[AAD] `az ad ds create/update/list/show/delete`: Support DomainService by evelyn-ys · Pull Request #2842 · Azure/azure-cli-extensions

Yishi Wang (evelyn-ys) · 2020-12-28T09:23:31Z

New command module: az ad ds support management for AAD.DomainService
Commands:

az ad ds create
az ad ds update
az ad ds list
az ad ds show
az ad ds delete

reference: AAD RP Speclet

This checklist is used to make sure that common guidelines for a pull request are followed.

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally?

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your PR is merged into master branch, a new PR will be created to update src/index.json automatically.
The precondition is to put your code inside this repo and upgrade the version in the PR but do not modify src/index.json.

Yong Zhang (yonzhan) · 2020-12-28T09:36:52Z

AAD

Jiashuo Li (jiasli) · 2021-01-05T03:00:32Z

+az ad ds create --domain "TestDomainService.com" --ntlm-v1 "Enabled" --sync-ntlm-passwords "Enabled" \
+    --tls-v1 "Disabled" --filtered-sync "Enabled" --external-access "Enabled" --ldaps "Enabled" \
+    --pfx-certificate "MIIDPDCCAiSgAwIBAgIQQUI9P6tq2p9OFIJa7DLNvTANBgkqhkiG9w0BAQsFADAgMR4w..." \
+    --pfx-certificate-password "<pfxCertificatePassword>" \
+    --additional-recipients "jicha@microsoft.com" "caalmont@microsoft.com" --notify-dc-admins "Enabled" \
+    --notify-global-admins "Enabled" \
+    --replica-sets location="West US" subnet-id="/subscriptions/1639790a-76a2-4ac4-98d9-8562f5dfcb4d/resourceGroups/TestNetworkResourceGroup/providers/Microsoft.Network/virtualNetworks/TestVnetWUS/subnets/TestSubnetWUS" \
+    --name "TestDomainService.com" --resource-group "TestResourceGroup" 


Same as #2817 (comment)

Backward slash \ is only supported by Linux Bash, we usually don't include \ in examples.

However, you can break lines without \ and add a comment to tell the user line breaks are added for legibility only, like

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-authorization-code

// Line breaks for legibility only https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize? client_id=6731de76-14a6-49ae-97bc-6eba6914391e &response_type=code &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F &response_mode=query &scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read &state=12345 &code_challenge=YTFjNjI1OWYzMzA3MTI4ZDY2Njg5M2RkNmVjNDE5YmEyZGRhOGYyM2IzNjdmZWFhMTQ1ODg3NDcxY2Nl &code_challenge_method=S256

So this command can be written as

az ad ds create --domain "TestDomainService.com" --ntlm-v1 "Enabled" --sync-ntlm-passwords "Enabled" --tls-v1 "Disabled" --filtered-sync "Enabled" --external-access "Enabled" --ldaps "Enabled" ...

Auto-generated by CodeGen

Jiashuo Li (jiasli) · 2021-01-05T03:01:40Z

+```
+
+### Included Features ###
+#### ad ds ####


We can explain what ds is.

Auto-generated by CodeGen

Jiashuo Li (jiasli) · 2021-01-05T03:04:45Z

+helps['ad ds'] = """
+    type: group
+    short-summary: Manage domain service with ad
+"""


These are redundant indents, against CLI convention, like

https://github.com/Azure/azure-cli/blob/84e0e45de5f99936ca5b933493fd6234dbf648ae/src/azure-cli/azure/cli/command_modules/vm/_help.py#L65-L73

helps['disk delete'] = """ type: command short-summary: Delete a managed disk. examples: - name: Delete a managed disk. (autogenerated) text: | az disk delete --name MyManagedDisk --resource-group MyResourceGroup crafted: true """

Suggested change

helps['ad ds'] = """

type: group

short-summary: Manage domain service with ad

"""

helps['ad ds'] = """

type: group

short-summary: Manage domain service with ad

"""

Auto-generated by CodeGen

Refined in manual/_help.py

Jiashuo Li (jiasli) · 2021-01-05T03:05:16Z

+
+helps['ad ds'] = """
+    type: group
+    short-summary: Manage domain service with ad


The short-summary should usually ends with a period (.), like

https://github.com/Azure/azure-cli/blob/84e0e45de5f99936ca5b933493fd6234dbf648ae/src/azure-cli/azure/cli/command_modules/vm/_help.py#L67

short-summary: Delete a managed disk.

Auto-generated by CodeGen

the description is not easy to understand with ad.

