Skip to content

[Network]az network vnet-gateway: --vpn-auth-type allow multi value #17505

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msyyc merged 6 commits into from
Apr 1, 2021
Merged

[Network]az network vnet-gateway: --vpn-auth-type allow multi value #17505

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3f3408e
create
msyyc Mar 19, 2021
79ada4b
update
msyyc Mar 19, 2021
c9f3a1c
test
msyyc Mar 22, 2021
62117cc
style
msyyc Mar 30, 2021
de8b4d7
Merge branch 'dev' of https://github.com/azure/azure-cli into network…
msyyc Mar 30, 2021
1c6ba12
remove deprecation for --sku of public-ip
msyyc Mar 31, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/azure-cli/azure/cli/command_modules/network/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5446,6 +5446,11 @@
az network vnet-gateway create -g MyResourceGroup -n MyVnetGateway --public-ip-address MyGatewayIp \\
--vnet MyVnet --gateway-type Vpn --sku VpnGw1 --vpn-type RouteBased --address-prefixes 40.1.0.0/24 \\
--client-protocol IkeV2 SSTP --radius-secret 111_aaa --radius-server 30.1.1.15 --vpn-gateway-generation Generation1

- name: >
Create a basic virtual network gateway with multi authentication
text: |
az network vnet-gateway create -g MyResourceGroup -n MyVnetGateway --public-ip-address MyGatewayIp --vnet MyVnet --gateway-type Vpn --sku VpnGw1 --vpn-type RouteBased --address-prefixes 40.1.0.0/24 --client-protocol OpenVPN --radius-secret 111_aaa --radius-server 30.1.1.15 --aad-issuer https://sts.windows.net/00000-000000-00000-0000-000/ --aad-tenant https://login.microsoftonline.com/000 --aad-audience 0000-000 --root-cert-name root-cert --root-cert-data "root-cert.cer" --vpn-auth-type AAD Certificate Radius
- name: Create a virtual network gateway. (autogenerated)
text: |
az network vnet-gateway create --gateway-type Vpn --location westus2 --name MyVnetGateway --no-wait --public-ip-addresses myVGPublicIPAddress --resource-group MyResourceGroup --sku Basic --vnet MyVnet --vpn-type PolicyBased
Expand Down
17 changes: 13 additions & 4 deletions src/azure-cli/azure/cli/command_modules/network/_params.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ def load_arguments(self, _):

(Access, ApplicationGatewayFirewallMode, ApplicationGatewayProtocol, ApplicationGatewayRedirectType,
ApplicationGatewayRequestRoutingRuleType, ApplicationGatewaySkuName, ApplicationGatewaySslProtocol, AuthenticationMethod,
Direction,
Direction, VpnAuthenticationType,
ExpressRouteCircuitSkuFamily, ExpressRouteCircuitSkuTier, ExpressRoutePortsEncapsulation,
FlowLogFormatType, HTTPMethod, IPAllocationMethod,
IPVersion, LoadBalancerSkuName, LoadDistribution, ProbeProtocol, ProcessorArchitecture, Protocol, PublicIPAddressSkuName, PublicIPAddressSkuTier,
Expand All @@ -66,7 +66,7 @@ def load_arguments(self, _):
PreferredIPVersion, HTTPConfigurationMethod, OutputType, DestinationPortBehavior, CoverageLevel, EndpointType) = self.get_models(
'Access', 'ApplicationGatewayFirewallMode', 'ApplicationGatewayProtocol', 'ApplicationGatewayRedirectType',
'ApplicationGatewayRequestRoutingRuleType', 'ApplicationGatewaySkuName', 'ApplicationGatewaySslProtocol', 'AuthenticationMethod',
'Direction',
'Direction', 'VpnAuthenticationType',
'ExpressRouteCircuitSkuFamily', 'ExpressRouteCircuitSkuTier', 'ExpressRoutePortsEncapsulation',
'FlowLogFormatType', 'HTTPMethod', 'IPAllocationMethod',
'IPVersion', 'LoadBalancerSkuName', 'LoadDistribution', 'ProbeProtocol', 'ProcessorArchitecture', 'Protocol', 'PublicIPAddressSkuName', 'PublicIPAddressSkuTier',
Expand Down Expand Up @@ -1694,8 +1694,7 @@ def load_arguments(self, _):
c.argument('version', min_api='2016-09-01', help='IP address type.', arg_type=get_enum_type(IPVersion, 'ipv4'))

