Skip to content

Commit

Permalink
[Synapse] Update swagger to aa19725fe79aea2a9dc580f3c66f77f89cc34563,…
Browse files Browse the repository at this point in the history
… bump to newest AccessControl API, add new Artifacts.Library API (#18343)

- There is work here porting the existing AccessControl tests to the new API but I've also [Ignore]'ed the test.
- The new API won't allow ID reuse for a month, and that's playing havoc w\ the recording system so far.
  • Loading branch information
chamons authored Feb 5, 2021
1 parent b9848cd commit c8e73e1
Show file tree
Hide file tree
Showing 77 changed files with 5,012 additions and 1,561 deletions.
45 changes: 26 additions & 19 deletions sdk/synapse/Azure.Analytics.Synapse.AccessControl/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,9 @@ az synapse workspace create \
```

### Authenticate the client
In order to interact with the Azure Synapse Analytics service, you'll need to create an instance of the [AccessControlClient](https://github.com/Azure/azure-sdk-for-net/blob/master/sdk/synapse/Azure.Analytics.Synapse.AccessControl/src/Customization/AccessControlClient.cs) class. You need a **workspace endpoint**, which you may see as "Development endpoint" in the portal,
and **client secret credentials (client id, client secret, tenant id)** to instantiate a client object.
In order to interact with the Azure Synapse Analytics service, you'll need to create an instance of a [RoleAssignmentsClient](https://github.com/Azure/azure-sdk-for-net/blob/master/sdk/synapse/Azure.Analytics.Synapse.AccessControl/src/Customization/RoleAssignmentsClient.cs) and/or a [RoleDefinitionsClient](https://github.com/Azure/azure-sdk-for-net/blob/master/sdk/synapse/Azure.Analytics.Synapse.AccessControl/src/Customization/RoleDefinitionsClient.cs) class.

You will also need a **workspace endpoint**, which you may see as "Development endpoint" in the portal, and **client secret credentials (client id, client secret, tenant id)** to instantiate a client object.

Client secret credential authentication is being used in this getting started section but you can find more ways to authenticate with [Azure identity](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity). To use the [DefaultAzureCredential](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity#defaultazurecredential) provider shown below,
or other credential providers provided with the Azure SDK, you should install the Azure.Identity package:
Expand All @@ -49,8 +50,9 @@ Install-Package Azure.Identity

## Key concepts

### AccessControlClient
With a `AccessControlClient` you can get role assignments from the workspace, create new role assignments, and delete role assignments.
### RoleAssignmentsClient & RoleDefinitionsClient

With a `RoleAssignmentsClient` you can create, update, and delete role assignments. With a `RoleDefinitionsClient` you can get role assignments from the workspace.

### Role Assignment
The way you control access to Synapse resources is to create role assignments. A role assignment is the process of attaching a role definition to a user, group, service principal, or managed identity at a particular scope for the purpose of granting access. Access is granted by creating a role assignment, and access is revoked by removing a role assignment.
Expand All @@ -67,33 +69,38 @@ The Azure.Analytics.Synapse.AccessControl package supports synchronous and async

### Create access control client

To interact with Azure Synapse, you need to instantiate a `AccessControlClient`. It requires an endpoint URL and a `TokenCredential`.
To interact with Azure Synapse, you need to instantiate a `RoleAssignmentsClient` and a `RoleDefinitionsClient`. It requires an endpoint URL and a `TokenCredential`.

```C# Snippet:CreateAccessControlClient
// Replace the string below with your actual endpoint url.
string endpoint = "<my-endpoint-url>";

AccessControlClient client = new AccessControlClient(new Uri(endpoint), new DefaultAzureCredential());
RoleAssignmentsClient roleAssignmentsClient = new RoleAssignmentsClient(new Uri(endpoint), new DefaultAzureCredential());
RoleDefinitionsClient definitionsClient = new RoleDefinitionsClient(new Uri(endpoint), new DefaultAzureCredential());
```

### Create a role assignment

First, you need to the determine the ID of the role you wish to assign, along with the ID of the principal you wish to assign that role.

```C# Snippet:PrepCreateRoleAssignment
Pageable<SynapseRole> roles = client.GetRoleDefinitions();
SynapseRole role = roles.Single(role => role.Name == "Workspace Admin");
string roleID = role.Id;
Response<IReadOnlyList<SynapseRoleDefinition>> roles = definitionsClient.ListRoleDefinitions();
SynapseRoleDefinition role = roles.Value.Single(role => role.Name == "Workspace Admin");
Guid roleId = role.Id.Value;

string assignedScope = "workspaces/<my-workspace-name>";

// Replace the string below with the ID you'd like to assign the role.
string principalId = "<my-principal-id>";
Guid principalId = Guid.Parse("<my-principal-id>");

// Replace the string below with the ID of the assignment you'd like to use.
string assignmentId = "<my-assignment-id>";
```

Then create an instance of `RoleAssignmentOptions` with the requested values. Finally call `CreateRoleAssignment` with the options to create the role assignment.
Then call `CreateRoleAssignment` with the options to create the role assignment.

```C# Snippet:CreateRoleAssignment
RoleAssignmentOptions request = new RoleAssignmentOptions(roleID, principalId);
Response<RoleAssignmentDetails> response = client.CreateRoleAssignment(request);
Response<RoleAssignmentDetails> response = roleAssignmentsClient.CreateRoleAssignment (assignmentId, roleId, principalId, assignedScope);
RoleAssignmentDetails roleAssignmentAdded = response.Value;
```

Expand All @@ -102,17 +109,17 @@ RoleAssignmentDetails roleAssignmentAdded = response.Value;
You can retrieve the details of a role assignment by calling `GetRoleAssignmentById`, passing in the assignment ID.

```C# Snippet:RetrieveRoleAssignment
RoleAssignmentDetails roleAssignment = client.GetRoleAssignmentById(roleAssignmentAdded.Id);
Console.WriteLine($"Role {roleAssignment.RoleId} is assigned to {roleAssignment.PrincipalId}.");
RoleAssignmentDetails roleAssignment = roleAssignmentsClient.GetRoleAssignmentById(roleAssignmentAdded.Id);
Console.WriteLine($"Role {roleAssignment.RoleDefinitionId} is assigned to {roleAssignment.PrincipalId}.");
```

### List role assignments

To enumerate all role assignments in the Synapse workspace you can call `GetRoleAssignments`.
To enumerate all role assignments in the Synapse workspace you can call `ListRoleDefinitions`.

```C# Snippet:ListRoleAssignments
Response<IReadOnlyList<RoleAssignmentDetails>> roleAssignments = client.GetRoleAssignments();
foreach (RoleAssignmentDetails assignment in roleAssignments.Value)
Response<IReadOnlyList<SynapseRoleDefinition>> roleAssignments = definitionsClient.ListRoleDefinitions();
foreach (SynapseRoleDefinition assignment in roleAssignments.Value)
{
Console.WriteLine(assignment.Id);
}
Expand All @@ -123,7 +130,7 @@ foreach (RoleAssignmentDetails assignment in roleAssignments.Value)
To delete a role assignment no longer needed you can call `DeleteRoleAssignmentById`, passing in the assignment ID.

```C# Snippet:DeleteRoleAssignment
client.DeleteRoleAssignmentById(roleAssignment.Id);
roleAssignmentsClient.DeleteRoleAssignmentById(roleAssignment.Id);
```

## To build
Expand Down
Loading

0 comments on commit c8e73e1

Please sign in to comment.