Skip to content

Commit 5b22be6

Browse files
PeterfengAzPeterfengAz
authored
Enable multi-auth support when both OpenVPN and IkeV2 protocols are used (Azure#21347)
* Enable multi-auth support when both OpenVPN and IkeV2 protocols are used * Fix indentation
1 parent 829a6c5 commit 5b22be6

File tree

12 files changed

+33468
-10995
lines changed

12 files changed

+33468
-10995
lines changed

‎src/Network/Network.Test/ScenarioTests/CortexTests.ps1‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -832,6 +832,7 @@ function Test-CortexExpressRouteCRUD
832832
$VpnServerConfiguration1Name = Get-ResourceName
833833
$VpnServerConfiguration2Name = Get-ResourceName
834834
$VpnServerConfigurationMultiAuthName = Get-ResourceName
835+
$VpnServerConfiguration2MultiAuthName = Get-ResourceName
835836
$P2SVpnGatewayName = Get-ResourceName
836837
$vpnclientAuthMethod = "EAPTLS"
837838

@@ -964,11 +965,30 @@ function Test-CortexExpressRouteCRUD
964965
$authenticationTypes = $vpnServerConfigMultiAuth.VpnAuthenticationTypes
965966
Assert-AreEqual 2 @($authenticationTypes).Count
966967

967-
# List all VpnServerConfigurations under Resource group
968+
# Create the VpnServerConfiguration2MultiAuth with OpenVPN & IkeV2 and only AAD auth should throw error
969+
Assert-ThrowsContains { New-AzVpnServerConfiguration -Name $VpnServerConfiguration2MultiAuthName -ResourceGroupName $rgName -VpnProtocol OpenVPN, IkeV2 -VpnAuthenticationType AAD -AadAudience $aadAudience -AadTenant $aadTenant -AadIssuer $aadIssuer -Location $rglocation } "Since AAD is only supported for OpenVPN, please choose one additional auth type or choose only OpenVPN protocol";
970+
# check no new server configuration got created
968971
$vpnServerConfigs = Get-AzVpnServerConfiguration -ResourceGroupName $rgName
969972
Assert-NotNull $vpnServerConfigs
970973
Assert-AreEqual 3 @($vpnServerConfigs).Count
971974

975+
# Create the VpnServerConfiguration2MultiAuth with a valid configuration to be used for testing Set later
976+
# VpnProtocol is OpenVPN and auth type is AAD
977+
New-AzVpnServerConfiguration -Name $VpnServerConfiguration2MultiAuthName -ResourceGroupName $rgName -VpnProtocol OpenVPN -VpnAuthenticationType AAD -AadAudience $aadAudience -AadTenant $aadTenant -AadIssuer $aadIssuer -Location $rglocation
978+
$vpnServerConfig2MultiAuth = Get-AzVpnServerConfiguration -ResourceGroupName $rgName -Name $VpnServerConfiguration2MultiAuthName
979+
Assert-AreEqual "Succeeded" $vpnServerConfig2MultiAuth.ProvisioningState
980+
Assert-AreEqual $aadAudience $vpnServerConfig2MultiAuth.AadAuthenticationParameters.AadAudience
981+
Assert-AreEqual $aadTenant $vpnServerConfig2MultiAuth.AadAuthenticationParameters.AadTenant
982+
Assert-AreEqual $aadIssuer $vpnServerConfig2MultiAuth.AadAuthenticationParameters.AadIssuer
983+
$protocols = $vpnServerConfig2MultiAuth.VpnProtocols
984+
Assert-AreEqual 1 @($protocols).Count
985+
Assert-AreEqual "OpenVPN" $protocols[0]
986+
987+
# List all VpnServerConfigurations under Resource group
988+
$vpnServerConfigs = Get-AzVpnServerConfiguration -ResourceGroupName $rgName
989+
Assert-NotNull $vpnServerConfigs
990+
Assert-AreEqual 4 @($vpnServerConfigs).Count
991+
972992
# Create a PolicyGroup2 Object
973993
$policyGroup2= New-Object -TypeName Microsoft.Azure.Commands.Network.Models.PSVpnServerConfigurationPolicyGroup
974994
$policyGroup2.Name = "PolicyGroup2"
@@ -1037,6 +1057,12 @@ function Test-CortexExpressRouteCRUD
10371057
$authenticationTypes = $vpnServerConfigMultiAuth.VpnAuthenticationTypes
10381058
Assert-AreEqual 3 @($authenticationTypes).Count
10391059