Refined in manual/_help.py

Jiashuo Li (jiasli) · 2021-01-05T03:12:43Z

+FAILED = "failed"
+
+
+def try_manual(func):


The meaning of this try_manual is unclear to me as someone who is not familiar with the code. Also, shouldn't it be a general method that appears in the centralized test framework, instead of individual modules/extensions?

Auto-generated by CodeGen aimed to use manual code overwrite generated code

Jiashuo Li (jiasli) · 2021-01-05T03:15:44Z

+KEY_VNET_NIC = 'nic'
+
+
+class VirtualNetworkPreparer(NoTrafficRecordingPreparer, SingleValueReplacer):


Not used? I can't seem to find any usage of VirtualNetworkPreparer.

Auto-generated by CodeGen. I didn't use it but keep it because it will always be generated. No need to delete every time.

changlong-liu could we remove these preparer and import from azure cli core module?

yes Zunli Hu (@Juliehzl) , we are refactoring the test preparers codegen.

Hi Yishi Wang (@evelyn-ys) , In latest autorest.az the preparers.py is supposed to be generated only when has some reference for it. Please help to send me the swagger branch to have further check if it generated even have no usage.

changlong-liu Hope this stable swagger can help

Zunli Hu (Juliehzl)

Current az ad command group has description Manage Azure Active Directory Graph entities needed for Role Based Access Control. It seems that your command group is not for az ad from the description.

Zunli Hu (Juliehzl) · 2021-01-15T03:48:17Z

@@ -0,0 +1,3 @@
+{
+    "azext.minCliCoreVersion": "2.15.0"


not in preview or experimental?

az ad is stable. az ad ds is marked as preview in command.py

Zunli Hu (Juliehzl) · 2021-01-15T03:51:36Z

+            location: Virtual network location
+            subnet-id: The name of the virtual network that Domain Services will be deployed on. The id of the subnet \


both of them are required?

I see. You could consider add [required] in the description for them. But should the location be the location for subnet?

Yishi Wang (evelyn-ys) · 2021-01-28T05:15:46Z

Current az ad command group has description Manage Azure Active Directory Graph entities needed for Role Based Access Control. It seems that your command group is not for az ad from the description.

Refined in manual/_help.py

Yishi Wang (evelyn-ys) · 2021-02-03T06:07:07Z

Zunli Hu (@Juliehzl) I have modified according to your comments, could you pls review again? Thanks a lot!

Jiashuo Li (jiasli) · 2024-01-05T12:51:02Z

Current az ad command group has description Manage Azure Active Directory Graph entities needed for Role Based Access Control. It seems that your command group is not for az ad from the description.

Refined in manual/_help.py

Even though the help message has been updated:

azure-cli-extensions/src/ad/azext_ad/manual/_help.py

Lines 14 to 17 in 2415c3b

    
           helps['ad'] = """ 
        
           type: group 
        
           short-summary: Manage Azure Active Directory related entities and resources. 
        
           """

this design of putting az ad ds under az ds is still against the purpose of az ad which is designed to be a pure data-plane command group for calling AD Graph/Microsoft Graph. Because of this, in main Azure CLI, the global argument _subscription is ignored for az ad:

https://github.com/Azure/azure-cli/blob/e8efb791ea2f0ba5e4f172b26f75725fd8aa8079/src/azure-cli/azure/cli/command_modules/role/_params.py#L25-L26

    with self.argument_context('ad') as c:
        c.ignore('_subscription')  # hide global subscription param

However, apparently, az ad ds is a mgmt-plane command group calling Microsoft.AAD Resource Provider:

azure-cli-extensions/src/ad/azext_ad/vendored_sdks/domainservices/operations/_domain_services_operations.py

Line 118 in 2415c3b

    
           list.metadata = {'url': '/subscriptions/{subscriptionId}/providers/Microsoft.AAD/domainServices'}  # type: ignore

This means the global argument _subscription shouldn't be ignored for az ad ds.

If a specific command such as az ad ds -h is run, the core is smart enough to filter the command loader based on the command name and only load what is needed:

https://github.com/Azure/azure-cli/blob/7a4d03f077151be8fc312c9ce82febd1dda118cb/src/azure-cli-core/azure/cli/core/__init__.py#L499

            command_loaders = self.cmd_to_loader_map.get(command, None)

In such case, only azext_ad.DomainServicesResourceProviderCommandsLoader is loaded and azure.cli.command_modules.role.RoleCommandsLoader will be skipped. _subscription won't be ignored and will still appear in the in-tool help.

