Initial import of Azure Secrets (#5120)

* Initial import of Azure Secrets

* Update vendor folder

.gitignore

@@ -32,6 +32,9 @@ _testmain.go
 example.hcl
 example.vault.d
 
+# Without this, the *.[568vq] above ignores this folder.
+!**/graphrbac/1.6
+
 # Ruby
 website/vendor
 website/.bundle

command/commands.go

@@ -7,6 +7,7 @@ import (
 	"syscall"
 
 	ad "github.com/hashicorp/vault-plugin-secrets-ad/plugin"
+	azure "github.com/hashicorp/vault-plugin-secrets-azure"
 	gcp "github.com/hashicorp/vault-plugin-secrets-gcp/plugin"
 	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/audit"
@@ -121,6 +122,7 @@ var (
 	logicalBackends = map[string]logical.Factory{
 		"ad":         ad.Factory,
 		"aws":        aws.Factory,
+		"azure":      azure.Factory,
 		"cassandra":  cassandra.Factory,
 		"consul":     consul.Factory,
 		"database":   database.Factory,

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/applications.go

@@ -0,0 +1,859 @@
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/Azure/go-autorest/autorest/validation"
+	"net/http"
+)
+
+// ApplicationsClient is the the Graph RBAC Management Client
+type ApplicationsClient struct {
+	BaseClient
+}
+
+// NewApplicationsClient creates an instance of the ApplicationsClient client.
+func NewApplicationsClient(tenantID string) ApplicationsClient {
+	return NewApplicationsClientWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewApplicationsClientWithBaseURI creates an instance of the ApplicationsClient client.
+func NewApplicationsClientWithBaseURI(baseURI string, tenantID string) ApplicationsClient {
+	return ApplicationsClient{NewWithBaseURI(baseURI, tenantID)}
+}
+
+// AddOwner add an owner to an application.
+// Parameters:
+// applicationObjectID - the object ID of the application to which to add the owner.
+// parameters - the URL of the owner object, such as
+// https://graph.windows.net/0b1f9851-1bf0-433f-aec3-cb9272f093dc/directoryObjects/f260bbc4-c254-447b-94cf-293b5ec434dd.
+func (client ApplicationsClient) AddOwner(ctx context.Context, applicationObjectID string, parameters ApplicationAddOwnerParameters) (result autorest.Response, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.URL", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.ApplicationsClient", "AddOwner", err.Error())
+	}
+
+	req, err := client.AddOwnerPreparer(ctx, applicationObjectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "AddOwner", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.AddOwnerSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "AddOwner", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.AddOwnerResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "AddOwner", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// AddOwnerPreparer prepares the AddOwner request.
+func (client ApplicationsClient) AddOwnerPreparer(ctx context.Context, applicationObjectID string, parameters ApplicationAddOwnerParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}/$links/owners", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// AddOwnerSender sends the AddOwner request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) AddOwnerSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// AddOwnerResponder handles the response to the AddOwner request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) AddOwnerResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// Create create a new application.
+// Parameters:
+// parameters - the parameters for creating an application.
+func (client ApplicationsClient) Create(ctx context.Context, parameters ApplicationCreateParameters) (result Application, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.AvailableToOtherTenants", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.DisplayName", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.IdentifierUris", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.ApplicationsClient", "Create", err.Error())
+	}
+
+	req, err := client.CreatePreparer(ctx, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Create", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Create", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Create", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreatePreparer prepares the Create request.
+func (client ApplicationsClient) CreatePreparer(ctx context.Context, parameters ApplicationCreateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateSender sends the Create request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) CreateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateResponder handles the response to the Create request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) CreateResponder(resp *http.Response) (result Application, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Delete delete an application.
+// Parameters:
+// applicationObjectID - application object ID.
+func (client ApplicationsClient) Delete(ctx context.Context, applicationObjectID string) (result autorest.Response, err error) {
+	req, err := client.DeletePreparer(ctx, applicationObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Delete", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Delete", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Delete", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeletePreparer prepares the Delete request.
+func (client ApplicationsClient) DeletePreparer(ctx context.Context, applicationObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteSender sends the Delete request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) DeleteSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteResponder handles the response to the Delete request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// Get get an application by object ID.
+// Parameters:
+// applicationObjectID - application object ID.
+func (client ApplicationsClient) Get(ctx context.Context, applicationObjectID string) (result Application, err error) {
+	req, err := client.GetPreparer(ctx, applicationObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client ApplicationsClient) GetPreparer(ctx context.Context, applicationObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) GetResponder(resp *http.Response) (result Application, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List lists applications by filter parameters.
+// Parameters:
+// filter - the filters to apply to the operation.
+func (client ApplicationsClient) List(ctx context.Context, filter string) (result ApplicationListResultPage, err error) {
+	result.fn = func(lastResult ApplicationListResult) (ApplicationListResult, error) {
+		if lastResult.OdataNextLink == nil || len(to.String(lastResult.OdataNextLink)) < 1 {
+			return ApplicationListResult{}, nil
+		}
+		return client.ListNext(ctx, *lastResult.OdataNextLink)
+	}
+	req, err := client.ListPreparer(ctx, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.alr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.alr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client ApplicationsClient) ListPreparer(ctx context.Context, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) ListResponder(resp *http.Response) (result ApplicationListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client ApplicationsClient) ListComplete(ctx context.Context, filter string) (result ApplicationListResultIterator, err error) {
+	result.page, err = client.List(ctx, filter)
+	return
+}
+
+// ListKeyCredentials get the keyCredentials associated with an application.
+// Parameters:
+// applicationObjectID - application object ID.
+func (client ApplicationsClient) ListKeyCredentials(ctx context.Context, applicationObjectID string) (result KeyCredentialListResult, err error) {
+	req, err := client.ListKeyCredentialsPreparer(ctx, applicationObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListKeyCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListKeyCredentialsSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListKeyCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListKeyCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListKeyCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListKeyCredentialsPreparer prepares the ListKeyCredentials request.
+func (client ApplicationsClient) ListKeyCredentialsPreparer(ctx context.Context, applicationObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}/keyCredentials", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListKeyCredentialsSender sends the ListKeyCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) ListKeyCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListKeyCredentialsResponder handles the response to the ListKeyCredentials request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) ListKeyCredentialsResponder(resp *http.Response) (result KeyCredentialListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListNext gets a list of applications from the current tenant.
+// Parameters:
+// nextLink - next link for the list operation.
+func (client ApplicationsClient) ListNext(ctx context.Context, nextLink string) (result ApplicationListResult, err error) {
+	req, err := client.ListNextPreparer(ctx, nextLink)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListNext", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListNextSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListNext", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListNextResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListNext", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListNextPreparer prepares the ListNext request.
+func (client ApplicationsClient) ListNextPreparer(ctx context.Context, nextLink string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"nextLink": nextLink,
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/{nextLink}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListNextSender sends the ListNext request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) ListNextSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListNextResponder handles the response to the ListNext request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) ListNextResponder(resp *http.Response) (result ApplicationListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListOwners the owners are a set of non-admin users who are allowed to modify this object.
+// Parameters:
+// applicationObjectID - the object ID of the application for which to get owners.
+func (client ApplicationsClient) ListOwners(ctx context.Context, applicationObjectID string) (result DirectoryObjectListResult, err error) {
+	req, err := client.ListOwnersPreparer(ctx, applicationObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListOwners", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListOwnersSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListOwners", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListOwnersResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListOwners", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListOwnersPreparer prepares the ListOwners request.
+func (client ApplicationsClient) ListOwnersPreparer(ctx context.Context, applicationObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}/owners", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListOwnersSender sends the ListOwners request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) ListOwnersSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListOwnersResponder handles the response to the ListOwners request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) ListOwnersResponder(resp *http.Response) (result DirectoryObjectListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListPasswordCredentials get the passwordCredentials associated with an application.
+// Parameters:
+// applicationObjectID - application object ID.
+func (client ApplicationsClient) ListPasswordCredentials(ctx context.Context, applicationObjectID string) (result PasswordCredentialListResult, err error) {
+	req, err := client.ListPasswordCredentialsPreparer(ctx, applicationObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListPasswordCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListPasswordCredentialsSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListPasswordCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListPasswordCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "ListPasswordCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPasswordCredentialsPreparer prepares the ListPasswordCredentials request.
+func (client ApplicationsClient) ListPasswordCredentialsPreparer(ctx context.Context, applicationObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}/passwordCredentials", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListPasswordCredentialsSender sends the ListPasswordCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) ListPasswordCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListPasswordCredentialsResponder handles the response to the ListPasswordCredentials request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) ListPasswordCredentialsResponder(resp *http.Response) (result PasswordCredentialListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Patch update an existing application.
+// Parameters:
+// applicationObjectID - application object ID.
+// parameters - parameters to update an existing application.
+func (client ApplicationsClient) Patch(ctx context.Context, applicationObjectID string, parameters ApplicationUpdateParameters) (result autorest.Response, err error) {
+	req, err := client.PatchPreparer(ctx, applicationObjectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Patch", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.PatchSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Patch", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.PatchResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "Patch", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// PatchPreparer prepares the Patch request.
+func (client ApplicationsClient) PatchPreparer(ctx context.Context, applicationObjectID string, parameters ApplicationUpdateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPatch(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// PatchSender sends the Patch request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) PatchSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// PatchResponder handles the response to the Patch request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) PatchResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// UpdateKeyCredentials update the keyCredentials associated with an application.
+// Parameters:
+// applicationObjectID - application object ID.
+// parameters - parameters to update the keyCredentials of an existing application.
+func (client ApplicationsClient) UpdateKeyCredentials(ctx context.Context, applicationObjectID string, parameters KeyCredentialsUpdateParameters) (result autorest.Response, err error) {
+	req, err := client.UpdateKeyCredentialsPreparer(ctx, applicationObjectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "UpdateKeyCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.UpdateKeyCredentialsSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "UpdateKeyCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.UpdateKeyCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "UpdateKeyCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// UpdateKeyCredentialsPreparer prepares the UpdateKeyCredentials request.
+func (client ApplicationsClient) UpdateKeyCredentialsPreparer(ctx context.Context, applicationObjectID string, parameters KeyCredentialsUpdateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPatch(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}/keyCredentials", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// UpdateKeyCredentialsSender sends the UpdateKeyCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) UpdateKeyCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// UpdateKeyCredentialsResponder handles the response to the UpdateKeyCredentials request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) UpdateKeyCredentialsResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// UpdatePasswordCredentials update passwordCredentials associated with an application.
+// Parameters:
+// applicationObjectID - application object ID.
+// parameters - parameters to update passwordCredentials of an existing application.
+func (client ApplicationsClient) UpdatePasswordCredentials(ctx context.Context, applicationObjectID string, parameters PasswordCredentialsUpdateParameters) (result autorest.Response, err error) {
+	req, err := client.UpdatePasswordCredentialsPreparer(ctx, applicationObjectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "UpdatePasswordCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.UpdatePasswordCredentialsSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "UpdatePasswordCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.UpdatePasswordCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ApplicationsClient", "UpdatePasswordCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// UpdatePasswordCredentialsPreparer prepares the UpdatePasswordCredentials request.
+func (client ApplicationsClient) UpdatePasswordCredentialsPreparer(ctx context.Context, applicationObjectID string, parameters PasswordCredentialsUpdateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"applicationObjectId": autorest.Encode("path", applicationObjectID),
+		"tenantID":            autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPatch(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/applications/{applicationObjectId}/passwordCredentials", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// UpdatePasswordCredentialsSender sends the UpdatePasswordCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ApplicationsClient) UpdatePasswordCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// UpdatePasswordCredentialsResponder handles the response to the UpdatePasswordCredentials request. The method always
+// closes the http.Response Body.
+func (client ApplicationsClient) UpdatePasswordCredentialsResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/client.go

@@ -0,0 +1,51 @@
+// Package graphrbac implements the Azure ARM Graphrbac service API version 1.6.
+//
+// The Graph RBAC Management Client
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"github.com/Azure/go-autorest/autorest"
+)
+
+const (
+	// DefaultBaseURI is the default URI used for the service Graphrbac
+	DefaultBaseURI = "https://graph.windows.net"
+)
+
+// BaseClient is the base client for Graphrbac.
+type BaseClient struct {
+	autorest.Client
+	BaseURI  string
+	TenantID string
+}
+
+// New creates an instance of the BaseClient client.
+func New(tenantID string) BaseClient {
+	return NewWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewWithBaseURI creates an instance of the BaseClient client.
+func NewWithBaseURI(baseURI string, tenantID string) BaseClient {
+	return BaseClient{
+		Client:   autorest.NewClientWithUserAgent(UserAgent()),
+		BaseURI:  baseURI,
+		TenantID: tenantID,
+	}
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/domains.go

