role assignment: support scope of management group

src/command_modules/azure-cli-role/HISTORY.rst

@@ -2,6 +2,8 @@
 
 Release History
 ===============
+* role assignment: support scope of management group
+
 2.6.1
 +++++
 * create-for-rbac: hide '--password' as the preparations to pull the plug completely in 2019 May

src/command_modules/azure-cli-role/azure/cli/command_modules/role/custom.py

@@ -450,15 +450,15 @@ def _search_role_assignments(cli_ctx, assignments_client, definitions_client,
     if assignee:
         assignee_object_id = _resolve_object_id(cli_ctx, assignee, fallback_to_object_id=True)
 
-    # combining filters is unsupported, so we pick the best, and do limited maunal filtering
-    if assignee_object_id:
+    # always use "scope" if provided, so we can get assignments beyond subscription e.g. management groups
+    if scope:
+        assignments = list(assignments_client.list_for_scope(scope=scope, filter='atScope()'))
+    elif assignee_object_id:
         if include_groups:
             f = "assignedTo('{}')".format(assignee_object_id)
         else:
             f = "principalId eq '{}'".format(assignee_object_id)
         assignments = list(assignments_client.list(filter=f))
-    elif scope:
-        assignments = list(assignments_client.list_for_scope(scope=scope, filter='atScope()'))
     else:
         assignments = list(assignments_client.list())
 
@@ -474,6 +474,9 @@ def _search_role_assignments(cli_ctx, assignments_client, definitions_client,
             role_id = _resolve_role_id(role, scope, definitions_client)
             assignments = [i for i in assignments if worker.get_role_property(i, 'role_definition_id') == role_id]
 
+        if assignee_object_id:
+            assignments = [i for i in assignments if worker.get_role_property(i, 'principal_id') == assignee_object_id]
+
     return assignments
 
 

src/command_modules/azure-cli-role/azure/cli/command_modules/role/tests/latest/test_role.py

@@ -317,6 +317,48 @@ def test_role_assignment_handle_conflicted_assignments(self, resource_group):
                 self.cmd('configure --default group=""')
                 self.cmd('ad user delete --upn-or-object-id {upn}')
 
+    @ResourceGroupPreparer(name_prefix='cli_role_assign')
+    @AllowLargeResponse()
+    def test_role_assignment_mgmt_grp(self, resource_group):
+        if self.run_under_service_principal():
+            return  # this test delete users which are beyond a SP's capacity, so quit...
+
+        with mock.patch('azure.cli.command_modules.role.custom._gen_guid', side_effect=self.create_guid):
+            user = self.create_random_name('testuser', 15)
+            mgmt_grp = self.create_random_name('mgmt_grp', 15)
+            self.kwargs.update({
+                'upn': user + '@azuresdkteam.onmicrosoft.com',
+                'mgmt_grp': mgmt_grp
+            })
+
+            self.cmd('ad user create --display-name tester123 --password Test123456789 --user-principal-name {upn}')
+            time.sleep(15)  # By-design, it takes some time for RBAC system propagated with graph object change
+
+            mgmt_grp_created = False
+
+            try:
+                mgmt_grp_id = self.cmd('account management-group create -n {mgmt_grp}').get_output_in_json()['id']
+                self.kwargs['scope'] = mgmt_grp_id
+                mgmt_grp_created = True
+                time.sleep(15)  # By-design, it takes some time for RBAC system propagated with graph object change
+                # test role assignments on a resource group
+                self.cmd('role assignment create --assignee {upn} --role reader --scope {scope}',
+                         checks=self.check('scope', self.kwargs['scope']))
+
+                self.cmd('role assignment list --assignee {upn} --role reader --scope {scope}', checks=[
+                    self.check('length([])', 1),
+                    self.check('[0].scope', self.kwargs['scope'])
+                ])
+
+                self.cmd('role assignment delete --assignee {upn} --role reader --scope {scope}')
+
+                self.cmd('role assignment list --assignee {upn} --role reader --scope {scope}',
+                         checks=self.check('length([])', 0))
+            finally:
+                if mgmt_grp_created:
+                    self.cmd('account management-group delete -n {mgmt_grp}')
+                self.cmd('ad user delete --upn-or-object-id {upn}')
+
     @ResourceGroupPreparer(name_prefix='cli_role_audit')
     @AllowLargeResponse()
     def test_role_assignment_audits(self, resource_group):