with self.argument_context('network public-ip update') as c:
c.argument('sku', min_api='2017-08-01', help='Public IP SKU', arg_type=get_enum_type(PublicIPAddressSkuName),
deprecate_info=c.deprecate(hide=True),)
c.argument('sku', min_api='2017-08-01', help='Public IP SKU', arg_type=get_enum_type(PublicIPAddressSkuName))

for scope in ['public-ip', 'lb frontend-ip', 'cross-region-lb frontend-ip']:
with self.argument_context('network {}'.format(scope), min_api='2018-07-01') as c:
Expand Down Expand Up @@ -1906,6 +1905,16 @@ def load_arguments(self, _):
c.argument('radius_secret', min_api='2017-06-01', help='Radius secret to use for authentication.', arg_group='VPN Client')
c.argument('client_protocol', min_api='2017-06-01', help='Protocols to use for connecting', nargs='+', arg_group='VPN Client', arg_type=get_enum_type(VpnClientProtocol))
c.argument('custom_routes', min_api='2019-02-01', help='Space-separated list of CIDR prefixes representing the custom routes address space specified by the customer for VpnClient.', nargs='+', arg_group='VPN Client')
c.argument('vpn_auth_type', min_api='2020-11-01', nargs='+', help='VPN authentication types enabled for the virtual network gateway.', arg_type=get_enum_type(VpnAuthenticationType))

with self.argument_context('network vnet-gateway', arg_group='AAD Authentication', min_api='2020-11-01') as c:
c.argument('aad_tenant', help='The AAD Tenant URI of the VirtualNetworkGateway.')
c.argument('aad_audience', help='The AADAudience ID of the VirtualNetworkGateway.')
c.argument('aad_issuer', help='The AAD Issuer URI of the VirtualNetworkGateway.')

with self.argument_context('network vnet-gateway', arg_group='Root Cert Authentication', min_api='2020-11-01') as c:
c.argument('root_cert_data', help='Base64 contents of the root certificate file or file path.', type=file_type, completer=FilesCompleter())
c.argument('root_cert_name', help='Root certificate name')

with self.argument_context('network vnet-gateway update') as c:
c.argument('gateway_type', vnet_gateway_type, default=None)
Expand Down
11 changes: 11 additions & 0 deletions src/azure-cli/azure/cli/command_modules/network/_validators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1109,6 +1109,12 @@ def process_vnet_create_namespace(cmd, namespace):
namespace.subnet_prefix = [subnet_prefix] if cmd.supported_api_version(min_api='2018-08-01') else subnet_prefix


def _validate_cert(namespace, param_name):
attr = getattr(namespace, param_name)
if attr and os.path.isfile(attr):
setattr(namespace, param_name, read_base_64_file(attr))


def process_vnet_gateway_create_namespace(cmd, namespace):
ns = namespace
get_default_location_from_resource_group(cmd, ns)
Expand All @@ -1131,12 +1137,17 @@ def process_vnet_gateway_create_namespace(cmd, namespace):
raise ValueError(
'incorrect usage: --asn ASN [--peer-weight WEIGHT --bgp-peering-address IP ]')

if cmd.supported_api_version(min_api='2020-11-01'):
_validate_cert(namespace, 'root_cert_data')


def process_vnet_gateway_update_namespace(cmd, namespace):
ns = namespace
get_virtual_network_validator()(cmd, ns)
get_public_ip_validator()(cmd, ns)
validate_tags(ns)
if cmd.supported_api_version(min_api='2020-11-01'):
_validate_cert(namespace, 'root_cert_data')
public_ip_count = len(ns.public_ip_address or [])
if public_ip_count > 2:
raise CLIError('Specify a single public IP to create an active-standby gateway or two '
Expand Down
34 changes: 28 additions & 6 deletions src/azure-cli/azure/cli/command_modules/network/custom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6336,11 +6336,12 @@ def create_vnet_gateway(cmd, resource_group_name, virtual_network_gateway_name,
no_wait=False, gateway_type=None, sku=None, vpn_type=None, vpn_gateway_generation=None,
asn=None, bgp_peering_address=None, peer_weight=None,
address_prefixes=None, radius_server=None, radius_secret=None, client_protocol=None,
gateway_default_site=None, custom_routes=None):
gateway_default_site=None, custom_routes=None, aad_tenant=None, aad_audience=None,
aad_issuer=None, root_cert_data=None, root_cert_name=None, vpn_auth_type=None):
(VirtualNetworkGateway, BgpSettings, SubResource, VirtualNetworkGatewayIPConfiguration, VirtualNetworkGatewaySku,
VpnClientConfiguration, AddressSpace) = cmd.get_models(
VpnClientConfiguration, AddressSpace, VpnClientRootCertificate) = cmd.get_models(
'VirtualNetworkGateway', 'BgpSettings', 'SubResource', 'VirtualNetworkGatewayIPConfiguration',
'VirtualNetworkGatewaySku', 'VpnClientConfiguration', 'AddressSpace')
'VirtualNetworkGatewaySku', 'VpnClientConfiguration', 'AddressSpace', 'VpnClientRootCertificate')