@@ -0,0 +1,172 @@
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"net/http"
+)
+
+// DomainsClient is the the Graph RBAC Management Client
+type DomainsClient struct {
+	BaseClient
+}
+
+// NewDomainsClient creates an instance of the DomainsClient client.
+func NewDomainsClient(tenantID string) DomainsClient {
+	return NewDomainsClientWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewDomainsClientWithBaseURI creates an instance of the DomainsClient client.
+func NewDomainsClientWithBaseURI(baseURI string, tenantID string) DomainsClient {
+	return DomainsClient{NewWithBaseURI(baseURI, tenantID)}
+}
+
+// Get gets a specific domain in the current tenant.
+// Parameters:
+// domainName - name of the domain.
+func (client DomainsClient) Get(ctx context.Context, domainName string) (result Domain, err error) {
+	req, err := client.GetPreparer(ctx, domainName)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.DomainsClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.DomainsClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.DomainsClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client DomainsClient) GetPreparer(ctx context.Context, domainName string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"domainName": autorest.Encode("path", domainName),
+		"tenantID":   autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/domains/{domainName}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client DomainsClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client DomainsClient) GetResponder(resp *http.Response) (result Domain, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List gets a list of domains for the current tenant.
+// Parameters:
+// filter - the filter to apply to the operation.
+func (client DomainsClient) List(ctx context.Context, filter string) (result DomainListResult, err error) {
+	req, err := client.ListPreparer(ctx, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.DomainsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.DomainsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.DomainsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client DomainsClient) ListPreparer(ctx context.Context, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/domains", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client DomainsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client DomainsClient) ListResponder(resp *http.Response) (result DomainListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/groups.go

@@ -0,0 +1,820 @@
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/Azure/go-autorest/autorest/validation"
+	"net/http"
+)
+
+// GroupsClient is the the Graph RBAC Management Client
+type GroupsClient struct {
+	BaseClient
+}
+
+// NewGroupsClient creates an instance of the GroupsClient client.
+func NewGroupsClient(tenantID string) GroupsClient {
+	return NewGroupsClientWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewGroupsClientWithBaseURI creates an instance of the GroupsClient client.
+func NewGroupsClientWithBaseURI(baseURI string, tenantID string) GroupsClient {
+	return GroupsClient{NewWithBaseURI(baseURI, tenantID)}
+}
+
+// AddMember add a member to a group.
+// Parameters:
+// groupObjectID - the object ID of the group to which to add the member.
+// parameters - the URL of the member object, such as
+// https://graph.windows.net/0b1f9851-1bf0-433f-aec3-cb9272f093dc/directoryObjects/f260bbc4-c254-447b-94cf-293b5ec434dd.
+func (client GroupsClient) AddMember(ctx context.Context, groupObjectID string, parameters GroupAddMemberParameters) (result autorest.Response, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.URL", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.GroupsClient", "AddMember", err.Error())
+	}
+
+	req, err := client.AddMemberPreparer(ctx, groupObjectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "AddMember", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.AddMemberSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "AddMember", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.AddMemberResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "AddMember", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// AddMemberPreparer prepares the AddMember request.
+func (client GroupsClient) AddMemberPreparer(ctx context.Context, groupObjectID string, parameters GroupAddMemberParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"groupObjectId": autorest.Encode("path", groupObjectID),
+		"tenantID":      autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups/{groupObjectId}/$links/members", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// AddMemberSender sends the AddMember request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) AddMemberSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// AddMemberResponder handles the response to the AddMember request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) AddMemberResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// Create create a group in the directory.
+// Parameters:
+// parameters - the parameters for the group to create.
+func (client GroupsClient) Create(ctx context.Context, parameters GroupCreateParameters) (result ADGroup, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.DisplayName", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.MailEnabled", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.MailNickname", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.SecurityEnabled", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.GroupsClient", "Create", err.Error())
+	}
+
+	req, err := client.CreatePreparer(ctx, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Create", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Create", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Create", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreatePreparer prepares the Create request.
+func (client GroupsClient) CreatePreparer(ctx context.Context, parameters GroupCreateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateSender sends the Create request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) CreateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateResponder handles the response to the Create request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) CreateResponder(resp *http.Response) (result ADGroup, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Delete delete a group from the directory.
+// Parameters:
+// objectID - the object ID of the group to delete.
+func (client GroupsClient) Delete(ctx context.Context, objectID string) (result autorest.Response, err error) {
+	req, err := client.DeletePreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Delete", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Delete", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Delete", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeletePreparer prepares the Delete request.
+func (client GroupsClient) DeletePreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups/{objectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteSender sends the Delete request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) DeleteSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteResponder handles the response to the Delete request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// Get gets group information from the directory.
+// Parameters:
+// objectID - the object ID of the user for which to get group information.
+func (client GroupsClient) Get(ctx context.Context, objectID string) (result ADGroup, err error) {
+	req, err := client.GetPreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client GroupsClient) GetPreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups/{objectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) GetResponder(resp *http.Response) (result ADGroup, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetGroupMembers gets the members of a group.
+// Parameters:
+// objectID - the object ID of the group whose members should be retrieved.
+func (client GroupsClient) GetGroupMembers(ctx context.Context, objectID string) (result GetObjectsResultPage, err error) {
+	result.fn = func(lastResult GetObjectsResult) (GetObjectsResult, error) {
+		if lastResult.OdataNextLink == nil || len(to.String(lastResult.OdataNextLink)) < 1 {
+			return GetObjectsResult{}, nil
+		}
+		return client.GetGroupMembersNext(ctx, *lastResult.OdataNextLink)
+	}
+	req, err := client.GetGroupMembersPreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetGroupMembers", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetGroupMembersSender(req)
+	if err != nil {
+		result.gor.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetGroupMembers", resp, "Failure sending request")
+		return
+	}
+
+	result.gor, err = client.GetGroupMembersResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetGroupMembers", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetGroupMembersPreparer prepares the GetGroupMembers request.
+func (client GroupsClient) GetGroupMembersPreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups/{objectId}/members", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetGroupMembersSender sends the GetGroupMembers request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) GetGroupMembersSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetGroupMembersResponder handles the response to the GetGroupMembers request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) GetGroupMembersResponder(resp *http.Response) (result GetObjectsResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetGroupMembersComplete enumerates all values, automatically crossing page boundaries as required.
+func (client GroupsClient) GetGroupMembersComplete(ctx context.Context, objectID string) (result GetObjectsResultIterator, err error) {
+	result.page, err = client.GetGroupMembers(ctx, objectID)
+	return
+}
+
+// GetGroupMembersNext gets the members of a group.
+// Parameters:
+// nextLink - next link for the list operation.
+func (client GroupsClient) GetGroupMembersNext(ctx context.Context, nextLink string) (result GetObjectsResult, err error) {
+	req, err := client.GetGroupMembersNextPreparer(ctx, nextLink)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetGroupMembersNext", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetGroupMembersNextSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetGroupMembersNext", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetGroupMembersNextResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetGroupMembersNext", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetGroupMembersNextPreparer prepares the GetGroupMembersNext request.
+func (client GroupsClient) GetGroupMembersNextPreparer(ctx context.Context, nextLink string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"nextLink": nextLink,
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/{nextLink}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetGroupMembersNextSender sends the GetGroupMembersNext request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) GetGroupMembersNextSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetGroupMembersNextResponder handles the response to the GetGroupMembersNext request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) GetGroupMembersNextResponder(resp *http.Response) (result GetObjectsResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetMemberGroups gets a collection of object IDs of groups of which the specified group is a member.
+// Parameters:
+// objectID - the object ID of the group for which to get group membership.
+// parameters - group filtering parameters.
+func (client GroupsClient) GetMemberGroups(ctx context.Context, objectID string, parameters GroupGetMemberGroupsParameters) (result GroupGetMemberGroupsResult, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.SecurityEnabledOnly", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.GroupsClient", "GetMemberGroups", err.Error())
+	}
+
+	req, err := client.GetMemberGroupsPreparer(ctx, objectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetMemberGroups", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetMemberGroupsSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetMemberGroups", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetMemberGroupsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "GetMemberGroups", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetMemberGroupsPreparer prepares the GetMemberGroups request.
+func (client GroupsClient) GetMemberGroupsPreparer(ctx context.Context, objectID string, parameters GroupGetMemberGroupsParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups/{objectId}/getMemberGroups", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetMemberGroupsSender sends the GetMemberGroups request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) GetMemberGroupsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetMemberGroupsResponder handles the response to the GetMemberGroups request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) GetMemberGroupsResponder(resp *http.Response) (result GroupGetMemberGroupsResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// IsMemberOf checks whether the specified user, group, contact, or service principal is a direct or transitive member
+// of the specified group.
+// Parameters:
+// parameters - the check group membership parameters.
+func (client GroupsClient) IsMemberOf(ctx context.Context, parameters CheckGroupMembershipParameters) (result CheckGroupMembershipResult, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.GroupID", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.MemberID", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.GroupsClient", "IsMemberOf", err.Error())
+	}
+
+	req, err := client.IsMemberOfPreparer(ctx, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "IsMemberOf", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.IsMemberOfSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "IsMemberOf", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.IsMemberOfResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "IsMemberOf", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// IsMemberOfPreparer prepares the IsMemberOf request.
+func (client GroupsClient) IsMemberOfPreparer(ctx context.Context, parameters CheckGroupMembershipParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/isMemberOf", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// IsMemberOfSender sends the IsMemberOf request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) IsMemberOfSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// IsMemberOfResponder handles the response to the IsMemberOf request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) IsMemberOfResponder(resp *http.Response) (result CheckGroupMembershipResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List gets list of groups for the current tenant.
+// Parameters:
+// filter - the filter to apply to the operation.
+func (client GroupsClient) List(ctx context.Context, filter string) (result GroupListResultPage, err error) {
+	result.fn = func(lastResult GroupListResult) (GroupListResult, error) {
+		if lastResult.OdataNextLink == nil || len(to.String(lastResult.OdataNextLink)) < 1 {
+			return GroupListResult{}, nil
+		}
+		return client.ListNext(ctx, *lastResult.OdataNextLink)
+	}
+	req, err := client.ListPreparer(ctx, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.glr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.glr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client GroupsClient) ListPreparer(ctx context.Context, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) ListResponder(resp *http.Response) (result GroupListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client GroupsClient) ListComplete(ctx context.Context, filter string) (result GroupListResultIterator, err error) {
+	result.page, err = client.List(ctx, filter)
+	return
+}
+
+// ListNext gets a list of groups for the current tenant.
+// Parameters:
+// nextLink - next link for the list operation.
+func (client GroupsClient) ListNext(ctx context.Context, nextLink string) (result GroupListResult, err error) {
+	req, err := client.ListNextPreparer(ctx, nextLink)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "ListNext", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListNextSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "ListNext", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListNextResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "ListNext", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListNextPreparer prepares the ListNext request.
+func (client GroupsClient) ListNextPreparer(ctx context.Context, nextLink string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"nextLink": nextLink,
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/{nextLink}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListNextSender sends the ListNext request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) ListNextSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListNextResponder handles the response to the ListNext request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) ListNextResponder(resp *http.Response) (result GroupListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// RemoveMember remove a member from a group.
+// Parameters:
+// groupObjectID - the object ID of the group from which to remove the member.
+// memberObjectID - member object id
+func (client GroupsClient) RemoveMember(ctx context.Context, groupObjectID string, memberObjectID string) (result autorest.Response, err error) {
+	req, err := client.RemoveMemberPreparer(ctx, groupObjectID, memberObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "RemoveMember", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.RemoveMemberSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "RemoveMember", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.RemoveMemberResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.GroupsClient", "RemoveMember", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// RemoveMemberPreparer prepares the RemoveMember request.
+func (client GroupsClient) RemoveMemberPreparer(ctx context.Context, groupObjectID string, memberObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"groupObjectId":  autorest.Encode("path", groupObjectID),
+		"memberObjectId": autorest.Encode("path", memberObjectID),
+		"tenantID":       autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/groups/{groupObjectId}/$links/members/{memberObjectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// RemoveMemberSender sends the RemoveMember request. The method will close the
+// http.Response Body if it receives an error.
+func (client GroupsClient) RemoveMemberSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// RemoveMemberResponder handles the response to the RemoveMember request. The method always
+// closes the http.Response Body.
+func (client GroupsClient) RemoveMemberResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/objects.go

