@@ -18,15 +18,15 @@ Tests retrieval of classic administrators
1818#>
1919function Test-RaClassicAdmins
2020{
21- # Setup
22- $subscription = Get-AzureRmSubscription
23-
24- # Test
25- $classic = Get-AzureRmRoleAssignment - IncludeClassicAdministrators | Where-Object { $_.Scope -ieq (' /subscriptions/' + $subscription [0 ].Id) -and $_.RoleDefinitionName.ToLower ().Contains(' administrator'
26-
27- # Assert
28- Assert-NotNull $classic
29- Assert-True { $classic.Length -ge 1 }
21+ # Setup
22+ $subscription = Get-AzureRmSubscription
23+
24+ # Test
25+ $classic = Get-AzureRmRoleAssignment - IncludeClassicAdministrators | Where-Object { $_.Scope -ieq (' /subscriptions/' + $subscription [0 ].Id) -and $_.RoleDefinitionName.ToLower ().Contains(' administrator'
26+
27+ # Assert
28+ Assert-NotNull $classic
29+ Assert-True { $classic.Length -ge 1 }
3030}
3131
3232<#
@@ -41,11 +41,11 @@ function Test-RaNegativeScenarios
4141 # Bad OID returns zero role assignments
4242 $badOid = ' aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'
4343 $badObjectResult = " Cannot find principal using the specified options"
44- $assignments = Get-AzureRmRoleAssignment - ObjectId $badOid
44+ $assignments = Get-AzureRmRoleAssignment - ObjectId $badOid
4545 Assert-AreEqual 0 $assignments.Count
4646
47- # Bad OID throws if Expand Principal Groups included
48- Assert-Throws { Get-AzureRmRoleAssignment - ObjectId $badOid - ExpandPrincipalGroups } $badObjectResult
47+ # Bad OID throws if Expand Principal Groups included
48+ Assert-Throws { Get-AzureRmRoleAssignment - ObjectId $badOid - ExpandPrincipalGroups } $badObjectResult
4949
5050 # Bad UPN
5151@@ -110,9 +110,9 @@ function Test-RaByScope
110110
111111 # Assert
112112 Assert-NotNull $newAssignment
113- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
114- Assert-AreEqual $scope $newAssignment.Scope
115- Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
113+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
114+ Assert-AreEqual $scope $newAssignment.Scope
115+ Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
116116
117117 VerifyRoleAssignmentDeleted $newAssignment
118118}
@@ -142,8 +142,8 @@ function Test-RaByResourceGroup
142142
143143 # Assert
144144 Assert-NotNull $newAssignment
145- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
146- Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
145+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
146+ Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
147147
148148 VerifyRoleAssignmentDeleted $newAssignment
149149}
@@ -177,8 +177,8 @@ function Test-RaByResource
177177
178178 # Assert
179179 Assert-NotNull $newAssignment
180- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
181- Assert-AreEqual $groups [0 ].DisplayName $newAssignment.DisplayName
180+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
181+ Assert-AreEqual $groups [0 ].DisplayName $newAssignment.DisplayName
182182
183183 VerifyRoleAssignmentDeleted $newAssignment
184184}
@@ -261,9 +261,9 @@ function Test-RaByServicePrincipal
261261
262262 # Assert
263263 Assert-NotNull $newAssignment
264- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
265- Assert-AreEqual $scope $newAssignment.Scope
266- Assert-AreEqual $servicePrincipals [0 ].DisplayName $newAssignment.DisplayName
264+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
265+ Assert-AreEqual $scope $newAssignment.Scope
266+ Assert-AreEqual $servicePrincipals [0 ].DisplayName $newAssignment.DisplayName
267267
268268 VerifyRoleAssignmentDeleted $newAssignment
269269}
@@ -282,7 +282,7 @@ function Test-RaByUpn
282282 Assert-AreEqual 1 $resourceGroups.Count " No resource group found. Unable to run the test."
283283
284284 # Test
285- [Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient ]::RoleAssignmentNames.Enqueue(" f8dac632-b879-42f9-b4ab-df2aab22a149"
285+ [Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient ]::RoleAssignmentNames.Enqueue(" f8dac632-b879-42f9-b4ab-df2aab22a149"
286286 $newAssignment = New-AzureRmRoleAssignment `
287287 - SignInName $users [0 ].UserPrincipalName `
288288 - RoleDefinitionName $definitionName `
@@ -293,8 +293,8 @@ function Test-RaByUpn
293293
294294 # Assert
295295 Assert-NotNull $newAssignment
296- Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
297- Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
296+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
297+ Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
298298
299299 VerifyRoleAssignmentDeleted $newAssignment
300300}
@@ -305,11 +305,11 @@ function Test-RaUserPermissions
305305 param ([string ]$rgName , [string ]$action )
306306 # Test
307307 $rg = Get-AzureRmResourceGroup
308- $errorMsg = " User should have access to only 1 RG. Found: {0}" -f $rg.Count
309- Assert-AreEqual 1 $rg.Count $errorMsg
308+ $errorMsg = " User should have access to only 1 RG. Found: {0}" -f $rg.Count
309+ Assert-AreEqual 1 $rg.Count $errorMsg
310310
311- # User should not be able to create another RG as he doesnt have access to the subscription.
312- Assert-Throws { New-AzureRmResourceGroup - Name ' NewGroupFromTest' - Location ' WestUS'
311+ # User should not be able to create another RG as he doesnt have access to the subscription.
312+ Assert-Throws { New-AzureRmResourceGroup - Name ' NewGroupFromTest' - Location ' WestUS'
313313}
314314
315315<#
@@ -430,6 +430,42 @@ function Test-RaPropertiesValidation
430430 VerifyRoleAssignmentDeleted $newAssignment
431431}
432432
433+ <#
434+ . SYNOPSIS
435+ Tests verifies creation and retrieval of a RoleAssignments using delegation flag
436+ #>
437+ function Test-RaDelegation
438+ {
439+ # Setup
440+ $definitionName = ' Reader'
441+ $users = Get-AzureRmADUser | Select-Object - First 1 - Wait
442+ $subscription = Get-AzureRmSubscription
443+ $resourceGroups = Get-AzureRmResourceGroup | Select-Object - Last 1 - Wait
444+ $scope = ' /subscriptions/' + $subscription [0 ].Id + ' /resourceGroups/' + $resourceGroups [0 ].ResourceGroupName
445+ $assignmentScope = $scope + " /"
446+ Assert-AreEqual 1 $users.Count " There should be at least one user to run the test."
447+
448+ # Test
449+ [Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient ]::RoleAssignmentNames.Enqueue(" f747531e-da33-43b9-b726-04675abf1939"
450+ $newAssignment = New-AzureRmRoleAssignment `
451+ - ObjectId $users [0 ].Id.Guid `
452+ - RoleDefinitionName $definitionName `
453+ - Scope $assignmentScope `
454+ - AllowDelegation
455+
456+ # Assert
457+ Assert-NotNull $newAssignment
458+ Assert-AreEqual $definitionName $newAssignment.RoleDefinitionName
459+ Assert-AreEqual $scope $newAssignment.Scope
460+ Assert-AreEqual $users [0 ].DisplayName $newAssignment.DisplayName
461+ Assert-AreEqual $true $newAssignment.CanDelegate
462+
463+ # cleanup
464+ DeleteRoleAssignment $newAssignment
465+
466+ VerifyRoleAssignmentDeleted $newAssignment
467+ }
468+
433469<#
434470. SYNOPSIS
435471Tests verifies get of RoleAssignment by Scope
0 commit comments