1060+
# Update existing VpnServerConfiguration2MultiAuth to use OpenVPN and IkeV2 with only AAD should fail
1061+
Assert-ThrowsContains { Update-AzVpnServerConfiguration -Name $VpnServerConfiguration2MultiAuthName -ResourceGroupName $rgName -VpnProtocol OpenVPN, IkeV2 } "Since AAD is only supported for OpenVPN, please choose one additional auth type or choose only OpenVPN protocol";
1062+
$protocols = $vpnServerConfig2MultiAuth.VpnProtocols
1063+
Assert-AreEqual 1 @($protocols).Count
1064+
Assert-AreEqual "OpenVPN" $protocols[0]
1065+
10401066
# Update existing P2SVpnGateway with new VpnClientAddressPool and CustomDnsServers using Update-AzP2sVpnGateway
10411067
$vpnClientAddressSpaces[1] = "192.168.4.0/24"
10421068
$updatedP2SVpnGateway = Update-AzP2sVpnGateway -ResourceGroupName $rgName -Name $P2SvpnGatewayName -VpnClientAddressPool $vpnClientAddressSpaces -CustomDnsServer 9.9.9.9 -DisableInternetSecurityFlag
@@ -1083,6 +1109,10 @@ function Test-CortexExpressRouteCRUD
10831109
$delete = Remove-AzVpnServerConfiguration -ResourceGroupName $rgName -Name $VpnServerConfigurationMultiAuthName -Force -PassThru
10841110
Assert-AreEqual $True $delete
10851111

1112+
# Delete VpnServerConfiguration2MultiAuth
1113+
$delete = Remove-AzVpnServerConfiguration -ResourceGroupName $rgName -Name $VpnServerConfiguration2MultiAuthName -Force -PassThru
1114+
Assert-AreEqual $True $delete
1115+
10861116
$vpnServerConfigs = Get-AzVpnServerConfiguration -ResourceGroupName $rgName
10871117
Assert-NotNull $vpnServerConfigs
10881118
Assert-AreEqual 1 @($vpnServerConfigs).Count

‎src/Network/Network.Test/ScenarioTests/VirtualNetworkGatewayTests.cs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,5 +171,13 @@ public void TestVirtualNetworkGatewayPolicyGroupCRUD()
171171
{
172172
TestRunner.RunTestScript("Test-VirtualNetworkGatewayPolicyGroupCRUD");
173173
}
174+
175+
[Fact]
176+
[Trait(Category.AcceptanceType, Category.CheckIn)]
177+
[Trait(Category.Owner, NrpTeamAlias.brooklynft_subset2)]
178+
public void TestVirtualNetworkGatewayMultiAuth()
179+
{
180+
TestRunner.RunTestScript("Test-VirtualNetworkGatewayMultiAuth");
181+
}
174182
}
175183
}