@@ -0,0 +1,253 @@
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/Azure/go-autorest/autorest/validation"
+	"net/http"
+)
+
+// ObjectsClient is the the Graph RBAC Management Client
+type ObjectsClient struct {
+	BaseClient
+}
+
+// NewObjectsClient creates an instance of the ObjectsClient client.
+func NewObjectsClient(tenantID string) ObjectsClient {
+	return NewObjectsClientWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewObjectsClientWithBaseURI creates an instance of the ObjectsClient client.
+func NewObjectsClientWithBaseURI(baseURI string, tenantID string) ObjectsClient {
+	return ObjectsClient{NewWithBaseURI(baseURI, tenantID)}
+}
+
+// GetCurrentUser gets the details for the currently logged-in user.
+func (client ObjectsClient) GetCurrentUser(ctx context.Context) (result AADObject, err error) {
+	req, err := client.GetCurrentUserPreparer(ctx)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetCurrentUser", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetCurrentUserSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetCurrentUser", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetCurrentUserResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetCurrentUser", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetCurrentUserPreparer prepares the GetCurrentUser request.
+func (client ObjectsClient) GetCurrentUserPreparer(ctx context.Context) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/me", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetCurrentUserSender sends the GetCurrentUser request. The method will close the
+// http.Response Body if it receives an error.
+func (client ObjectsClient) GetCurrentUserSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetCurrentUserResponder handles the response to the GetCurrentUser request. The method always
+// closes the http.Response Body.
+func (client ObjectsClient) GetCurrentUserResponder(resp *http.Response) (result AADObject, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetObjectsByObjectIds gets AD group membership for the specified AD object IDs.
+// Parameters:
+// parameters - objects filtering parameters.
+func (client ObjectsClient) GetObjectsByObjectIds(ctx context.Context, parameters GetObjectsParameters) (result GetObjectsResultPage, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.IncludeDirectoryObjectReferences", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.ObjectsClient", "GetObjectsByObjectIds", err.Error())
+	}
+
+	result.fn = func(lastResult GetObjectsResult) (GetObjectsResult, error) {
+		if lastResult.OdataNextLink == nil || len(to.String(lastResult.OdataNextLink)) < 1 {
+			return GetObjectsResult{}, nil
+		}
+		return client.GetObjectsByObjectIdsNext(ctx, *lastResult.OdataNextLink)
+	}
+	req, err := client.GetObjectsByObjectIdsPreparer(ctx, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetObjectsByObjectIds", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetObjectsByObjectIdsSender(req)
+	if err != nil {
+		result.gor.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetObjectsByObjectIds", resp, "Failure sending request")
+		return
+	}
+
+	result.gor, err = client.GetObjectsByObjectIdsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetObjectsByObjectIds", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetObjectsByObjectIdsPreparer prepares the GetObjectsByObjectIds request.
+func (client ObjectsClient) GetObjectsByObjectIdsPreparer(ctx context.Context, parameters GetObjectsParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/getObjectsByObjectIds", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetObjectsByObjectIdsSender sends the GetObjectsByObjectIds request. The method will close the
+// http.Response Body if it receives an error.
+func (client ObjectsClient) GetObjectsByObjectIdsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetObjectsByObjectIdsResponder handles the response to the GetObjectsByObjectIds request. The method always
+// closes the http.Response Body.
+func (client ObjectsClient) GetObjectsByObjectIdsResponder(resp *http.Response) (result GetObjectsResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetObjectsByObjectIdsComplete enumerates all values, automatically crossing page boundaries as required.
+func (client ObjectsClient) GetObjectsByObjectIdsComplete(ctx context.Context, parameters GetObjectsParameters) (result GetObjectsResultIterator, err error) {
+	result.page, err = client.GetObjectsByObjectIds(ctx, parameters)
+	return
+}
+
+// GetObjectsByObjectIdsNext gets AD group membership for the specified AD object IDs.
+// Parameters:
+// nextLink - next link for the list operation.
+func (client ObjectsClient) GetObjectsByObjectIdsNext(ctx context.Context, nextLink string) (result GetObjectsResult, err error) {
+	req, err := client.GetObjectsByObjectIdsNextPreparer(ctx, nextLink)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetObjectsByObjectIdsNext", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetObjectsByObjectIdsNextSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetObjectsByObjectIdsNext", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetObjectsByObjectIdsNextResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ObjectsClient", "GetObjectsByObjectIdsNext", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetObjectsByObjectIdsNextPreparer prepares the GetObjectsByObjectIdsNext request.
+func (client ObjectsClient) GetObjectsByObjectIdsNextPreparer(ctx context.Context, nextLink string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"nextLink": nextLink,
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/{nextLink}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetObjectsByObjectIdsNextSender sends the GetObjectsByObjectIdsNext request. The method will close the
+// http.Response Body if it receives an error.
+func (client ObjectsClient) GetObjectsByObjectIdsNextSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetObjectsByObjectIdsNextResponder handles the response to the GetObjectsByObjectIdsNext request. The method always
+// closes the http.Response Body.
+func (client ObjectsClient) GetObjectsByObjectIdsNextResponder(resp *http.Response) (result GetObjectsResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/serviceprincipals.go

@@ -0,0 +1,717 @@
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/Azure/go-autorest/autorest/validation"
+	"net/http"
+)
+
+// ServicePrincipalsClient is the the Graph RBAC Management Client
+type ServicePrincipalsClient struct {
+	BaseClient
+}
+
+// NewServicePrincipalsClient creates an instance of the ServicePrincipalsClient client.
+func NewServicePrincipalsClient(tenantID string) ServicePrincipalsClient {
+	return NewServicePrincipalsClientWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewServicePrincipalsClientWithBaseURI creates an instance of the ServicePrincipalsClient client.
+func NewServicePrincipalsClientWithBaseURI(baseURI string, tenantID string) ServicePrincipalsClient {
+	return ServicePrincipalsClient{NewWithBaseURI(baseURI, tenantID)}
+}
+
+// Create creates a service principal in the directory.
+// Parameters:
+// parameters - parameters to create a service principal.
+func (client ServicePrincipalsClient) Create(ctx context.Context, parameters ServicePrincipalCreateParameters) (result ServicePrincipal, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.AppID", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.AccountEnabled", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.ServicePrincipalsClient", "Create", err.Error())
+	}
+
+	req, err := client.CreatePreparer(ctx, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Create", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Create", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Create", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreatePreparer prepares the Create request.
+func (client ServicePrincipalsClient) CreatePreparer(ctx context.Context, parameters ServicePrincipalCreateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateSender sends the Create request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) CreateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateResponder handles the response to the Create request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) CreateResponder(resp *http.Response) (result ServicePrincipal, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Delete deletes a service principal from the directory.
+// Parameters:
+// objectID - the object ID of the service principal to delete.
+func (client ServicePrincipalsClient) Delete(ctx context.Context, objectID string) (result autorest.Response, err error) {
+	req, err := client.DeletePreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Delete", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Delete", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Delete", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeletePreparer prepares the Delete request.
+func (client ServicePrincipalsClient) DeletePreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteSender sends the Delete request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) DeleteSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteResponder handles the response to the Delete request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// Get gets service principal information from the directory.
+// Parameters:
+// objectID - the object ID of the service principal to get.
+func (client ServicePrincipalsClient) Get(ctx context.Context, objectID string) (result ServicePrincipal, err error) {
+	req, err := client.GetPreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client ServicePrincipalsClient) GetPreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) GetResponder(resp *http.Response) (result ServicePrincipal, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List gets a list of service principals from the current tenant.
+// Parameters:
+// filter - the filter to apply to the operation.
+func (client ServicePrincipalsClient) List(ctx context.Context, filter string) (result ServicePrincipalListResultPage, err error) {
+	result.fn = func(lastResult ServicePrincipalListResult) (ServicePrincipalListResult, error) {
+		if lastResult.OdataNextLink == nil || len(to.String(lastResult.OdataNextLink)) < 1 {
+			return ServicePrincipalListResult{}, nil
+		}
+		return client.ListNext(ctx, *lastResult.OdataNextLink)
+	}
+	req, err := client.ListPreparer(ctx, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.splr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.splr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client ServicePrincipalsClient) ListPreparer(ctx context.Context, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) ListResponder(resp *http.Response) (result ServicePrincipalListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client ServicePrincipalsClient) ListComplete(ctx context.Context, filter string) (result ServicePrincipalListResultIterator, err error) {
+	result.page, err = client.List(ctx, filter)
+	return
+}
+
+// ListKeyCredentials get the keyCredentials associated with the specified service principal.
+// Parameters:
+// objectID - the object ID of the service principal for which to get keyCredentials.
+func (client ServicePrincipalsClient) ListKeyCredentials(ctx context.Context, objectID string) (result KeyCredentialListResult, err error) {
+	req, err := client.ListKeyCredentialsPreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListKeyCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListKeyCredentialsSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListKeyCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListKeyCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListKeyCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListKeyCredentialsPreparer prepares the ListKeyCredentials request.
+func (client ServicePrincipalsClient) ListKeyCredentialsPreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}/keyCredentials", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListKeyCredentialsSender sends the ListKeyCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) ListKeyCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListKeyCredentialsResponder handles the response to the ListKeyCredentials request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) ListKeyCredentialsResponder(resp *http.Response) (result KeyCredentialListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListNext gets a list of service principals from the current tenant.
+// Parameters:
+// nextLink - next link for the list operation.
+func (client ServicePrincipalsClient) ListNext(ctx context.Context, nextLink string) (result ServicePrincipalListResult, err error) {
+	req, err := client.ListNextPreparer(ctx, nextLink)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListNext", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListNextSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListNext", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListNextResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListNext", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListNextPreparer prepares the ListNext request.
+func (client ServicePrincipalsClient) ListNextPreparer(ctx context.Context, nextLink string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"nextLink": nextLink,
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/{nextLink}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListNextSender sends the ListNext request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) ListNextSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListNextResponder handles the response to the ListNext request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) ListNextResponder(resp *http.Response) (result ServicePrincipalListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListOwners the owners are a set of non-admin users who are allowed to modify this object.
+// Parameters:
+// objectID - the object ID of the service principal for which to get owners.
+func (client ServicePrincipalsClient) ListOwners(ctx context.Context, objectID string) (result DirectoryObjectListResult, err error) {
+	req, err := client.ListOwnersPreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListOwners", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListOwnersSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListOwners", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListOwnersResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListOwners", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListOwnersPreparer prepares the ListOwners request.
+func (client ServicePrincipalsClient) ListOwnersPreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}/owners", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListOwnersSender sends the ListOwners request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) ListOwnersSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListOwnersResponder handles the response to the ListOwners request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) ListOwnersResponder(resp *http.Response) (result DirectoryObjectListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListPasswordCredentials gets the passwordCredentials associated with a service principal.
+// Parameters:
+// objectID - the object ID of the service principal.
+func (client ServicePrincipalsClient) ListPasswordCredentials(ctx context.Context, objectID string) (result PasswordCredentialListResult, err error) {
+	req, err := client.ListPasswordCredentialsPreparer(ctx, objectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListPasswordCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListPasswordCredentialsSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListPasswordCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListPasswordCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "ListPasswordCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPasswordCredentialsPreparer prepares the ListPasswordCredentials request.
+func (client ServicePrincipalsClient) ListPasswordCredentialsPreparer(ctx context.Context, objectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}/passwordCredentials", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListPasswordCredentialsSender sends the ListPasswordCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) ListPasswordCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListPasswordCredentialsResponder handles the response to the ListPasswordCredentials request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) ListPasswordCredentialsResponder(resp *http.Response) (result PasswordCredentialListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// UpdateKeyCredentials update the keyCredentials associated with a service principal.
+// Parameters:
+// objectID - the object ID for which to get service principal information.
+// parameters - parameters to update the keyCredentials of an existing service principal.
+func (client ServicePrincipalsClient) UpdateKeyCredentials(ctx context.Context, objectID string, parameters KeyCredentialsUpdateParameters) (result autorest.Response, err error) {
+	req, err := client.UpdateKeyCredentialsPreparer(ctx, objectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "UpdateKeyCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.UpdateKeyCredentialsSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "UpdateKeyCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.UpdateKeyCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "UpdateKeyCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// UpdateKeyCredentialsPreparer prepares the UpdateKeyCredentials request.
+func (client ServicePrincipalsClient) UpdateKeyCredentialsPreparer(ctx context.Context, objectID string, parameters KeyCredentialsUpdateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPatch(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}/keyCredentials", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// UpdateKeyCredentialsSender sends the UpdateKeyCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) UpdateKeyCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// UpdateKeyCredentialsResponder handles the response to the UpdateKeyCredentials request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) UpdateKeyCredentialsResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// UpdatePasswordCredentials updates the passwordCredentials associated with a service principal.
+// Parameters:
+// objectID - the object ID of the service principal.
+// parameters - parameters to update the passwordCredentials of an existing service principal.
+func (client ServicePrincipalsClient) UpdatePasswordCredentials(ctx context.Context, objectID string, parameters PasswordCredentialsUpdateParameters) (result autorest.Response, err error) {
+	req, err := client.UpdatePasswordCredentialsPreparer(ctx, objectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "UpdatePasswordCredentials", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.UpdatePasswordCredentialsSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "UpdatePasswordCredentials", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.UpdatePasswordCredentialsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.ServicePrincipalsClient", "UpdatePasswordCredentials", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// UpdatePasswordCredentialsPreparer prepares the UpdatePasswordCredentials request.
+func (client ServicePrincipalsClient) UpdatePasswordCredentialsPreparer(ctx context.Context, objectID string, parameters PasswordCredentialsUpdateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPatch(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/servicePrincipals/{objectId}/passwordCredentials", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// UpdatePasswordCredentialsSender sends the UpdatePasswordCredentials request. The method will close the
+// http.Response Body if it receives an error.
+func (client ServicePrincipalsClient) UpdatePasswordCredentialsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// UpdatePasswordCredentialsResponder handles the response to the UpdatePasswordCredentials request. The method always
+// closes the http.Response Body.
+func (client ServicePrincipalsClient) UpdatePasswordCredentialsResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/users.go

