Tài Khoản Người Dùng & Nhóm

# Tạo Resource Group cho module 02
az group create \
  --name rg-az104-m02 \
  --location southeastasia \
  --tags Module=02 Course=AZ-104 Environment=Lab

# Lấy domain mặc định của tenant
DOMAIN=$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d'@' -f2)
echo "Domain: $DOMAIN"

# Tạo user Developer
az ad user create \
  --display-name "Dev User M02" \
  --user-principal-name "devuser.m02@$DOMAIN" \
  --password "Az104Lab@2024!" \
  --force-change-password-next-sign-in false

# Update extended attributes qua Graph API
az rest --method PATCH \
  --uri "https://graph.microsoft.com/v1.0/users/devuser.m02@$DOMAIN" \
  --body '{"jobTitle":"Developer","department":"IT","city":"Hanoi"}'

# ============================================================
# Tạo user HR Manager
# ============================================================
az ad user create \
  --display-name "HR Manager M02" \
  --user-principal-name "hrmanager.m02@$DOMAIN" \
  --password "Az104Lab@2024!" \
  --force-change-password-next-sign-in false

az rest --method PATCH \
  --uri "https://graph.microsoft.com/v1.0/users/hrmanager.m02@$DOMAIN" \
  --body '{"jobTitle":"Manager","department":"HR","city":"Ho Chi Minh"}'

# ============================================================
# Tạo user Marketing
# ============================================================
az ad user create \
  --display-name "Marketing User M02" \
  --user-principal-name "marketing.m02@$DOMAIN" \
  --password "Az104Lab@2024!" \
  --force-change-password-next-sign-in false

az rest --method PATCH \
  --uri "https://graph.microsoft.com/v1.0/users/marketing.m02@$DOMAIN" \
  --body '{"jobTitle":"Designer","department":"Marketing","city":"Hanoi"}'

# Liệt kê users vừa tạo
az ad user list --filter "startswith(userPrincipalName,'devuser.m02') or startswith(userPrincipalName,'hrmanager.m02') or startswith(userPrincipalName,'marketing.m02')" \
  --query '[].{UPN:userPrincipalName, Name:displayName, Dept:department}' -o table

DOMAIN=$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d'@' -f2)

# Tạo file CSV với dữ liệu bulk users
cat > /tmp/bulk-users-m02.csv << EOF
displayName,userPrincipalName,password,department,jobTitle,city
"Finance User 01","finance01.m02@$DOMAIN","Az104Lab@2024!","Finance","Accountant","Hanoi"
"Finance User 02","finance02.m02@$DOMAIN","Az104Lab@2024!","Finance","Analyst","Hanoi"
"Sales User 01","sales01.m02@$DOMAIN","Az104Lab@2024!","Sales","Executive","Ho Chi Minh"
"Sales User 02","sales02.m02@$DOMAIN","Az104Lab@2024!","Sales","Manager","Ho Chi Minh"
"IT User 01","ituser01.m02@$DOMAIN","Az104Lab@2024!","IT","Engineer","Hanoi"
EOF

echo "CSV created. Processing bulk users..."

# Đọc CSV và tạo từng user
tail -n +2 /tmp/bulk-users-m02.csv | while IFS=',' read -r displayName upn password dept title city; do
  # Loại bỏ dấu nháy kép bao quanh nếu có
  displayName=$(echo $displayName | tr -d '"')
  upn=$(echo $upn | tr -d '"')
  dept=$(echo $dept | tr -d '"')
  title=$(echo $title | tr -d '"')
  city=$(echo $city | tr -d '"')

  echo "Creating: $displayName ($upn)..."
  az ad user create \
    --display-name "$displayName" \
    --user-principal-name "$upn" \
    --password "$password" \
    --force-change-password-next-sign-in false \
    --department "$dept" \
    --job-title "$title" \
    --city "$city" \
    2>&1 | grep -E '"id"|"error"' | head -1
done

echo "Bulk import complete."
# Đếm số user có UPN chứa .m02@
az ad user list --query "[?contains(userPrincipalName,'.m02@')].userPrincipalName" -o tsv | wc -l

