492499
{
493500
bool result = false;
494501
if (Contexts != null)
495502
{
503+
if (TryFindContext(context, out string oldName))
504+
{
505+
var oldContext = Contexts[oldName].DeepCopy();
506+
oldContext.Update(context);
507+
context = oldContext;
508+
}
496509
Contexts[name] = context;
497510
result = true;
498511
}
@@ -528,6 +541,13 @@ public bool TrySetDefaultContext(string name)
528541
return result;
529542
}
530543

544+
/// <summary>
545+
/// Set the default context with the input context.
546+
/// If the context with the same name does not exist, add the input into context list and set as default.
547+
/// If the context with the same name already exist, update the attributes with the same names and add the missing attributes.
548+
/// </summary>
549+
/// <param name="context">The new context to set as default.</param>
550+
531551
public bool TrySetDefaultContext(IAzureContext context)
532552
{
533553
bool result = false;

0 commit comments

Comments
 (0)