如何使用资源管理API和Azure Java SDK向AD应用程序分配读写权限以管理资源

Question

I am trying to connect to Azure Resource Manager API using java sdk. I have an AD application which has "Windows Service Management API" permissions enabled. When running the test samples, I am hitting the following error when performing get call on a specific resource group.

Exception in thread "main" com.microsoft.windowsazure.exception.ServiceException: AuthorizationFailed: The client '1111-5a7b-4384-9fee-3a593a8c6875' with object id '1111115-5a7b-4384-9fee-3a593a8c6875' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/zzzzzzzzzzzz-ae67-ed0926abfe0d/resourcegroups/Group'.
at com.microsoft.windowsazure.exception.ServiceException.createFromJson

How to assign read write permissions to the application in an AD which is used to connect to resource management API ?

Answer 1

As @Gaurav Mantri said, the easiest way for assigning reader role for your ad app is using Azure Preview Portal if runing the sample ServicePrincipalExample at https://github.com/Azure/azure-sdk-for-java/blob/master/azure-mgmt-samples/src/main/java/com/microsoft/azure/samples/authentication/ServicePrincipalExample.java .

For complete details to do it, please see below.

According to the picture above, the steps as follow:

1. Click the Resource groups .
2. Input the resource group name in the filter items field, and click the selected resource group.
3. Click the settings button.
4. Click the Users button.
5. Click the Add button.
6. Click the Select a role and select the Reader role.
7. Click the Add users botton, input the ad app name in the search field and select the ad app to click the select button.
8. Click the OK button in the Add access tab page.

Now, you can run the sample again that return the correct result without errors.

Beside Azure PowerShell, you can also use the Azure CLI to do it.

1. Login the azure cli with your username & password, run azure login
2. Switch the arm mode, run azure config mode arm
3. Role assignment, run azure role assignment create --objectId <objectId> -o Reader -c /subscriptions/<subscriptionId>/> .

Note: For the object Id, you can run azure ad sp show --search <ad-app-name> to show it.

Then, run the sample again without errors.

Answer 2

What you would need to do is assign your application Reader role in your Azure Subscription. This you could do programmatically using ARM API or you could use Azure PowerShell to do that.

However the easiest for you would be to assign role using Azure Preview Portal . You may find this link useful for assigning roles using Preview Portal: https://azure.microsoft.com/en-in/documentation/articles/role-based-access-control-configure/ .