Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Synapse] Update swagger to aa19725fe79aea2a9dc580f3c66f77f89cc34563, bump to newest AccessControl API, add new Artifacts.Library API #18343

Merged
merged 14 commits into from
Feb 5, 2021
45 changes: 26 additions & 19 deletions sdk/synapse/Azure.Analytics.Synapse.AccessControl/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,9 @@ az synapse workspace create \
```

### Authenticate the client
In order to interact with the Azure Synapse Analytics service, you'll need to create an instance of the [AccessControlClient](https://github.com/Azure/azure-sdk-for-net/blob/master/sdk/synapse/Azure.Analytics.Synapse.AccessControl/src/Customization/AccessControlClient.cs) class. You need a **workspace endpoint**, which you may see as "Development endpoint" in the portal,
and **client secret credentials (client id, client secret, tenant id)** to instantiate a client object.
In order to interact with the Azure Synapse Analytics service, you'll need to create an instance of a [RoleAssignmentsClient](https://github.com/Azure/azure-sdk-for-net/blob/master/sdk/synapse/Azure.Analytics.Synapse.AccessControl/src/Customization/RoleAssignmentsClient.cs) and/or a [RoleDefinitionsClient](https://github.com/Azure/azure-sdk-for-net/blob/master/sdk/synapse/Azure.Analytics.Synapse.AccessControl/src/Customization/RoleDefinitionsClient.cs) class.

You will also need a **workspace endpoint**, which you may see as "Development endpoint" in the portal, and **client secret credentials (client id, client secret, tenant id)** to instantiate a client object.

Client secret credential authentication is being used in this getting started section but you can find more ways to authenticate with [Azure identity](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity). To use the [DefaultAzureCredential](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity#defaultazurecredential) provider shown below,
or other credential providers provided with the Azure SDK, you should install the Azure.Identity package:
Expand All @@ -49,8 +50,9 @@ Install-Package Azure.Identity

## Key concepts

### AccessControlClient
With a `AccessControlClient` you can get role assignments from the workspace, create new role assignments, and delete role assignments.
### RoleAssignmentsClient & RoleDefinitionsClient

With a `RoleAssignmentsClient` you can create, update, and delete role assignments. With a `RoleDefinitionsClient` you can get role assignments from the workspace.

### Role Assignment
The way you control access to Synapse resources is to create role assignments. A role assignment is the process of attaching a role definition to a user, group, service principal, or managed identity at a particular scope for the purpose of granting access. Access is granted by creating a role assignment, and access is revoked by removing a role assignment.
Expand All @@ -67,33 +69,38 @@ The Azure.Analytics.Synapse.AccessControl package supports synchronous and async

### Create access control client

To interact with Azure Synapse, you need to instantiate a `AccessControlClient`. It requires an endpoint URL and a `TokenCredential`.
To interact with Azure Synapse, you need to instantiate a `RoleAssignmentsClient` and a `RoleDefinitionsClient`. It requires an endpoint URL and a `TokenCredential`.

```C# Snippet:CreateAccessControlClient
// Replace the string below with your actual endpoint url.
string endpoint = "<my-endpoint-url>";

AccessControlClient client = new AccessControlClient(new Uri(endpoint), new DefaultAzureCredential());
RoleAssignmentsClient roleAssignmentsClient = new RoleAssignmentsClient(new Uri(endpoint), new DefaultAzureCredential());
RoleDefinitionsClient definitionsClient = new RoleDefinitionsClient(new Uri(endpoint), new DefaultAzureCredential());
```

### Create a role assignment

First, you need to the determine the ID of the role you wish to assign, along with the ID of the principal you wish to assign that role.

```C# Snippet:PrepCreateRoleAssignment
Pageable<SynapseRole> roles = client.GetRoleDefinitions();
SynapseRole role = roles.Single(role => role.Name == "Workspace Admin");
string roleID = role.Id;
Response<IReadOnlyList<SynapseRoleDefinition>> roles = definitionsClient.ListRoleDefinitions();
SynapseRoleDefinition role = roles.Value.Single(role => role.Name == "Workspace Admin");
Guid roleId = role.Id.Value;

string assignedScope = "workspaces/<my-workspace-name>";

// Replace the string below with the ID you'd like to assign the role.
string principalId = "<my-principal-id>";
Guid principalId = Guid.Parse("<my-principal-id>");

// Replace the string below with the ID of the assignment you'd like to use.
string assignmentId = "<my-assignment-id>";
```

Then create an instance of `RoleAssignmentOptions` with the requested values. Finally call `CreateRoleAssignment` with the options to create the role assignment.
Then call `CreateRoleAssignment` with the options to create the role assignment.

```C# Snippet:CreateRoleAssignment
RoleAssignmentOptions request = new RoleAssignmentOptions(roleID, principalId);
Response<RoleAssignmentDetails> response = client.CreateRoleAssignment(request);
Response<RoleAssignmentDetails> response = roleAssignmentsClient.CreateRoleAssignment (assignmentId, roleId, principalId, assignedScope);
RoleAssignmentDetails roleAssignmentAdded = response.Value;
```

Expand All @@ -102,17 +109,17 @@ RoleAssignmentDetails roleAssignmentAdded = response.Value;
You can retrieve the details of a role assignment by calling `GetRoleAssignmentById`, passing in the assignment ID.

```C# Snippet:RetrieveRoleAssignment
RoleAssignmentDetails roleAssignment = client.GetRoleAssignmentById(roleAssignmentAdded.Id);
Console.WriteLine($"Role {roleAssignment.RoleId} is assigned to {roleAssignment.PrincipalId}.");
RoleAssignmentDetails roleAssignment = roleAssignmentsClient.GetRoleAssignmentById(roleAssignmentAdded.Id);
Console.WriteLine($"Role {roleAssignment.RoleDefinitionId} is assigned to {roleAssignment.PrincipalId}.");
```

### List role assignments

To enumerate all role assignments in the Synapse workspace you can call `GetRoleAssignments`.
To enumerate all role assignments in the Synapse workspace you can call `ListRoleDefinitions`.

```C# Snippet:ListRoleAssignments
Response<IReadOnlyList<RoleAssignmentDetails>> roleAssignments = client.GetRoleAssignments();
foreach (RoleAssignmentDetails assignment in roleAssignments.Value)
Response<IReadOnlyList<SynapseRoleDefinition>> roleAssignments = definitionsClient.ListRoleDefinitions();
foreach (SynapseRoleDefinition assignment in roleAssignments.Value)
{
Console.WriteLine(assignment.Id);
}
Expand All @@ -123,7 +130,7 @@ foreach (RoleAssignmentDetails assignment in roleAssignments.Value)
To delete a role assignment no longer needed you can call `DeleteRoleAssignmentById`, passing in the assignment ID.

```C# Snippet:DeleteRoleAssignment
client.DeleteRoleAssignmentById(roleAssignment.Id);
roleAssignmentsClient.DeleteRoleAssignmentById(roleAssignment.Id);
```

## To build
Expand Down
Loading