However, in the reference doc generation pipeline, both command loaders will be loaded. If azure.cli.command_modules.role.RoleCommandsLoader is load first, when azext_ad.DomainServicesResourceProviderCommandsLoader is loaded, _subscription will be ignored for az ad ds.

See Azure/azure-cli#27296 (comment) for details.

Bump api_version to 0.12.0 and framework_version to 0.5.0 to match the hcsshim CWCOW policy framework, and add the enforcement points introduced by PR Azure#2842. The Windows policy template now wires registry_changes, unmount_cims, host_network and load_transparency_trust_list, and emits the allow_host_network, allow_unencrypted_scratch, allow_capability_dropping and allow_registry_changes_dropping switches. The Linux policy template wires host_network and load_transparency_trust_list (newly active at api_version 0.12.0) and emits allow_host_network, which has no framework default. The fragment and sidecar templates are bumped to framework_version 0.5.0. These enforcement points have no ARM property, so they are exposed only through confcom-owned --input (-i) JSON fields, mirroring the log-provider fields: the top-level allowHostNetwork and allowRegistryChangesDropping bools, the per-container registryChanges object (passed through in the hcsshim add_values/delete_keys shape), and the top-level mappedDirectories list. mapped_directory_mount/unmount are wired only when mappedDirectories is supplied, since wiring them without backing data can only deny; an undeclared hot-add is denied by the framework either way. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Takuro Sato <takurosato@microsoft.com>

Elastic SAN volumes on Confidential ACI are bind-mounted into the workload container by the atlas mounthost from /tmp/atlas/esanVolume/<deployment>/<volume>, analogous to Azure File's /tmp/atlas/azureFileVolume/... . Register a matching "elasticSan" mount type so CCE policies accept the Elastic SAN volume mount. The type name matches the ARM/CCE volume property (Volume.ElasticSan -> "elasticSan") and the source mirrors the azureFile entry, both per Compute-ACI release/rel-20260429. Compute-ACI also places a Linux pod that mounts an Elastic SAN volume on the host network (iscsid needs the UVM init netns), so the generated policy for such a pod must allow the host_network enforcement point (added in Azure#2842). Detect the elasticSan mount type and force allow_host_network on for Linux policies, leaving the flag at its default False otherwise. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Takuro Sato <takurosato@microsoft.com>

Bump api_version to 0.12.0 and framework_version to 0.5.0 to match the hcsshim CWCOW policy framework, and add the enforcement points introduced by PR Azure#2842. The Windows policy template now wires registry_changes, unmount_cims, host_network and load_transparency_trust_list, and emits the allow_host_network, allow_unencrypted_scratch, allow_capability_dropping and allow_registry_changes_dropping switches. The Linux policy template wires host_network and load_transparency_trust_list (newly active at api_version 0.12.0) and emits allow_host_network, which has no framework default. The fragment and sidecar templates are bumped to framework_version 0.5.0. These enforcement points have no ARM property, so they are exposed only through confcom-owned --input (-i) JSON fields, mirroring the log-provider fields: the top-level allowHostNetwork and allowRegistryChangesDropping bools, the per-container registryChanges object (passed through in the hcsshim add_values/delete_keys shape), and the top-level mappedDirectories list. mapped_directory_mount/unmount are wired only when mappedDirectories is supplied, since wiring them without backing data can only deny; an undeclared hot-add is denied by the framework either way. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Takuro Sato <takurosato@microsoft.com>

Elastic SAN volumes on Confidential ACI are bind-mounted into the workload container by the atlas mounthost from /tmp/atlas/esanVolume/<deployment>/<volume>, analogous to Azure File's /tmp/atlas/azureFileVolume/... . Register a matching "elasticSan" mount type so CCE policies accept the Elastic SAN volume mount. The type name matches the ARM/CCE volume property (Volume.ElasticSan -> "elasticSan") and the source mirrors the azureFile entry, both per Compute-ACI release/rel-20260429. Compute-ACI also places a Linux pod that mounts an Elastic SAN volume on the host network (iscsid needs the UVM init netns), so the generated policy for such a pod must allow the host_network enforcement point (added in Azure#2842). Detect the elasticSan mount type and force allow_host_network on for Linux policies, leaving the flag at its default False otherwise. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Takuro Sato <takurosato@microsoft.com>