TOKEN=$(az account get-access-token \
  --resource https://graph.microsoft.com \
  --query accessToken -o tsv)

# Tạo Security Group (Assigned) — cho RBAC
az ad group create \
  --display-name "SG-IT-Department-M02" \
  --mail-nickname "sg-it-department-m02" \
  --description "Security Group - IT Department Lab M02"

# Lấy Object ID của group vừa tạo
SG_IT=$(az ad group show --group "SG-IT-Department-M02" --query id -o tsv)
echo "Security Group ID: $SG_IT"

# Thêm devuser và ituser01 vào group thủ công
DEV_ID=$(az ad user show --id "devuser.m02@$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d'@' -f2)" --query id -o tsv)
IT01_ID=$(az ad user show --id "ituser01.m02@$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d'@' -f2)" --query id -o tsv)

az ad group member add --group "SG-IT-Department-M02" --member-id $DEV_ID
az ad group member add --group "SG-IT-Department-M02" --member-id $IT01_ID

# Tạo Dynamic Security Group qua Graph API (cần P1 license)
curl -s -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "displayName": "SG-Finance-Dynamic-M02",
    "description": "Dynamic group - tự động gồm tất cả user thuộc Finance department",
    "mailEnabled": false,
    "mailNickname": "sg-finance-dynamic-m02",
    "securityEnabled": true,
    "groupTypes": ["DynamicMembership"],
    "membershipRule": "(user.department -eq \"Finance\")",
    "membershipRuleProcessingState": "On"
  }' \
  "https://graph.microsoft.com/v1.0/groups" \
  | python3 -c "import json,sys; d=json.load(sys.stdin); print(f'Dynamic Group created: {d[\"id\"]} | {d[\"displayName\"]}')"

# Xem thành viên group (có thể mất vài phút để dynamic rule xử lý)
echo "Waiting 60s for dynamic membership to process..."
sleep 60
FINANCE_GID=$(az ad group show --group "SG-Finance-Dynamic-M02" --query id -o tsv 2>/dev/null)
if [ -n "$FINANCE_GID" ]; then
  az ad group member list --group "SG-Finance-Dynamic-M02" \
    --query '[].{Name:displayName, Dept:department}' -o table
fi

SUB_ID=$(az account show --query id -o tsv)
SG_IT=$(az ad group show --group "SG-IT-Department-M02" --query id -o tsv)

# Gán Contributor role cho IT Security Group trên RG az104-m02
az role assignment create \
  --assignee-object-id $SG_IT \
  --assignee-principal-type Group \
  --role "Contributor" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m02"

# Xác nhận role assignment
az role assignment list \
  --scope "/subscriptions/$SUB_ID/resourceGroups/rg-az104-m02" \
  --query "[?principalType=='Group'].{Principal:principalName, Role:roleDefinitionName, Scope:scope}" \
  -o table

# Kiểm tra quyền hiệu lực của một user cụ thể
DOMAIN=$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d'@' -f2)
DEV_ID=$(az ad user show --id "devuser.m02@$DOMAIN" --query id -o tsv)
az role assignment list --assignee $DEV_ID -o table

DOMAIN=$(az ad signed-in-user show --query userPrincipalName -o tsv | cut -d'@' -f2)

# Xóa tất cả users .m02
for UPN in devuser.m02 hrmanager.m02 marketing.m02 finance01.m02 finance02.m02 sales01.m02 sales02.m02 ituser01.m02; do
  echo "Deleting $UPN@$DOMAIN ..."
  az ad user delete --id "$UPN@$DOMAIN" 2>/dev/null && echo "  Deleted." || echo "  Not found, skipping."
done

# Xóa Security Groups
az ad group delete --group "SG-IT-Department-M02" 2>/dev/null && echo "SG-IT-Department-M02 deleted."
az ad group delete --group "SG-Finance-Dynamic-M02" 2>/dev/null && echo "SG-Finance-Dynamic-M02 deleted."

# Xóa Resource Group
az group delete --name rg-az104-m02 --yes --no-wait
echo "Resource group rg-az104-m02 deletion initiated (async)."