-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Implement RoleDefinitions RoleCapabilityFiles keyword #3067
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
ad9552a
Changes to implement remote endpoint RoleDefinition RoleCapabilityFil…
PaulHigin 913cce7
Fixed spelling error. Added back missing resource string
PaulHigin ae9eada
Updated tests from CR comments
PaulHigin 132b36a
Simplified error tests per Code Review
PaulHigin 37ab39c
Test change from Code Review
PaulHigin File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
111 changes: 111 additions & 0 deletions
111
test/powershell/engine/Remoting/RoleCapabilityFiles.Tests.ps1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| ## | ||
| ## PowerShell Remoting Endpoint Role Capability Files Tests | ||
| ## | ||
|
|
||
| Describe "Remote session configuration RoleDefintion RoleCapabilityFiles key tests" -Tags "Feature" { | ||
|
|
||
| BeforeAll { | ||
|
|
||
| if (!$IsWindows) | ||
| { | ||
| $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() | ||
| $PSDefaultParameterValues["it:skip"] = $true | ||
| } | ||
| else | ||
| { | ||
| [string] $RoleCapDirectory = (New-Item -Path "$TestDrive\RoleCapability" -ItemType Directory -Force).FullName | ||
|
|
||
| [string] $GoodRoleCapFile = "$RoleCapDirectory\TestGoodRoleCap.psrc" | ||
| New-PSRoleCapabilityFile -Path $GoodRoleCapFile -VisibleCmdlets 'Get-Command','Get-Process','Clear-Host','Out-Default','Select-Object','Get-FormatData','Get-Help' | ||
|
|
||
| [string] $BadRoleCapFile = "$RoleCapDirectory\TestBadRoleCap.psrc" | ||
| New-PSRoleCapabilityFile -Path $BadRoleCapFile -VisibleCmdlets * | ||
| [string] $BadRoleCapFile = $BadRoleCapFile.Replace('.psrc', 'psbad') | ||
|
|
||
| [string] $PSSessionConfigFile = "$RoleCapDirectory\TestConfig.pssc" | ||
| } | ||
| } | ||
|
|
||
| AfterAll { | ||
|
|
||
| if (!$IsWindows) | ||
| { | ||
| $global:PSDefaultParameterValues = $originalDefaultParameterValues | ||
| } | ||
| } | ||
|
|
||
| It "Verifies missing role capability file error" { | ||
|
|
||
| New-PSSessionConfigurationFile -Path $PSSessionConfigFile -RoleDefinitions @{ | ||
| Administrators = @{ RoleCapabilityFiles = "$RoleCapDirectory\NoFile.psrc" } | ||
| } | ||
|
|
||
| $fullyQualifiedErrorId = "" | ||
| try | ||
| { | ||
| $iss = [initialsessionstate]::CreateFromSessionConfigurationFile($PSSessionConfigFile, { $true }) | ||
| throw 'No Exception!' | ||
| } | ||
| catch | ||
| { | ||
| $psioe = [System.Management.Automation.PSInvalidOperationException] ($_.Exception).InnerException | ||
| if ($psioe -ne $null) | ||
| { | ||
| $fullyQualifiedErrorId = $psioe.ErrorRecord.FullyQualifiedErrorId | ||
| } | ||
| $fullyQualifiedErrorId | Should Be 'CouldNotFindRoleCapabilityFile' | ||
| } | ||
| } | ||
|
|
||
| It "Verifies incorrect role capability file extenstion error" { | ||
|
|
||
| New-PSSessionConfigurationFile -Path $PSSessionConfigFile -RoleDefinitions @{ | ||
| Administrators = @{ RoleCapabilityFiles = "$BadRoleCapFile" } | ||
| } | ||
|
|
||
| $fullyQualifiedErrorId = "" | ||
| try | ||
| { | ||
| $iss = [initialsessionstate]::CreateFromSessionConfigurationFile($PSSessionConfigFile, { $true }) | ||
| throw 'No Exception!' | ||
| } | ||
| catch | ||
| { | ||
| $psioe = [System.Management.Automation.PSInvalidOperationException] ($_.Exception).InnerException | ||
| if ($psioe -ne $null) | ||
| { | ||
| $fullyQualifiedErrorId = $psioe.ErrorRecord.FullyQualifiedErrorId | ||
| } | ||
| $fullyQualifiedErrorId | Should Be 'InvalidRoleCapabilityFileExtension' | ||
| } | ||
| } | ||
|
|
||
| It "Verifies restriction on good role capability file" { | ||
|
|
||
| New-PSSessionConfigurationFile -Path $PSSessionConfigFile -RoleDefinitions @{ | ||
| Administrators = @{ RoleCapabilityFiles = "$GoodRoleCapFile" } | ||
| } | ||
|
|
||
| # 'Get-Service' is not included in the session. | ||
| $iss = [initialsessionstate]::CreateFromSessionConfigurationFile($PSSessionConfigFile, { $true }) | ||
| [powershell] $ps = [powershell]::Create($iss) | ||
| $null = $ps.AddCommand('Get-Service') | ||
|
|
||
| $exceptionTypeName = "" | ||
| try | ||
| { | ||
| $ps.Invoke() | ||
| throw 'No Exception!' | ||
| } | ||
| catch | ||
| { | ||
| if ($_.Exception.InnerException -ne $null) | ||
| { | ||
| $exceptionTypeName = $_.Exception.InnerException.GetType().FullName | ||
| } | ||
| $exceptionTypeName | Should Be 'System.Management.Automation.CommandNotFoundException' | ||
| } | ||
|
|
||
| $ps.Dispose() | ||
| } | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I notice windows specific paths (
C:\\) are used in the code, and I assume the related functionalities are not supported on unix plats, but what would be the user experience?New-PSSessionConfigurationFileis exposed on unix plats, so will it throw a friendly error when running the following?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remoting endpoint configuration is supported on Windows only, at least for now, hence the Windows only test restriction. This change follows the existing code as originally ported.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do you mean this cmdlet shouldn't be exposed on Linux/OSX at all? I opened #3147 to track this usability issue.
The code change LGTM.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, none of our remoting endpoint configuration works on Linux since it is specific to Windows/WinRM, and is not functional with OMI/WinRM AFAIK. I hope to create an RFC in the not too distant future that proposes how this might work on Linux, including JEA and hosting model.
Can you please make this issue more general since it involves more than just one cmdlet and is really about endpoint configuration on Linux.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the clarification. I updated the issue to make it more general. Feel free to update further to make it more clear.