@@ -0,0 +1,533 @@
+package graphrbac
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/Azure/go-autorest/autorest/validation"
+	"net/http"
+)
+
+// UsersClient is the the Graph RBAC Management Client
+type UsersClient struct {
+	BaseClient
+}
+
+// NewUsersClient creates an instance of the UsersClient client.
+func NewUsersClient(tenantID string) UsersClient {
+	return NewUsersClientWithBaseURI(DefaultBaseURI, tenantID)
+}
+
+// NewUsersClientWithBaseURI creates an instance of the UsersClient client.
+func NewUsersClientWithBaseURI(baseURI string, tenantID string) UsersClient {
+	return UsersClient{NewWithBaseURI(baseURI, tenantID)}
+}
+
+// Create create a new user.
+// Parameters:
+// parameters - parameters to create a user.
+func (client UsersClient) Create(ctx context.Context, parameters UserCreateParameters) (result User, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.AccountEnabled", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.DisplayName", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.PasswordProfile", Name: validation.Null, Rule: true,
+					Chain: []validation.Constraint{{Target: "parameters.PasswordProfile.Password", Name: validation.Null, Rule: true, Chain: nil}}},
+				{Target: "parameters.UserPrincipalName", Name: validation.Null, Rule: true, Chain: nil},
+				{Target: "parameters.MailNickname", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.UsersClient", "Create", err.Error())
+	}
+
+	req, err := client.CreatePreparer(ctx, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Create", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Create", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Create", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreatePreparer prepares the Create request.
+func (client UsersClient) CreatePreparer(ctx context.Context, parameters UserCreateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/users", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateSender sends the Create request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) CreateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateResponder handles the response to the Create request. The method always
+// closes the http.Response Body.
+func (client UsersClient) CreateResponder(resp *http.Response) (result User, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Delete delete a user.
+// Parameters:
+// upnOrObjectID - the object ID or principal name of the user to delete.
+func (client UsersClient) Delete(ctx context.Context, upnOrObjectID string) (result autorest.Response, err error) {
+	req, err := client.DeletePreparer(ctx, upnOrObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Delete", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Delete", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Delete", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeletePreparer prepares the Delete request.
+func (client UsersClient) DeletePreparer(ctx context.Context, upnOrObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID":      autorest.Encode("path", client.TenantID),
+		"upnOrObjectId": autorest.Encode("path", upnOrObjectID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/users/{upnOrObjectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteSender sends the Delete request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) DeleteSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteResponder handles the response to the Delete request. The method always
+// closes the http.Response Body.
+func (client UsersClient) DeleteResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}
+
+// Get gets user information from the directory.
+// Parameters:
+// upnOrObjectID - the object ID or principal name of the user for which to get information.
+func (client UsersClient) Get(ctx context.Context, upnOrObjectID string) (result User, err error) {
+	req, err := client.GetPreparer(ctx, upnOrObjectID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client UsersClient) GetPreparer(ctx context.Context, upnOrObjectID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID":      autorest.Encode("path", client.TenantID),
+		"upnOrObjectId": autorest.Encode("path", upnOrObjectID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/users/{upnOrObjectId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client UsersClient) GetResponder(resp *http.Response) (result User, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetMemberGroups gets a collection that contains the object IDs of the groups of which the user is a member.
+// Parameters:
+// objectID - the object ID of the user for which to get group membership.
+// parameters - user filtering parameters.
+func (client UsersClient) GetMemberGroups(ctx context.Context, objectID string, parameters UserGetMemberGroupsParameters) (result UserGetMemberGroupsResult, err error) {
+	if err := validation.Validate([]validation.Validation{
+		{TargetValue: parameters,
+			Constraints: []validation.Constraint{{Target: "parameters.SecurityEnabledOnly", Name: validation.Null, Rule: true, Chain: nil}}}}); err != nil {
+		return result, validation.NewError("graphrbac.UsersClient", "GetMemberGroups", err.Error())
+	}
+
+	req, err := client.GetMemberGroupsPreparer(ctx, objectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "GetMemberGroups", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetMemberGroupsSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "GetMemberGroups", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetMemberGroupsResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "GetMemberGroups", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetMemberGroupsPreparer prepares the GetMemberGroups request.
+func (client UsersClient) GetMemberGroupsPreparer(ctx context.Context, objectID string, parameters UserGetMemberGroupsParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"objectId": autorest.Encode("path", objectID),
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPost(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/users/{objectId}/getMemberGroups", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetMemberGroupsSender sends the GetMemberGroups request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) GetMemberGroupsSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetMemberGroupsResponder handles the response to the GetMemberGroups request. The method always
+// closes the http.Response Body.
+func (client UsersClient) GetMemberGroupsResponder(resp *http.Response) (result UserGetMemberGroupsResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List gets list of users for the current tenant.
+// Parameters:
+// filter - the filter to apply to the operation.
+func (client UsersClient) List(ctx context.Context, filter string) (result UserListResultPage, err error) {
+	result.fn = func(lastResult UserListResult) (UserListResult, error) {
+		if lastResult.OdataNextLink == nil || len(to.String(lastResult.OdataNextLink)) < 1 {
+			return UserListResult{}, nil
+		}
+		return client.ListNext(ctx, *lastResult.OdataNextLink)
+	}
+	req, err := client.ListPreparer(ctx, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.ulr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.ulr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client UsersClient) ListPreparer(ctx context.Context, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/users", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client UsersClient) ListResponder(resp *http.Response) (result UserListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client UsersClient) ListComplete(ctx context.Context, filter string) (result UserListResultIterator, err error) {
+	result.page, err = client.List(ctx, filter)
+	return
+}
+
+// ListNext gets a list of users for the current tenant.
+// Parameters:
+// nextLink - next link for the list operation.
+func (client UsersClient) ListNext(ctx context.Context, nextLink string) (result UserListResult, err error) {
+	req, err := client.ListNextPreparer(ctx, nextLink)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "ListNext", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListNextSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "ListNext", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.ListNextResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "ListNext", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListNextPreparer prepares the ListNext request.
+func (client UsersClient) ListNextPreparer(ctx context.Context, nextLink string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"nextLink": nextLink,
+		"tenantID": autorest.Encode("path", client.TenantID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/{nextLink}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListNextSender sends the ListNext request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) ListNextSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListNextResponder handles the response to the ListNext request. The method always
+// closes the http.Response Body.
+func (client UsersClient) ListNextResponder(resp *http.Response) (result UserListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Update updates a user.
+// Parameters:
+// upnOrObjectID - the object ID or principal name of the user to update.
+// parameters - parameters to update an existing user.
+func (client UsersClient) Update(ctx context.Context, upnOrObjectID string, parameters UserUpdateParameters) (result autorest.Response, err error) {
+	req, err := client.UpdatePreparer(ctx, upnOrObjectID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Update", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.UpdateSender(req)
+	if err != nil {
+		result.Response = resp
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Update", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.UpdateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "graphrbac.UsersClient", "Update", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// UpdatePreparer prepares the Update request.
+func (client UsersClient) UpdatePreparer(ctx context.Context, upnOrObjectID string, parameters UserUpdateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"tenantID":      autorest.Encode("path", client.TenantID),
+		"upnOrObjectId": autorest.Encode("path", upnOrObjectID),
+	}
+
+	const APIVersion = "1.6"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPatch(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{tenantID}/users/{upnOrObjectId}", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// UpdateSender sends the Update request. The method will close the
+// http.Response Body if it receives an error.
+func (client UsersClient) UpdateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// UpdateResponder handles the response to the Update request. The method always
+// closes the http.Response Body.
+func (client UsersClient) UpdateResponder(resp *http.Response) (result autorest.Response, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusNoContent),
+		autorest.ByClosing())
+	result.Response = resp
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac/version.go

@@ -0,0 +1,30 @@
+package graphrbac
+
+import "github.com/Azure/azure-sdk-for-go/version"
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+// UserAgent returns the UserAgent string to use when sending http.Requests.
+func UserAgent() string {
+	return "Azure-SDK-For-Go/" + version.Number + " graphrbac/1.6"
+}
+
+// Version returns the semantic version (see http://semver.org) of the client.
+func Version() string {
+	return version.Number
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/classicadministrators.go

@@ -0,0 +1,133 @@
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"net/http"
+)
+
+// ClassicAdministratorsClient is the role based access control provides you a way to apply granular level policy
+// administration down to individual resources or resource groups. These operations enable you to manage role
+// definitions and role assignments. A role definition describes the set of actions that can be performed on resources.
+// A role assignment grants access to Azure Active Directory users.
+type ClassicAdministratorsClient struct {
+	BaseClient
+}
+
+// NewClassicAdministratorsClient creates an instance of the ClassicAdministratorsClient client.
+func NewClassicAdministratorsClient(subscriptionID string) ClassicAdministratorsClient {
+	return NewClassicAdministratorsClientWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewClassicAdministratorsClientWithBaseURI creates an instance of the ClassicAdministratorsClient client.
+func NewClassicAdministratorsClientWithBaseURI(baseURI string, subscriptionID string) ClassicAdministratorsClient {
+	return ClassicAdministratorsClient{NewWithBaseURI(baseURI, subscriptionID)}
+}
+
+// List gets service administrator, account administrator, and co-administrators for the subscription.
+func (client ClassicAdministratorsClient) List(ctx context.Context) (result ClassicAdministratorListResultPage, err error) {
+	result.fn = client.listNextResults
+	req, err := client.ListPreparer(ctx)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ClassicAdministratorsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.calr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.ClassicAdministratorsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.calr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ClassicAdministratorsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client ClassicAdministratorsClient) ListPreparer(ctx context.Context) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"subscriptionId": autorest.Encode("path", client.SubscriptionID),
+	}
+
+	const APIVersion = "2015-06-01"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/classicAdministrators", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client ClassicAdministratorsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		azure.DoRetryWithRegistration(client.Client))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client ClassicAdministratorsClient) ListResponder(resp *http.Response) (result ClassicAdministratorListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listNextResults retrieves the next set of results, if any.
+func (client ClassicAdministratorsClient) listNextResults(lastResults ClassicAdministratorListResult) (result ClassicAdministratorListResult, err error) {
+	req, err := lastResults.classicAdministratorListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.ClassicAdministratorsClient", "listNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.ClassicAdministratorsClient", "listNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ClassicAdministratorsClient", "listNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client ClassicAdministratorsClient) ListComplete(ctx context.Context) (result ClassicAdministratorListResultIterator, err error) {
+	result.page, err = client.List(ctx)
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/client.go

@@ -0,0 +1,54 @@
+// Package authorization implements the Azure ARM Authorization service API version .
+//
+// Role based access control provides you a way to apply granular level policy administration down to individual
+// resources or resource groups. These operations enable you to manage role definitions and role assignments. A role
+// definition describes the set of actions that can be performed on resources. A role assignment grants access to Azure
+// Active Directory users.
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"github.com/Azure/go-autorest/autorest"
+)
+
+const (
+	// DefaultBaseURI is the default URI used for the service Authorization
+	DefaultBaseURI = "https://management.azure.com"
+)
+
+// BaseClient is the base client for Authorization.
+type BaseClient struct {
+	autorest.Client
+	BaseURI        string
+	SubscriptionID string
+}
+
+// New creates an instance of the BaseClient client.
+func New(subscriptionID string) BaseClient {
+	return NewWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewWithBaseURI creates an instance of the BaseClient client.
+func NewWithBaseURI(baseURI string, subscriptionID string) BaseClient {
+	return BaseClient{
+		Client:         autorest.NewClientWithUserAgent(UserAgent()),
+		BaseURI:        baseURI,
+		SubscriptionID: subscriptionID,
+	}
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/models.go