‎src/Network/Network.Test/ScenarioTests/VirtualNetworkGatewayTests.ps1‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1484,4 +1484,89 @@ param
14841484
# Cleanup
14851485
Clean-ResourceGroup $rgname
14861486
}
1487+
}
1488+
1489+
<#
1490+
.SYNOPSIS
1491+
Virtual network gateway P2S multiauth test
1492+
#>
1493+
function Test-VirtualNetworkGatewayMultiAuth
1494+
{
1495+
# Setup
1496+
$rgname = Get-ResourceGroupName
1497+
$rname = Get-ResourceName
1498+
$domainNameLabel = Get-ResourceName
1499+
$vnetName = Get-ResourceName
1500+
$publicIpName = Get-ResourceName
1501+
$vnetGatewayConfigName = Get-ResourceName
1502+
$rglocation = Get-ProviderLocation ResourceManagement
1503+
$resourceTypeParent = "Microsoft.Network/virtualNetworkGateways"
1504+
$location = Get-ProviderLocation $resourceTypeParent
1505+
1506+
try
1507+
{
1508+
# Create the resource group
1509+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $rglocation -Tags @{ testtag = "testval" }
1510+
1511+
# AAD authentication configurations
1512+
$aadTenant = "https://login.microsoftonline.com/0ab2c4f4-81e6-44cc-a0b2-b3a47a1443f4"
1513+
$aadIssuer = "https://sts.windows.net/0ab2c4f4-81e6-44cc-a0b2-b3a47a1443f4/"
1514+
$aadAudience = "a21fce82-76af-45e6-8583-a08cb3b956f9"
1515+
1516+
# Create the Virtual Network
1517+
$subnet = New-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -AddressPrefix 10.0.0.0/24
1518+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet
1519+
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname
1520+
$subnet = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet
1521+
1522+
# Create the IP config
1523+
$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Dynamic -DomainNameLabel $domainNameLabel
1524+
$vnetIpConfig = New-AzVirtualNetworkGatewayIpConfig -Name $vnetGatewayConfigName -PublicIpAddress $publicip -Subnet $subnet
1525+
1526+
# Creating a P2S VPN gateway with AAD without OpenVPN protocol should throw error
1527+
Assert-ThrowsContains { New-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname -location $location -IpConfigurations $vnetIpConfig -GatewayType Vpn -VpnType RouteBased -VpnClientProtocol IkeV2 -EnableBgp $false -GatewaySku VpnGw1 -VpnClientAddressPool 201.169.0.0/16 -AadTenantUri $aadTenant -AadIssuerUri $aadIssuer -AadAudienceId $aadAudience } "Virtual Network Gateway VpnClientProtocol should contain";
1528+
1529+
# Creating a P2S VPN gateway with OpenVPN & IkeV2 with AAD auth only should throw error message
1530+
Assert-ThrowsContains { New-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname -location $location -IpConfigurations $vnetIpConfig -GatewayType Vpn -VpnType RouteBased -VpnClientProtocol "OpenVPN", "IkeV2" -EnableBgp $false -GatewaySku VpnGw1 -VpnClientAddressPool 201.169.0.0/16 -AadTenantUri $aadTenant -AadIssuerUri $aadIssuer -AadAudienceId $aadAudience } "Since AAD is only supported for OpenVPN, please choose one additional auth type or choose only OpenVPN protocol";
1531+
1532+