client = network_client_factory(cmd.cli_ctx).virtual_network_gateways
subnet = virtual_network + '/subnets/GatewaySubnet'
Expand Down Expand Up @@ -6371,6 +6372,16 @@ def create_vnet_gateway(cmd, resource_group_name, virtual_network_gateway_name,
vnet_gateway.vpn_client_configuration.radius_server_address = radius_server
vnet_gateway.vpn_client_configuration.radius_server_secret = radius_secret

# multi authentication
if cmd.supported_api_version(min_api='2020-11-01'):
vnet_gateway.vpn_client_configuration.vpn_authentication_types = vpn_auth_type
vnet_gateway.vpn_client_configuration.aad_tenant = aad_tenant
vnet_gateway.vpn_client_configuration.aad_issuer = aad_issuer
vnet_gateway.vpn_client_configuration.aad_audience = aad_audience
vnet_gateway.vpn_client_configuration.vpn_client_root_certificates = [
VpnClientRootCertificate(name=root_cert_name,
public_cert_data=root_cert_data)] if root_cert_data else None
Comment on lines +6382 to +6383
Copy link
Contributor

@kairu-ms kairu-ms Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to throw error if user provide rout_cert_data but forget root_cert_name?

Copy link
Member Author

@msyyc msyyc Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

root_cert_data is necessary while root_cert_name is not.


if custom_routes and cmd.supported_api_version(min_api='2019-02-01'):
vnet_gateway.custom_routes = AddressSpace()
vnet_gateway.custom_routes.address_prefixes = custom_routes
Expand All @@ -6383,9 +6394,11 @@ def update_vnet_gateway(cmd, instance, sku=None, vpn_type=None, tags=None,
public_ip_address=None, gateway_type=None, enable_bgp=None,
asn=None, bgp_peering_address=None, peer_weight=None, virtual_network=None,
address_prefixes=None, radius_server=None, radius_secret=None, client_protocol=None,
gateway_default_site=None, custom_routes=None):
AddressSpace, SubResource, VirtualNetworkGatewayIPConfiguration, VpnClientConfiguration = cmd.get_models(
'AddressSpace', 'SubResource', 'VirtualNetworkGatewayIPConfiguration', 'VpnClientConfiguration')
gateway_default_site=None, custom_routes=None, aad_tenant=None, aad_audience=None,
aad_issuer=None, root_cert_data=None, root_cert_name=None, vpn_auth_type=None):
(AddressSpace, SubResource, VirtualNetworkGatewayIPConfiguration, VpnClientConfiguration,
VpnClientRootCertificate) = cmd.get_models('AddressSpace', 'SubResource', 'VirtualNetworkGatewayIPConfiguration',
'VpnClientConfiguration', 'VpnClientRootCertificate')

if any((address_prefixes, radius_server, radius_secret, client_protocol)) and not instance.vpn_client_configuration:
instance.vpn_client_configuration = VpnClientConfiguration()
Expand All @@ -6401,6 +6414,15 @@ def update_vnet_gateway(cmd, instance, sku=None, vpn_type=None, tags=None,
c.set_param('vpn_client_protocols', client_protocol)
c.set_param('radius_server_address', radius_server)
c.set_param('radius_server_secret', radius_secret)
if cmd.supported_api_version(min_api='2020-11-01'):
c.set_param('aad_tenant', aad_tenant)
c.set_param('aad_audience', aad_audience)
c.set_param('aad_issuer', aad_issuer)
c.set_param('vpn_authentication_types', vpn_auth_type)

if root_cert_data and cmd.supported_api_version(min_api='2020-11-01'):
upsert_to_collection(instance.vpn_client_configuration, 'vpn_client_root_certificates',
VpnClientRootCertificate(name=root_cert_name, public_cert_data=root_cert_data), 'name')
Comment on lines +6423 to +6425
Copy link
Contributor

@kairu-ms kairu-ms Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same question as above

Copy link
Member Author

@msyyc msyyc Mar 31, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same reply as above


with cmd.update_context(instance.sku) as c:
c.set_param('name', sku)
Expand Down
Loading