Yishi Wang (evelyn-ys) added 5 commits December 23, 2020 18:03

domain service

8963fc5

fix tests

d16a8c1

linter

9d75f47

test check

2c376df

tests recorded

b5cb147

Yishi Wang (evelyn-ys) self-assigned this Dec 28, 2020

Yishi Wang (evelyn-ys) requested review from Zunli Hu (Juliehzl), Jiashuo Li (jiasli) and Yu Chen (jsntcy) December 28, 2020 09:24

add codeowner

dedb6c0

Yong Zhang (yonzhan) added this to the S180 milestone Dec 28, 2020

Yishi Wang (evelyn-ys) changed the title ~~[AAD] DomainService support~~ [AAD] az ad ds create/update/list/show/delete: Support DomainService Dec 28, 2020

Yishi Wang (evelyn-ys) added 2 commits January 4, 2021 10:08

Merge branch 'master' into domainservice

29615b6

code owner

84537e4

Jiashuo Li (jiasli) reviewed Jan 5, 2021

View reviewed changes

Merge branch 'master' into domainservice

9811af7

Yong Zhang (yonzhan) modified the milestones: S180, S181 Jan 6, 2021

Zunli Hu (Juliehzl) reviewed Jan 15, 2021

View reviewed changes

Comment thread src/ad/azext_ad/generated/_help.py

Zunli Hu (Juliehzl) reviewed Jan 15, 2021

View reviewed changes

Comment thread src/ad/azext_ad/generated/_help.py

Zunli Hu (Juliehzl) reviewed Jan 15, 2021

View reviewed changes

Comment thread src/ad/azext_ad/generated/_help.py

Zunli Hu (Juliehzl) reviewed Jan 15, 2021

View reviewed changes

Comment thread src/ad/azext_ad/generated/_help.py

resolve conflicts

0f1e0d1

Yong Zhang (yonzhan) modified the milestones: S181, S182 Jan 26, 2021

Yishi Wang (evelyn-ys) added 4 commits January 27, 2021 13:44

refine help

2d41ffb

linter

18e7598

change complicated param to json

bab6639

json format

b9e75f2

Yishi Wang (evelyn-ys) requested a review from Zunli Hu (Juliehzl) January 28, 2021 05:19

Zunli Hu (Juliehzl) reviewed Feb 3, 2021

View reviewed changes

Comment thread src/ad/azext_ad/manual/custom.py Outdated

Zunli Hu (Juliehzl) reviewed Feb 3, 2021

View reviewed changes

Comment thread src/ad/azext_ad/tests/latest/test_ad_scenario.py

Yishi Wang (evelyn-ys) added 2 commits February 4, 2021 10:39

add validators

3f4355a

linter

6294971

Zunli Hu (Juliehzl) approved these changes Feb 4, 2021

View reviewed changes

Yishi Wang (evelyn-ys) merged commit 2415c3b into Azure:master Feb 4, 2021

Jiashuo Li (jiasli) mentioned this pull request Mar 17, 2025

{Microsoft Entra ID} az ad: Ignore global --subscription in subgroups Azure/azure-cli#31029

Merged

Takuro Sato (takuro-sato) mentioned this pull request Sep 10, 2026

confcom: C-WCOW enforcement-point support, Elastic SAN mounts, and package/versioning updates #10273

Open

4 tasks

		KEY_VNET_NIC = 'nic'


		class VirtualNetworkPreparer(NoTrafficRecordingPreparer, SingleValueReplacer):

		location: Virtual network location
		subnet-id: The name of the virtual network that Domain Services will be deployed on. The id of the subnet \

		FAILED = "failed"


		def try_manual(func):

Conversation

Yishi Wang (evelyn-ys) commented Dec 28, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

General Guidelines

About Extension Publish

Uh oh!

Yong Zhang (yonzhan) commented Dec 28, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jiashuo Li (jiasli) Jan 5, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jiashuo Li (jiasli) Jan 5, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jiashuo Li (jiasli) Jan 5, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Yishi Wang (evelyn-ys) Jan 5, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Zunli Hu (Juliehzl) left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Zunli Hu (Juliehzl) Feb 3, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Yishi Wang (evelyn-ys) commented Jan 28, 2021

Uh oh!

Yishi Wang (evelyn-ys) commented Feb 3, 2021

Uh oh!

Uh oh!

Uh oh!

Jiashuo Li (jiasli) commented Jan 5, 2024

Uh oh!

Reviewers

Yishi Wang (evelyn-ys) commented Dec 28, 2020 •

edited

Loading

Jiashuo Li (jiasli) Jan 5, 2021 •

edited

Loading

Jiashuo Li (jiasli) Jan 5, 2021 •

edited

Loading

Jiashuo Li (jiasli) Jan 5, 2021 •

edited

Loading

Yishi Wang (evelyn-ys) Jan 5, 2021 •

edited

Loading

Zunli Hu (Juliehzl) Feb 3, 2021 •

edited

Loading