# Create a P2S VPN gateway with OpenVPN & AAD to be used to test Set-AzVirtualNetworkGateway
1533+
New-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname -location $location -IpConfigurations $vnetIpConfig -GatewayType Vpn -VpnType RouteBased -VpnClientProtocol OpenVPN -EnableBgp $false -GatewaySku VpnGw1 -VpnClientAddressPool 201.169.0.0/16 -AadTenantUri $aadTenant -AadIssuerUri $aadIssuer -AadAudienceId $aadAudience
1534+
$actual = Get-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname
1535+
$protocols = $actual.VpnClientConfiguration.VpnClientProtocols
1536+
Assert-AreEqual 1 @($protocols).Count
1537+
Assert-AreEqual "OpenVPN" $protocols[0]
1538+
Assert-AreEqual "201.169.0.0/16" $actual.VpnClientConfiguration.VpnClientAddressPool.AddressPrefixes
1539+
Assert-AreEqual $aadTenant $actual.VpnClientConfiguration.AadTenant
1540+
Assert-AreEqual $aadIssuer $actual.VpnClientConfiguration.AadIssuer
1541+
Assert-AreEqual $aadAudience $actual.VpnClientConfiguration.AadAudience
1542+
1543+
# Set an existing P2S VPN gateway to use AAD without OpenVPN should throw error
1544+
Assert-ThrowsContains { Set-AzVirtualNetworkGateway -VirtualNetworkGateway $actual -VpnClientProtocol IkeV2 -AadAudience $aadAudience -AadTenant $aadTenant -AadIssuer $aadIssuer } "Virtual Network Gateway VpnClientProtocol should contain";
1545+
# Check gateway protocol was not updated
1546+
$actual = Get-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname
1547+
$protocols = $actual.VpnClientConfiguration.VpnClientProtocols
1548+
Assert-AreEqual 1 @($protocols).Count
1549+
Assert-AreEqual "OpenVPN" $protocols[0]
1550+
Assert-AreEqual "201.169.0.0/16" $actual.VpnClientConfiguration.VpnClientAddressPool.AddressPrefixes
1551+
Assert-AreEqual $aadTenant $actual.VpnClientConfiguration.AadTenant
1552+
Assert-AreEqual $aadIssuer $actual.VpnClientConfiguration.AadIssuer
1553+
Assert-AreEqual $aadAudience $actual.VpnClientConfiguration.AadAudience
1554+
1555+
# Set an existing P2S VPN gateway to use OpenVPN & IkeV2 with AAD auth only should throw error message
1556+
Assert-ThrowsContains { Set-AzVirtualNetworkGateway -VirtualNetworkGateway $actual -VpnClientProtocol "OpenVPN", "IkeV2" } "Since AAD is only supported for OpenVPN, please choose one additional auth type or choose only OpenVPN protocol";
1557+
# Check gateway protocol was not updated
1558+
$actual = Get-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname
1559+
$protocols = $actual.VpnClientConfiguration.VpnClientProtocols
1560+
Assert-AreEqual 1 @($protocols).Count
1561+
Assert-AreEqual "OpenVPN" $protocols[0]
1562+
Assert-AreEqual "201.169.0.0/16" $actual.VpnClientConfiguration.VpnClientAddressPool.AddressPrefixes
1563+
Assert-AreEqual $aadTenant $actual.VpnClientConfiguration.AadTenant
1564+
Assert-AreEqual $aadIssuer $actual.VpnClientConfiguration.AadIssuer
1565+
Assert-AreEqual $aadAudience $actual.VpnClientConfiguration.AadAudience
1566+
}
1567+
finally
1568+
{
1569+
# Cleanup
1570+
Clean-ResourceGroup $rgname
1571+
}
14871572
}