@@ -0,0 +1,935 @@
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"encoding/json"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/to"
+	"net/http"
+)
+
+// ClassicAdministrator classic Administrators
+type ClassicAdministrator struct {
+	// ID - The ID of the administrator.
+	ID *string `json:"id,omitempty"`
+	// Name - The name of the administrator.
+	Name *string `json:"name,omitempty"`
+	// Type - The type of the administrator.
+	Type *string `json:"type,omitempty"`
+	// ClassicAdministratorProperties - Properties for the classic administrator.
+	*ClassicAdministratorProperties `json:"properties,omitempty"`
+}
+
+// MarshalJSON is the custom marshaler for ClassicAdministrator.
+func (ca ClassicAdministrator) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	if ca.ID != nil {
+		objectMap["id"] = ca.ID
+	}
+	if ca.Name != nil {
+		objectMap["name"] = ca.Name
+	}
+	if ca.Type != nil {
+		objectMap["type"] = ca.Type
+	}
+	if ca.ClassicAdministratorProperties != nil {
+		objectMap["properties"] = ca.ClassicAdministratorProperties
+	}
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON is the custom unmarshaler for ClassicAdministrator struct.
+func (ca *ClassicAdministrator) UnmarshalJSON(body []byte) error {
+	var m map[string]*json.RawMessage
+	err := json.Unmarshal(body, &m)
+	if err != nil {
+		return err
+	}
+	for k, v := range m {
+		switch k {
+		case "id":
+			if v != nil {
+				var ID string
+				err = json.Unmarshal(*v, &ID)
+				if err != nil {
+					return err
+				}
+				ca.ID = &ID
+			}
+		case "name":
+			if v != nil {
+				var name string
+				err = json.Unmarshal(*v, &name)
+				if err != nil {
+					return err
+				}
+				ca.Name = &name
+			}
+		case "type":
+			if v != nil {
+				var typeVar string
+				err = json.Unmarshal(*v, &typeVar)
+				if err != nil {
+					return err
+				}
+				ca.Type = &typeVar
+			}
+		case "properties":
+			if v != nil {
+				var classicAdministratorProperties ClassicAdministratorProperties
+				err = json.Unmarshal(*v, &classicAdministratorProperties)
+				if err != nil {
+					return err
+				}
+				ca.ClassicAdministratorProperties = &classicAdministratorProperties
+			}
+		}
+	}
+
+	return nil
+}
+
+// ClassicAdministratorListResult classicAdministrator list result information.
+type ClassicAdministratorListResult struct {
+	autorest.Response `json:"-"`
+	// Value - An array of administrators.
+	Value *[]ClassicAdministrator `json:"value,omitempty"`
+	// NextLink - The URL to use for getting the next set of results.
+	NextLink *string `json:"nextLink,omitempty"`
+}
+
+// ClassicAdministratorListResultIterator provides access to a complete listing of ClassicAdministrator values.
+type ClassicAdministratorListResultIterator struct {
+	i    int
+	page ClassicAdministratorListResultPage
+}
+
+// Next advances to the next value.  If there was an error making
+// the request the iterator does not advance and the error is returned.
+func (iter *ClassicAdministratorListResultIterator) Next() error {
+	iter.i++
+	if iter.i < len(iter.page.Values()) {
+		return nil
+	}
+	err := iter.page.Next()
+	if err != nil {
+		iter.i--
+		return err
+	}
+	iter.i = 0
+	return nil
+}
+
+// NotDone returns true if the enumeration should be started or is not yet complete.
+func (iter ClassicAdministratorListResultIterator) NotDone() bool {
+	return iter.page.NotDone() && iter.i < len(iter.page.Values())
+}
+
+// Response returns the raw server response from the last page request.
+func (iter ClassicAdministratorListResultIterator) Response() ClassicAdministratorListResult {
+	return iter.page.Response()
+}
+
+// Value returns the current value or a zero-initialized value if the
+// iterator has advanced beyond the end of the collection.
+func (iter ClassicAdministratorListResultIterator) Value() ClassicAdministrator {
+	if !iter.page.NotDone() {
+		return ClassicAdministrator{}
+	}
+	return iter.page.Values()[iter.i]
+}
+
+// IsEmpty returns true if the ListResult contains no values.
+func (calr ClassicAdministratorListResult) IsEmpty() bool {
+	return calr.Value == nil || len(*calr.Value) == 0
+}
+
+// classicAdministratorListResultPreparer prepares a request to retrieve the next set of results.
+// It returns nil if no more results exist.
+func (calr ClassicAdministratorListResult) classicAdministratorListResultPreparer() (*http.Request, error) {
+	if calr.NextLink == nil || len(to.String(calr.NextLink)) < 1 {
+		return nil, nil
+	}
+	return autorest.Prepare(&http.Request{},
+		autorest.AsJSON(),
+		autorest.AsGet(),
+		autorest.WithBaseURL(to.String(calr.NextLink)))
+}
+
+// ClassicAdministratorListResultPage contains a page of ClassicAdministrator values.
+type ClassicAdministratorListResultPage struct {
+	fn   func(ClassicAdministratorListResult) (ClassicAdministratorListResult, error)
+	calr ClassicAdministratorListResult
+}
+
+// Next advances to the next page of values.  If there was an error making
+// the request the page does not advance and the error is returned.
+func (page *ClassicAdministratorListResultPage) Next() error {
+	next, err := page.fn(page.calr)
+	if err != nil {
+		return err
+	}
+	page.calr = next
+	return nil
+}
+
+// NotDone returns true if the page enumeration should be started or is not yet complete.
+func (page ClassicAdministratorListResultPage) NotDone() bool {
+	return !page.calr.IsEmpty()
+}
+
+// Response returns the raw server response from the last page request.
+func (page ClassicAdministratorListResultPage) Response() ClassicAdministratorListResult {
+	return page.calr
+}
+
+// Values returns the slice of values for the current page or nil if there are no values.
+func (page ClassicAdministratorListResultPage) Values() []ClassicAdministrator {
+	if page.calr.IsEmpty() {
+		return nil
+	}
+	return *page.calr.Value
+}
+
+// ClassicAdministratorProperties classic Administrator properties.
+type ClassicAdministratorProperties struct {
+	// EmailAddress - The email address of the administrator.
+	EmailAddress *string `json:"emailAddress,omitempty"`
+	// Role - The role of the administrator.
+	Role *string `json:"role,omitempty"`
+}
+
+// Permission role definition permissions.
+type Permission struct {
+	// Actions - Allowed actions.
+	Actions *[]string `json:"actions,omitempty"`
+	// NotActions - Denied actions.
+	NotActions *[]string `json:"notActions,omitempty"`
+	// DataActions - Allowed Data actions.
+	DataActions *[]string `json:"dataActions,omitempty"`
+	// NotDataActions - Denied Data actions.
+	NotDataActions *[]string `json:"notDataActions,omitempty"`
+}
+
+// PermissionGetResult permissions information.
+type PermissionGetResult struct {
+	autorest.Response `json:"-"`
+	// Value - An array of permissions.
+	Value *[]Permission `json:"value,omitempty"`
+	// NextLink - The URL to use for getting the next set of results.
+	NextLink *string `json:"nextLink,omitempty"`
+}
+
+// PermissionGetResultIterator provides access to a complete listing of Permission values.
+type PermissionGetResultIterator struct {
+	i    int
+	page PermissionGetResultPage
+}
+
+// Next advances to the next value.  If there was an error making
+// the request the iterator does not advance and the error is returned.
+func (iter *PermissionGetResultIterator) Next() error {
+	iter.i++
+	if iter.i < len(iter.page.Values()) {
+		return nil
+	}
+	err := iter.page.Next()
+	if err != nil {
+		iter.i--
+		return err
+	}
+	iter.i = 0
+	return nil
+}
+
+// NotDone returns true if the enumeration should be started or is not yet complete.
+func (iter PermissionGetResultIterator) NotDone() bool {
+	return iter.page.NotDone() && iter.i < len(iter.page.Values())
+}
+
+// Response returns the raw server response from the last page request.
+func (iter PermissionGetResultIterator) Response() PermissionGetResult {
+	return iter.page.Response()
+}
+
+// Value returns the current value or a zero-initialized value if the
+// iterator has advanced beyond the end of the collection.
+func (iter PermissionGetResultIterator) Value() Permission {
+	if !iter.page.NotDone() {
+		return Permission{}
+	}
+	return iter.page.Values()[iter.i]
+}
+
+// IsEmpty returns true if the ListResult contains no values.
+func (pgr PermissionGetResult) IsEmpty() bool {
+	return pgr.Value == nil || len(*pgr.Value) == 0
+}
+
+// permissionGetResultPreparer prepares a request to retrieve the next set of results.
+// It returns nil if no more results exist.
+func (pgr PermissionGetResult) permissionGetResultPreparer() (*http.Request, error) {
+	if pgr.NextLink == nil || len(to.String(pgr.NextLink)) < 1 {
+		return nil, nil
+	}
+	return autorest.Prepare(&http.Request{},
+		autorest.AsJSON(),
+		autorest.AsGet(),
+		autorest.WithBaseURL(to.String(pgr.NextLink)))
+}
+
+// PermissionGetResultPage contains a page of Permission values.
+type PermissionGetResultPage struct {
+	fn  func(PermissionGetResult) (PermissionGetResult, error)
+	pgr PermissionGetResult
+}
+
+// Next advances to the next page of values.  If there was an error making
+// the request the page does not advance and the error is returned.
+func (page *PermissionGetResultPage) Next() error {
+	next, err := page.fn(page.pgr)
+	if err != nil {
+		return err
+	}
+	page.pgr = next
+	return nil
+}
+
+// NotDone returns true if the page enumeration should be started or is not yet complete.
+func (page PermissionGetResultPage) NotDone() bool {
+	return !page.pgr.IsEmpty()
+}
+
+// Response returns the raw server response from the last page request.
+func (page PermissionGetResultPage) Response() PermissionGetResult {
+	return page.pgr
+}
+
+// Values returns the slice of values for the current page or nil if there are no values.
+func (page PermissionGetResultPage) Values() []Permission {
+	if page.pgr.IsEmpty() {
+		return nil
+	}
+	return *page.pgr.Value
+}
+
+// ProviderOperation operation
+type ProviderOperation struct {
+	// Name - The operation name.
+	Name *string `json:"name,omitempty"`
+	// DisplayName - The operation display name.
+	DisplayName *string `json:"displayName,omitempty"`
+	// Description - The operation description.
+	Description *string `json:"description,omitempty"`
+	// Origin - The operation origin.
+	Origin *string `json:"origin,omitempty"`
+	// Properties - The operation properties.
+	Properties interface{} `json:"properties,omitempty"`
+	// IsDataAction - The dataAction flag to specify the operation type.
+	IsDataAction *bool `json:"isDataAction,omitempty"`
+}
+
+// ProviderOperationsMetadata provider Operations metadata
+type ProviderOperationsMetadata struct {
+	autorest.Response `json:"-"`
+	// ID - The provider id.
+	ID *string `json:"id,omitempty"`
+	// Name - The provider name.
+	Name *string `json:"name,omitempty"`
+	// Type - The provider type.
+	Type *string `json:"type,omitempty"`
+	// DisplayName - The provider display name.
+	DisplayName *string `json:"displayName,omitempty"`
+	// ResourceTypes - The provider resource types
+	ResourceTypes *[]ResourceType `json:"resourceTypes,omitempty"`
+	// Operations - The provider operations.
+	Operations *[]ProviderOperation `json:"operations,omitempty"`
+}
+
+// ProviderOperationsMetadataListResult provider operations metadata list
+type ProviderOperationsMetadataListResult struct {
+	autorest.Response `json:"-"`
+	// Value - The list of providers.
+	Value *[]ProviderOperationsMetadata `json:"value,omitempty"`
+	// NextLink - The URL to use for getting the next set of results.
+	NextLink *string `json:"nextLink,omitempty"`
+}
+
+// ProviderOperationsMetadataListResultIterator provides access to a complete listing of ProviderOperationsMetadata
+// values.
+type ProviderOperationsMetadataListResultIterator struct {
+	i    int
+	page ProviderOperationsMetadataListResultPage
+}
+
+// Next advances to the next value.  If there was an error making
+// the request the iterator does not advance and the error is returned.
+func (iter *ProviderOperationsMetadataListResultIterator) Next() error {
+	iter.i++
+	if iter.i < len(iter.page.Values()) {
+		return nil
+	}
+	err := iter.page.Next()
+	if err != nil {
+		iter.i--
+		return err
+	}
+	iter.i = 0
+	return nil
+}
+
+// NotDone returns true if the enumeration should be started or is not yet complete.
+func (iter ProviderOperationsMetadataListResultIterator) NotDone() bool {
+	return iter.page.NotDone() && iter.i < len(iter.page.Values())
+}
+
+// Response returns the raw server response from the last page request.
+func (iter ProviderOperationsMetadataListResultIterator) Response() ProviderOperationsMetadataListResult {
+	return iter.page.Response()
+}
+
+// Value returns the current value or a zero-initialized value if the
+// iterator has advanced beyond the end of the collection.
+func (iter ProviderOperationsMetadataListResultIterator) Value() ProviderOperationsMetadata {
+	if !iter.page.NotDone() {
+		return ProviderOperationsMetadata{}
+	}
+	return iter.page.Values()[iter.i]
+}
+
+// IsEmpty returns true if the ListResult contains no values.
+func (pomlr ProviderOperationsMetadataListResult) IsEmpty() bool {
+	return pomlr.Value == nil || len(*pomlr.Value) == 0
+}
+
+// providerOperationsMetadataListResultPreparer prepares a request to retrieve the next set of results.
+// It returns nil if no more results exist.
+func (pomlr ProviderOperationsMetadataListResult) providerOperationsMetadataListResultPreparer() (*http.Request, error) {
+	if pomlr.NextLink == nil || len(to.String(pomlr.NextLink)) < 1 {
+		return nil, nil
+	}
+	return autorest.Prepare(&http.Request{},
+		autorest.AsJSON(),
+		autorest.AsGet(),
+		autorest.WithBaseURL(to.String(pomlr.NextLink)))
+}
+
+// ProviderOperationsMetadataListResultPage contains a page of ProviderOperationsMetadata values.
+type ProviderOperationsMetadataListResultPage struct {
+	fn    func(ProviderOperationsMetadataListResult) (ProviderOperationsMetadataListResult, error)
+	pomlr ProviderOperationsMetadataListResult
+}
+
+// Next advances to the next page of values.  If there was an error making
+// the request the page does not advance and the error is returned.
+func (page *ProviderOperationsMetadataListResultPage) Next() error {
+	next, err := page.fn(page.pomlr)
+	if err != nil {
+		return err
+	}
+	page.pomlr = next
+	return nil
+}
+
+// NotDone returns true if the page enumeration should be started or is not yet complete.
+func (page ProviderOperationsMetadataListResultPage) NotDone() bool {
+	return !page.pomlr.IsEmpty()
+}
+
+// Response returns the raw server response from the last page request.
+func (page ProviderOperationsMetadataListResultPage) Response() ProviderOperationsMetadataListResult {
+	return page.pomlr
+}
+
+// Values returns the slice of values for the current page or nil if there are no values.
+func (page ProviderOperationsMetadataListResultPage) Values() []ProviderOperationsMetadata {
+	if page.pomlr.IsEmpty() {
+		return nil
+	}
+	return *page.pomlr.Value
+}
+
+// ResourceType resource Type
+type ResourceType struct {
+	// Name - The resource type name.
+	Name *string `json:"name,omitempty"`
+	// DisplayName - The resource type display name.
+	DisplayName *string `json:"displayName,omitempty"`
+	// Operations - The resource type operations.
+	Operations *[]ProviderOperation `json:"operations,omitempty"`
+}
+
+// RoleAssignment role Assignments
+type RoleAssignment struct {
+	autorest.Response `json:"-"`
+	// ID - The role assignment ID.
+	ID *string `json:"id,omitempty"`
+	// Name - The role assignment name.
+	Name *string `json:"name,omitempty"`
+	// Type - The role assignment type.
+	Type *string `json:"type,omitempty"`
+	// RoleAssignmentPropertiesWithScope - Role assignment properties.
+	*RoleAssignmentPropertiesWithScope `json:"properties,omitempty"`
+}
+
+// MarshalJSON is the custom marshaler for RoleAssignment.
+func (ra RoleAssignment) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	if ra.ID != nil {
+		objectMap["id"] = ra.ID
+	}
+	if ra.Name != nil {
+		objectMap["name"] = ra.Name
+	}
+	if ra.Type != nil {
+		objectMap["type"] = ra.Type
+	}
+	if ra.RoleAssignmentPropertiesWithScope != nil {
+		objectMap["properties"] = ra.RoleAssignmentPropertiesWithScope
+	}
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON is the custom unmarshaler for RoleAssignment struct.
+func (ra *RoleAssignment) UnmarshalJSON(body []byte) error {
+	var m map[string]*json.RawMessage
+	err := json.Unmarshal(body, &m)
+	if err != nil {
+		return err
+	}
+	for k, v := range m {
+		switch k {
+		case "id":
+			if v != nil {
+				var ID string
+				err = json.Unmarshal(*v, &ID)
+				if err != nil {
+					return err
+				}
+				ra.ID = &ID
+			}
+		case "name":
+			if v != nil {
+				var name string
+				err = json.Unmarshal(*v, &name)
+				if err != nil {
+					return err
+				}
+				ra.Name = &name
+			}
+		case "type":
+			if v != nil {
+				var typeVar string
+				err = json.Unmarshal(*v, &typeVar)
+				if err != nil {
+					return err
+				}
+				ra.Type = &typeVar
+			}
+		case "properties":
+			if v != nil {
+				var roleAssignmentPropertiesWithScope RoleAssignmentPropertiesWithScope
+				err = json.Unmarshal(*v, &roleAssignmentPropertiesWithScope)
+				if err != nil {
+					return err
+				}
+				ra.RoleAssignmentPropertiesWithScope = &roleAssignmentPropertiesWithScope
+			}
+		}
+	}
+
+	return nil
+}
+
+// RoleAssignmentCreateParameters role assignment create parameters.
+type RoleAssignmentCreateParameters struct {
+	// RoleAssignmentProperties - Role assignment properties.
+	*RoleAssignmentProperties `json:"properties,omitempty"`
+}
+
+// MarshalJSON is the custom marshaler for RoleAssignmentCreateParameters.
+func (racp RoleAssignmentCreateParameters) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	if racp.RoleAssignmentProperties != nil {
+		objectMap["properties"] = racp.RoleAssignmentProperties
+	}
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON is the custom unmarshaler for RoleAssignmentCreateParameters struct.
+func (racp *RoleAssignmentCreateParameters) UnmarshalJSON(body []byte) error {
+	var m map[string]*json.RawMessage
+	err := json.Unmarshal(body, &m)
+	if err != nil {
+		return err
+	}
+	for k, v := range m {
+		switch k {
+		case "properties":
+			if v != nil {
+				var roleAssignmentProperties RoleAssignmentProperties
+				err = json.Unmarshal(*v, &roleAssignmentProperties)
+				if err != nil {
+					return err
+				}
+				racp.RoleAssignmentProperties = &roleAssignmentProperties
+			}
+		}
+	}
+
+	return nil
+}
+
+// RoleAssignmentFilter role Assignments filter
+type RoleAssignmentFilter struct {
+	// PrincipalID - Returns role assignment of the specific principal.
+	PrincipalID *string `json:"principalId,omitempty"`
+	// CanDelegate - The Delegation flag for the roleassignment
+	CanDelegate *bool `json:"canDelegate,omitempty"`
+}
+
+// RoleAssignmentListResult role assignment list operation result.
+type RoleAssignmentListResult struct {
+	autorest.Response `json:"-"`
+	// Value - Role assignment list.
+	Value *[]RoleAssignment `json:"value,omitempty"`
+	// NextLink - The URL to use for getting the next set of results.
+	NextLink *string `json:"nextLink,omitempty"`
+}
+
+// RoleAssignmentListResultIterator provides access to a complete listing of RoleAssignment values.
+type RoleAssignmentListResultIterator struct {
+	i    int
+	page RoleAssignmentListResultPage
+}
+
+// Next advances to the next value.  If there was an error making
+// the request the iterator does not advance and the error is returned.
+func (iter *RoleAssignmentListResultIterator) Next() error {
+	iter.i++
+	if iter.i < len(iter.page.Values()) {
+		return nil
+	}
+	err := iter.page.Next()
+	if err != nil {
+		iter.i--
+		return err
+	}
+	iter.i = 0
+	return nil
+}
+
+// NotDone returns true if the enumeration should be started or is not yet complete.
+func (iter RoleAssignmentListResultIterator) NotDone() bool {
+	return iter.page.NotDone() && iter.i < len(iter.page.Values())
+}
+
+// Response returns the raw server response from the last page request.
+func (iter RoleAssignmentListResultIterator) Response() RoleAssignmentListResult {
+	return iter.page.Response()
+}
+
+// Value returns the current value or a zero-initialized value if the
+// iterator has advanced beyond the end of the collection.
+func (iter RoleAssignmentListResultIterator) Value() RoleAssignment {
+	if !iter.page.NotDone() {
+		return RoleAssignment{}
+	}
+	return iter.page.Values()[iter.i]
+}
+
+// IsEmpty returns true if the ListResult contains no values.
+func (ralr RoleAssignmentListResult) IsEmpty() bool {
+	return ralr.Value == nil || len(*ralr.Value) == 0
+}
+
+// roleAssignmentListResultPreparer prepares a request to retrieve the next set of results.
+// It returns nil if no more results exist.
+func (ralr RoleAssignmentListResult) roleAssignmentListResultPreparer() (*http.Request, error) {
+	if ralr.NextLink == nil || len(to.String(ralr.NextLink)) < 1 {
+		return nil, nil
+	}
+	return autorest.Prepare(&http.Request{},
+		autorest.AsJSON(),
+		autorest.AsGet(),
+		autorest.WithBaseURL(to.String(ralr.NextLink)))
+}
+
+// RoleAssignmentListResultPage contains a page of RoleAssignment values.
+type RoleAssignmentListResultPage struct {
+	fn   func(RoleAssignmentListResult) (RoleAssignmentListResult, error)
+	ralr RoleAssignmentListResult
+}
+
+// Next advances to the next page of values.  If there was an error making
+// the request the page does not advance and the error is returned.
+func (page *RoleAssignmentListResultPage) Next() error {
+	next, err := page.fn(page.ralr)
+	if err != nil {
+		return err
+	}
+	page.ralr = next
+	return nil
+}
+
+// NotDone returns true if the page enumeration should be started or is not yet complete.
+func (page RoleAssignmentListResultPage) NotDone() bool {
+	return !page.ralr.IsEmpty()
+}
+
+// Response returns the raw server response from the last page request.
+func (page RoleAssignmentListResultPage) Response() RoleAssignmentListResult {
+	return page.ralr
+}
+
+// Values returns the slice of values for the current page or nil if there are no values.
+func (page RoleAssignmentListResultPage) Values() []RoleAssignment {
+	if page.ralr.IsEmpty() {
+		return nil
+	}
+	return *page.ralr.Value
+}
+
+// RoleAssignmentProperties role assignment properties.
+type RoleAssignmentProperties struct {
+	// RoleDefinitionID - The role definition ID used in the role assignment.
+	RoleDefinitionID *string `json:"roleDefinitionId,omitempty"`
+	// PrincipalID - The principal ID assigned to the role. This maps to the ID inside the Active Directory. It can point to a user, service principal, or security group.
+	PrincipalID *string `json:"principalId,omitempty"`
+	// CanDelegate - The delgation flag used for creating a role assignment
+	CanDelegate *bool `json:"canDelegate,omitempty"`
+}
+
+// RoleAssignmentPropertiesWithScope role assignment properties with scope.
+type RoleAssignmentPropertiesWithScope struct {
+	// Scope - The role assignment scope.
+	Scope *string `json:"scope,omitempty"`
+	// RoleDefinitionID - The role definition ID.
+	RoleDefinitionID *string `json:"roleDefinitionId,omitempty"`
+	// PrincipalID - The principal ID.
+	PrincipalID *string `json:"principalId,omitempty"`
+	// CanDelegate - The Delegation flag for the roleassignment
+	CanDelegate *bool `json:"canDelegate,omitempty"`
+}
+
+// RoleDefinition role definition.
+type RoleDefinition struct {
+	autorest.Response `json:"-"`
+	// ID - The role definition ID.
+	ID *string `json:"id,omitempty"`
+	// Name - The role definition name.
+	Name *string `json:"name,omitempty"`
+	// Type - The role definition type.
+	Type *string `json:"type,omitempty"`
+	// RoleDefinitionProperties - Role definition properties.
+	*RoleDefinitionProperties `json:"properties,omitempty"`
+}
+
+// MarshalJSON is the custom marshaler for RoleDefinition.
+func (rd RoleDefinition) MarshalJSON() ([]byte, error) {
+	objectMap := make(map[string]interface{})
+	if rd.ID != nil {
+		objectMap["id"] = rd.ID
+	}
+	if rd.Name != nil {
+		objectMap["name"] = rd.Name
+	}
+	if rd.Type != nil {
+		objectMap["type"] = rd.Type
+	}
+	if rd.RoleDefinitionProperties != nil {
+		objectMap["properties"] = rd.RoleDefinitionProperties
+	}
+	return json.Marshal(objectMap)
+}
+
+// UnmarshalJSON is the custom unmarshaler for RoleDefinition struct.
+func (rd *RoleDefinition) UnmarshalJSON(body []byte) error {
+	var m map[string]*json.RawMessage
+	err := json.Unmarshal(body, &m)
+	if err != nil {
+		return err
+	}
+	for k, v := range m {
+		switch k {
+		case "id":
+			if v != nil {
+				var ID string
+				err = json.Unmarshal(*v, &ID)
+				if err != nil {
+					return err
+				}
+				rd.ID = &ID
+			}
+		case "name":
+			if v != nil {
+				var name string
+				err = json.Unmarshal(*v, &name)
+				if err != nil {
+					return err
+				}
+				rd.Name = &name
+			}
+		case "type":
+			if v != nil {
+				var typeVar string
+				err = json.Unmarshal(*v, &typeVar)
+				if err != nil {
+					return err
+				}
+				rd.Type = &typeVar
+			}
+		case "properties":
+			if v != nil {
+				var roleDefinitionProperties RoleDefinitionProperties
+				err = json.Unmarshal(*v, &roleDefinitionProperties)
+				if err != nil {
+					return err
+				}
+				rd.RoleDefinitionProperties = &roleDefinitionProperties
+			}
+		}
+	}
+
+	return nil
+}
+
+// RoleDefinitionFilter role Definitions filter
+type RoleDefinitionFilter struct {
+	// RoleName - Returns role definition with the specific name.
+	RoleName *string `json:"roleName,omitempty"`
+	// Type - Returns role definition with the specific type.
+	Type *string `json:"type,omitempty"`
+}
+
+// RoleDefinitionListResult role definition list operation result.
+type RoleDefinitionListResult struct {
+	autorest.Response `json:"-"`
+	// Value - Role definition list.
+	Value *[]RoleDefinition `json:"value,omitempty"`
+	// NextLink - The URL to use for getting the next set of results.
+	NextLink *string `json:"nextLink,omitempty"`
+}
+
+// RoleDefinitionListResultIterator provides access to a complete listing of RoleDefinition values.
+type RoleDefinitionListResultIterator struct {
+	i    int
+	page RoleDefinitionListResultPage
+}
+
+// Next advances to the next value.  If there was an error making
+// the request the iterator does not advance and the error is returned.
+func (iter *RoleDefinitionListResultIterator) Next() error {
+	iter.i++
+	if iter.i < len(iter.page.Values()) {
+		return nil
+	}
+	err := iter.page.Next()
+	if err != nil {
+		iter.i--
+		return err
+	}
+	iter.i = 0
+	return nil
+}
+
+// NotDone returns true if the enumeration should be started or is not yet complete.
+func (iter RoleDefinitionListResultIterator) NotDone() bool {
+	return iter.page.NotDone() && iter.i < len(iter.page.Values())
+}
+
+// Response returns the raw server response from the last page request.
+func (iter RoleDefinitionListResultIterator) Response() RoleDefinitionListResult {
+	return iter.page.Response()
+}
+
+// Value returns the current value or a zero-initialized value if the
+// iterator has advanced beyond the end of the collection.
+func (iter RoleDefinitionListResultIterator) Value() RoleDefinition {
+	if !iter.page.NotDone() {
+		return RoleDefinition{}
+	}
+	return iter.page.Values()[iter.i]
+}
+
+// IsEmpty returns true if the ListResult contains no values.
+func (rdlr RoleDefinitionListResult) IsEmpty() bool {
+	return rdlr.Value == nil || len(*rdlr.Value) == 0
+}
+
+// roleDefinitionListResultPreparer prepares a request to retrieve the next set of results.
+// It returns nil if no more results exist.
+func (rdlr RoleDefinitionListResult) roleDefinitionListResultPreparer() (*http.Request, error) {
+	if rdlr.NextLink == nil || len(to.String(rdlr.NextLink)) < 1 {
+		return nil, nil
+	}
+	return autorest.Prepare(&http.Request{},
+		autorest.AsJSON(),
+		autorest.AsGet(),
+		autorest.WithBaseURL(to.String(rdlr.NextLink)))
+}
+
+// RoleDefinitionListResultPage contains a page of RoleDefinition values.
+type RoleDefinitionListResultPage struct {
+	fn   func(RoleDefinitionListResult) (RoleDefinitionListResult, error)
+	rdlr RoleDefinitionListResult
+}
+
+// Next advances to the next page of values.  If there was an error making
+// the request the page does not advance and the error is returned.
+func (page *RoleDefinitionListResultPage) Next() error {
+	next, err := page.fn(page.rdlr)
+	if err != nil {
+		return err
+	}
+	page.rdlr = next
+	return nil
+}
+
+// NotDone returns true if the page enumeration should be started or is not yet complete.
+func (page RoleDefinitionListResultPage) NotDone() bool {
+	return !page.rdlr.IsEmpty()
+}
+
+// Response returns the raw server response from the last page request.
+func (page RoleDefinitionListResultPage) Response() RoleDefinitionListResult {
+	return page.rdlr
+}
+
+// Values returns the slice of values for the current page or nil if there are no values.
+func (page RoleDefinitionListResultPage) Values() []RoleDefinition {
+	if page.rdlr.IsEmpty() {
+		return nil
+	}
+	return *page.rdlr.Value
+}
+
+// RoleDefinitionProperties role definition properties.
+type RoleDefinitionProperties struct {
+	// RoleName - The role name.
+	RoleName *string `json:"roleName,omitempty"`
+	// Description - The role definition description.
+	Description *string `json:"description,omitempty"`
+	// RoleType - The role type.
+	RoleType *string `json:"type,omitempty"`
+	// Permissions - Role definition permissions.
+	Permissions *[]Permission `json:"permissions,omitempty"`
+	// AssignableScopes - Role definition assignable scopes.
+	AssignableScopes *[]string `json:"assignableScopes,omitempty"`
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/permissions.go

@@ -0,0 +1,237 @@
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"net/http"
+)
+
+// PermissionsClient is the role based access control provides you a way to apply granular level policy administration
+// down to individual resources or resource groups. These operations enable you to manage role definitions and role
+// assignments. A role definition describes the set of actions that can be performed on resources. A role assignment
+// grants access to Azure Active Directory users.
+type PermissionsClient struct {
+	BaseClient
+}
+
+// NewPermissionsClient creates an instance of the PermissionsClient client.
+func NewPermissionsClient(subscriptionID string) PermissionsClient {
+	return NewPermissionsClientWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewPermissionsClientWithBaseURI creates an instance of the PermissionsClient client.
+func NewPermissionsClientWithBaseURI(baseURI string, subscriptionID string) PermissionsClient {
+	return PermissionsClient{NewWithBaseURI(baseURI, subscriptionID)}
+}
+
+// ListForResource gets all permissions the caller has for a resource.
+// Parameters:
+// resourceGroupName - the name of the resource group.
+// resourceProviderNamespace - the namespace of the resource provider.
+// parentResourcePath - the parent resource identity.
+// resourceType - the resource type of the resource.
+// resourceName - the name of the resource to get the permissions for.
+func (client PermissionsClient) ListForResource(ctx context.Context, resourceGroupName string, resourceProviderNamespace string, parentResourcePath string, resourceType string, resourceName string) (result PermissionGetResultPage, err error) {
+	result.fn = client.listForResourceNextResults
+	req, err := client.ListForResourcePreparer(ctx, resourceGroupName, resourceProviderNamespace, parentResourcePath, resourceType, resourceName)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "ListForResource", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListForResourceSender(req)
+	if err != nil {
+		result.pgr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "ListForResource", resp, "Failure sending request")
+		return
+	}
+
+	result.pgr, err = client.ListForResourceResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "ListForResource", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListForResourcePreparer prepares the ListForResource request.
+func (client PermissionsClient) ListForResourcePreparer(ctx context.Context, resourceGroupName string, resourceProviderNamespace string, parentResourcePath string, resourceType string, resourceName string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"parentResourcePath":        parentResourcePath,
+		"resourceGroupName":         autorest.Encode("path", resourceGroupName),
+		"resourceName":              autorest.Encode("path", resourceName),
+		"resourceProviderNamespace": autorest.Encode("path", resourceProviderNamespace),
+		"resourceType":              resourceType,
+		"subscriptionId":            autorest.Encode("path", client.SubscriptionID),
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{parentResourcePath}/{resourceType}/{resourceName}/providers/Microsoft.Authorization/permissions", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListForResourceSender sends the ListForResource request. The method will close the
+// http.Response Body if it receives an error.
+func (client PermissionsClient) ListForResourceSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		azure.DoRetryWithRegistration(client.Client))
+}
+
+// ListForResourceResponder handles the response to the ListForResource request. The method always
+// closes the http.Response Body.
+func (client PermissionsClient) ListForResourceResponder(resp *http.Response) (result PermissionGetResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listForResourceNextResults retrieves the next set of results, if any.
+func (client PermissionsClient) listForResourceNextResults(lastResults PermissionGetResult) (result PermissionGetResult, err error) {
+	req, err := lastResults.permissionGetResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.PermissionsClient", "listForResourceNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListForResourceSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.PermissionsClient", "listForResourceNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListForResourceResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "listForResourceNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListForResourceComplete enumerates all values, automatically crossing page boundaries as required.
+func (client PermissionsClient) ListForResourceComplete(ctx context.Context, resourceGroupName string, resourceProviderNamespace string, parentResourcePath string, resourceType string, resourceName string) (result PermissionGetResultIterator, err error) {
+	result.page, err = client.ListForResource(ctx, resourceGroupName, resourceProviderNamespace, parentResourcePath, resourceType, resourceName)
+	return
+}
+
+// ListForResourceGroup gets all permissions the caller has for a resource group.
+// Parameters:
+// resourceGroupName - the name of the resource group.
+func (client PermissionsClient) ListForResourceGroup(ctx context.Context, resourceGroupName string) (result PermissionGetResultPage, err error) {
+	result.fn = client.listForResourceGroupNextResults
+	req, err := client.ListForResourceGroupPreparer(ctx, resourceGroupName)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "ListForResourceGroup", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListForResourceGroupSender(req)
+	if err != nil {
+		result.pgr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "ListForResourceGroup", resp, "Failure sending request")
+		return
+	}
+
+	result.pgr, err = client.ListForResourceGroupResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "ListForResourceGroup", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListForResourceGroupPreparer prepares the ListForResourceGroup request.
+func (client PermissionsClient) ListForResourceGroupPreparer(ctx context.Context, resourceGroupName string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"resourceGroupName": autorest.Encode("path", resourceGroupName),
+		"subscriptionId":    autorest.Encode("path", client.SubscriptionID),
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Authorization/permissions", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListForResourceGroupSender sends the ListForResourceGroup request. The method will close the
+// http.Response Body if it receives an error.
+func (client PermissionsClient) ListForResourceGroupSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		azure.DoRetryWithRegistration(client.Client))
+}
+
+// ListForResourceGroupResponder handles the response to the ListForResourceGroup request. The method always
+// closes the http.Response Body.
+func (client PermissionsClient) ListForResourceGroupResponder(resp *http.Response) (result PermissionGetResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listForResourceGroupNextResults retrieves the next set of results, if any.
+func (client PermissionsClient) listForResourceGroupNextResults(lastResults PermissionGetResult) (result PermissionGetResult, err error) {
+	req, err := lastResults.permissionGetResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.PermissionsClient", "listForResourceGroupNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListForResourceGroupSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.PermissionsClient", "listForResourceGroupNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListForResourceGroupResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.PermissionsClient", "listForResourceGroupNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListForResourceGroupComplete enumerates all values, automatically crossing page boundaries as required.
+func (client PermissionsClient) ListForResourceGroupComplete(ctx context.Context, resourceGroupName string) (result PermissionGetResultIterator, err error) {
+	result.page, err = client.ListForResourceGroup(ctx, resourceGroupName)
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/provideroperationsmetadata.go