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.CortexTests/TestP2SCortexCRUD.json‎

Lines changed: 26630 additions & 10985 deletions
Large diffs are not rendered by default.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.VirtualNetworkGatewayTests/TestVirtualNetworkGatewayMultiAuth.json‎

Lines changed: 6576 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/ChangeLog.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
* Updated `Reset-AzVpnGateway` to support IpConfigurationId.
3131
* Blocked some regions when creating/updating Basic Sku firewall
3232
* Fixed bugs related to auto learn IP prefixes and Snat
33+
* Updated multi-auth to be supported when both OpenVPN and IkeV2 protocols are used for VNG and VWAN VPN
3334

3435
## Version 5.5.0
3536
* Updated cmdlets to add new property of `Snat` in Azure Firewall Policy.

‎src/Network/Network/Cortex/VpnServerConfiguration/NewAzureRmVpnServerConfigurationCommand.cs‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,32 @@ public override void Execute()
162162
throw new PSArgumentException(string.Format(Properties.Resources.ResourceAlreadyPresentInResourceGroup, this.Name, this.ResourceGroupName));
163163
}
164164

165+
if (this.VpnAuthenticationType != null)
166+
{
167+
if (this.VpnAuthenticationType.Contains(MNM.VpnAuthenticationType.AAD))
168+
{
169+
if ((this.VpnProtocol == null) ||
170+
(this.VpnProtocol != null &&
171+
this.VpnProtocol.Contains(MNM.VpnClientProtocol.IkeV2) &&
172+
this.VpnProtocol.Contains(MNM.VpnClientProtocol.OpenVPN) &&
173+
this.VpnProtocol.Count() == 2))
174+
{
175+
// In the case of multi-auth with OpenVPN and IkeV2, block user from configuring with just AAD since AAD is not supported for IkeV2
176+
if (this.VpnAuthenticationType.Count() == 1)
177+
{
178+
throw new ArgumentException(Properties.Resources.VpnMultiAuthIkev2OpenvpnOnlyAad);
179+
}
180+
else if (this.VpnAuthenticationType.Count() > 1)
181+
{
182+
if (!ShouldContinue(Properties.Resources.VpnMultiAuthIkev2OpenvpnAadWarning, Properties.Resources.ConfirmMessage))
183+
{
184+
return;
185+
}
186+
}
187+
}
188+
}
189+
}
190+
165191
vpnServerConfigurationToCreate = this.CreateVpnServerConfigurationObject(
166192
vpnServerConfigurationToCreate,
167193
this.VpnProtocol,

‎src/Network/Network/Cortex/VpnServerConfiguration/UpdateAzureRmVpnServerConfigurationCommand.cs‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -458,6 +458,25 @@ public override void Execute()
458458
{
459459
vpnServerConfigurationToUpdate.AadAuthenticationParameters.AadIssuer = this.AadIssuer;
460460
}
461+
462+
if (vpnServerConfigurationToUpdate.VpnProtocols != null &&
463+
vpnServerConfigurationToUpdate.VpnProtocols.Contains(MNM.VpnClientProtocol.IkeV2) &&
464+
vpnServerConfigurationToUpdate.VpnProtocols.Contains(MNM.VpnClientProtocol.OpenVPN) &&
465+
vpnServerConfigurationToUpdate.VpnProtocols.Count() == 2)
466+
{
467+
// In the case of multi-auth with OpenVPN and IkeV2, block user from configuring with just AAD since AAD is not supported for IkeV2
468+
if (vpnServerConfigurationToUpdate.VpnAuthenticationTypes.Count() == 1)
469+
{
470+
throw new ArgumentException(Properties.Resources.VpnMultiAuthIkev2OpenvpnOnlyAad);
471+
}
472+
else if (vpnServerConfigurationToUpdate.VpnAuthenticationTypes.Count() > 1)
473+
{
474+
if (!ShouldContinue(Properties.Resources.VpnMultiAuthIkev2OpenvpnAadWarning, Properties.Resources.ConfirmMessage))
475+
{
476+
return;
477+
}
478+
}
479+
}
461480
}
462481
else
463482
{

‎src/Network/Network/Properties/Resources.Designer.cs‎

Lines changed: 28 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Network/Network/Properties/Resources.resx‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -765,4 +765,13 @@
765765
<data name="InvalidVnetLocalRouteOverrideCriteriaValue" xml:space="preserve">
766766
<value>Permitted values for VnetLocalRouteOverrideCriteria are Equal and Contains.</value>
767767
</data>
768+
<data name="VpnMultiAuthIkev2OpenvpnAadWarning" xml:space="preserve">
769+
<value>Warning: VpnClientProtocol being configured are: OpenVPN, IkeV2. AAD is one of the auth types configured. Since AAD is only supported for OpenVPN, it will only be used for OpenVPN.</value>
770+
</data>
771+
<data name="VpnMultiAuthIkev2OpenvpnOnlyAad" xml:space="preserve">
772+
<value>VpnClientProtocol being configured are : OpenVPN, IkeV2. VpnAuthenticationType being configured is AAD. Since AAD is only supported for OpenVPN, please choose one additional auth type or choose only OpenVPN protocol.</value>
773+
</data>
774+
<data name="ConfirmMessage" xml:space="preserve">
775+
<value>Confirm</value>
776+
</data>
768777
</root>

0 commit comments

Comments
 (0)