@@ -0,0 +1,206 @@
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"net/http"
+)
+
+// ProviderOperationsMetadataClient is the role based access control provides you a way to apply granular level policy
+// administration down to individual resources or resource groups. These operations enable you to manage role
+// definitions and role assignments. A role definition describes the set of actions that can be performed on resources.
+// A role assignment grants access to Azure Active Directory users.
+type ProviderOperationsMetadataClient struct {
+	BaseClient
+}
+
+// NewProviderOperationsMetadataClient creates an instance of the ProviderOperationsMetadataClient client.
+func NewProviderOperationsMetadataClient(subscriptionID string) ProviderOperationsMetadataClient {
+	return NewProviderOperationsMetadataClientWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewProviderOperationsMetadataClientWithBaseURI creates an instance of the ProviderOperationsMetadataClient client.
+func NewProviderOperationsMetadataClientWithBaseURI(baseURI string, subscriptionID string) ProviderOperationsMetadataClient {
+	return ProviderOperationsMetadataClient{NewWithBaseURI(baseURI, subscriptionID)}
+}
+
+// Get gets provider operations metadata for the specified resource provider.
+// Parameters:
+// resourceProviderNamespace - the namespace of the resource provider.
+// expand - specifies whether to expand the values.
+func (client ProviderOperationsMetadataClient) Get(ctx context.Context, resourceProviderNamespace string, expand string) (result ProviderOperationsMetadata, err error) {
+	req, err := client.GetPreparer(ctx, resourceProviderNamespace, expand)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client ProviderOperationsMetadataClient) GetPreparer(ctx context.Context, resourceProviderNamespace string, expand string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"resourceProviderNamespace": autorest.Encode("path", resourceProviderNamespace),
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(expand) > 0 {
+		queryParameters["$expand"] = autorest.Encode("query", expand)
+	} else {
+		queryParameters["$expand"] = autorest.Encode("query", "resourceTypes")
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/providers/Microsoft.Authorization/providerOperations/{resourceProviderNamespace}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client ProviderOperationsMetadataClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client ProviderOperationsMetadataClient) GetResponder(resp *http.Response) (result ProviderOperationsMetadata, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List gets provider operations metadata for all resource providers.
+// Parameters:
+// expand - specifies whether to expand the values.
+func (client ProviderOperationsMetadataClient) List(ctx context.Context, expand string) (result ProviderOperationsMetadataListResultPage, err error) {
+	result.fn = client.listNextResults
+	req, err := client.ListPreparer(ctx, expand)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.pomlr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.pomlr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client ProviderOperationsMetadataClient) ListPreparer(ctx context.Context, expand string) (*http.Request, error) {
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(expand) > 0 {
+		queryParameters["$expand"] = autorest.Encode("query", expand)
+	} else {
+		queryParameters["$expand"] = autorest.Encode("query", "resourceTypes")
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPath("/providers/Microsoft.Authorization/providerOperations"),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client ProviderOperationsMetadataClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client ProviderOperationsMetadataClient) ListResponder(resp *http.Response) (result ProviderOperationsMetadataListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listNextResults retrieves the next set of results, if any.
+func (client ProviderOperationsMetadataClient) listNextResults(lastResults ProviderOperationsMetadataListResult) (result ProviderOperationsMetadataListResult, err error) {
+	req, err := lastResults.providerOperationsMetadataListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "listNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "listNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.ProviderOperationsMetadataClient", "listNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client ProviderOperationsMetadataClient) ListComplete(ctx context.Context, expand string) (result ProviderOperationsMetadataListResultIterator, err error) {
+	result.page, err = client.List(ctx, expand)
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/roleassignments.go

@@ -0,0 +1,844 @@
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"net/http"
+)
+
+// RoleAssignmentsClient is the role based access control provides you a way to apply granular level policy
+// administration down to individual resources or resource groups. These operations enable you to manage role
+// definitions and role assignments. A role definition describes the set of actions that can be performed on resources.
+// A role assignment grants access to Azure Active Directory users.
+type RoleAssignmentsClient struct {
+	BaseClient
+}
+
+// NewRoleAssignmentsClient creates an instance of the RoleAssignmentsClient client.
+func NewRoleAssignmentsClient(subscriptionID string) RoleAssignmentsClient {
+	return NewRoleAssignmentsClientWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewRoleAssignmentsClientWithBaseURI creates an instance of the RoleAssignmentsClient client.
+func NewRoleAssignmentsClientWithBaseURI(baseURI string, subscriptionID string) RoleAssignmentsClient {
+	return RoleAssignmentsClient{NewWithBaseURI(baseURI, subscriptionID)}
+}
+
+// Create creates a role assignment.
+// Parameters:
+// scope - the scope of the role assignment to create. The scope can be any REST resource instance. For
+// example, use '/subscriptions/{subscription-id}/' for a subscription,
+// '/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}' for a resource group, and
+// '/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/{resource-provider}/{resource-type}/{resource-name}'
+// for a resource.
+// roleAssignmentName - the name of the role assignment to create. It can be any valid GUID.
+// parameters - parameters for the role assignment.
+func (client RoleAssignmentsClient) Create(ctx context.Context, scope string, roleAssignmentName string, parameters RoleAssignmentCreateParameters) (result RoleAssignment, err error) {
+	req, err := client.CreatePreparer(ctx, scope, roleAssignmentName, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Create", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Create", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Create", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreatePreparer prepares the Create request.
+func (client RoleAssignmentsClient) CreatePreparer(ctx context.Context, scope string, roleAssignmentName string, parameters RoleAssignmentCreateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleAssignmentName": autorest.Encode("path", roleAssignmentName),
+		"scope":              scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPut(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateSender sends the Create request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) CreateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateResponder handles the response to the Create request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) CreateResponder(resp *http.Response) (result RoleAssignment, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// CreateByID creates a role assignment by ID.
+// Parameters:
+// roleID - the ID of the role assignment to create.
+// parameters - parameters for the role assignment.
+func (client RoleAssignmentsClient) CreateByID(ctx context.Context, roleID string, parameters RoleAssignmentCreateParameters) (result RoleAssignment, err error) {
+	req, err := client.CreateByIDPreparer(ctx, roleID, parameters)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "CreateByID", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateByIDSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "CreateByID", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateByIDResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "CreateByID", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreateByIDPreparer prepares the CreateByID request.
+func (client RoleAssignmentsClient) CreateByIDPreparer(ctx context.Context, roleID string, parameters RoleAssignmentCreateParameters) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleId": roleID,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPut(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{roleId}", pathParameters),
+		autorest.WithJSON(parameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateByIDSender sends the CreateByID request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) CreateByIDSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateByIDResponder handles the response to the CreateByID request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) CreateByIDResponder(resp *http.Response) (result RoleAssignment, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Delete deletes a role assignment.
+// Parameters:
+// scope - the scope of the role assignment to delete.
+// roleAssignmentName - the name of the role assignment to delete.
+func (client RoleAssignmentsClient) Delete(ctx context.Context, scope string, roleAssignmentName string) (result RoleAssignment, err error) {
+	req, err := client.DeletePreparer(ctx, scope, roleAssignmentName)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Delete", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Delete", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Delete", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeletePreparer prepares the Delete request.
+func (client RoleAssignmentsClient) DeletePreparer(ctx context.Context, scope string, roleAssignmentName string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleAssignmentName": autorest.Encode("path", roleAssignmentName),
+		"scope":              scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteSender sends the Delete request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) DeleteSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteResponder handles the response to the Delete request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) DeleteResponder(resp *http.Response) (result RoleAssignment, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// DeleteByID deletes a role assignment.
+// Parameters:
+// roleID - the ID of the role assignment to delete.
+func (client RoleAssignmentsClient) DeleteByID(ctx context.Context, roleID string) (result RoleAssignment, err error) {
+	req, err := client.DeleteByIDPreparer(ctx, roleID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "DeleteByID", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteByIDSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "DeleteByID", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteByIDResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "DeleteByID", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeleteByIDPreparer prepares the DeleteByID request.
+func (client RoleAssignmentsClient) DeleteByIDPreparer(ctx context.Context, roleID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleId": roleID,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{roleId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteByIDSender sends the DeleteByID request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) DeleteByIDSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteByIDResponder handles the response to the DeleteByID request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) DeleteByIDResponder(resp *http.Response) (result RoleAssignment, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Get get the specified role assignment.
+// Parameters:
+// scope - the scope of the role assignment.
+// roleAssignmentName - the name of the role assignment to get.
+func (client RoleAssignmentsClient) Get(ctx context.Context, scope string, roleAssignmentName string) (result RoleAssignment, err error) {
+	req, err := client.GetPreparer(ctx, scope, roleAssignmentName)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client RoleAssignmentsClient) GetPreparer(ctx context.Context, scope string, roleAssignmentName string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleAssignmentName": autorest.Encode("path", roleAssignmentName),
+		"scope":              scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentName}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) GetResponder(resp *http.Response) (result RoleAssignment, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetByID gets a role assignment by ID.
+// Parameters:
+// roleID - the ID of the role assignment to get.
+func (client RoleAssignmentsClient) GetByID(ctx context.Context, roleID string) (result RoleAssignment, err error) {
+	req, err := client.GetByIDPreparer(ctx, roleID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "GetByID", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetByIDSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "GetByID", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetByIDResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "GetByID", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetByIDPreparer prepares the GetByID request.
+func (client RoleAssignmentsClient) GetByIDPreparer(ctx context.Context, roleID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleId": roleID,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{roleId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetByIDSender sends the GetByID request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) GetByIDSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetByIDResponder handles the response to the GetByID request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) GetByIDResponder(resp *http.Response) (result RoleAssignment, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List gets all role assignments for the subscription.
+// Parameters:
+// filter - the filter to apply on the operation. Use $filter=atScope() to return all role assignments at or
+// above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope
+// for the specified principal.
+func (client RoleAssignmentsClient) List(ctx context.Context, filter string) (result RoleAssignmentListResultPage, err error) {
+	result.fn = client.listNextResults
+	req, err := client.ListPreparer(ctx, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.ralr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.ralr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client RoleAssignmentsClient) ListPreparer(ctx context.Context, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"subscriptionId": autorest.Encode("path", client.SubscriptionID),
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleAssignments", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		azure.DoRetryWithRegistration(client.Client))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) ListResponder(resp *http.Response) (result RoleAssignmentListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listNextResults retrieves the next set of results, if any.
+func (client RoleAssignmentsClient) listNextResults(lastResults RoleAssignmentListResult) (result RoleAssignmentListResult, err error) {
+	req, err := lastResults.roleAssignmentListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client RoleAssignmentsClient) ListComplete(ctx context.Context, filter string) (result RoleAssignmentListResultIterator, err error) {
+	result.page, err = client.List(ctx, filter)
+	return
+}
+
+// ListForResource gets role assignments for a resource.
+// Parameters:
+// resourceGroupName - the name of the resource group.
+// resourceProviderNamespace - the namespace of the resource provider.
+// parentResourcePath - the parent resource identity.
+// resourceType - the resource type of the resource.
+// resourceName - the name of the resource to get role assignments for.
+// filter - the filter to apply on the operation. Use $filter=atScope() to return all role assignments at or
+// above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope
+// for the specified principal.
+func (client RoleAssignmentsClient) ListForResource(ctx context.Context, resourceGroupName string, resourceProviderNamespace string, parentResourcePath string, resourceType string, resourceName string, filter string) (result RoleAssignmentListResultPage, err error) {
+	result.fn = client.listForResourceNextResults
+	req, err := client.ListForResourcePreparer(ctx, resourceGroupName, resourceProviderNamespace, parentResourcePath, resourceType, resourceName, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForResource", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListForResourceSender(req)
+	if err != nil {
+		result.ralr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForResource", resp, "Failure sending request")
+		return
+	}
+
+	result.ralr, err = client.ListForResourceResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForResource", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListForResourcePreparer prepares the ListForResource request.
+func (client RoleAssignmentsClient) ListForResourcePreparer(ctx context.Context, resourceGroupName string, resourceProviderNamespace string, parentResourcePath string, resourceType string, resourceName string, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"parentResourcePath":        parentResourcePath,
+		"resourceGroupName":         autorest.Encode("path", resourceGroupName),
+		"resourceName":              autorest.Encode("path", resourceName),
+		"resourceProviderNamespace": autorest.Encode("path", resourceProviderNamespace),
+		"resourceType":              resourceType,
+		"subscriptionId":            autorest.Encode("path", client.SubscriptionID),
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{parentResourcePath}/{resourceType}/{resourceName}/providers/Microsoft.Authorization/roleAssignments", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListForResourceSender sends the ListForResource request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) ListForResourceSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		azure.DoRetryWithRegistration(client.Client))
+}
+
+// ListForResourceResponder handles the response to the ListForResource request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) ListForResourceResponder(resp *http.Response) (result RoleAssignmentListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listForResourceNextResults retrieves the next set of results, if any.
+func (client RoleAssignmentsClient) listForResourceNextResults(lastResults RoleAssignmentListResult) (result RoleAssignmentListResult, err error) {
+	req, err := lastResults.roleAssignmentListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForResourceNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListForResourceSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForResourceNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListForResourceResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForResourceNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListForResourceComplete enumerates all values, automatically crossing page boundaries as required.
+func (client RoleAssignmentsClient) ListForResourceComplete(ctx context.Context, resourceGroupName string, resourceProviderNamespace string, parentResourcePath string, resourceType string, resourceName string, filter string) (result RoleAssignmentListResultIterator, err error) {
+	result.page, err = client.ListForResource(ctx, resourceGroupName, resourceProviderNamespace, parentResourcePath, resourceType, resourceName, filter)
+	return
+}
+
+// ListForResourceGroup gets role assignments for a resource group.
+// Parameters:
+// resourceGroupName - the name of the resource group.
+// filter - the filter to apply on the operation. Use $filter=atScope() to return all role assignments at or
+// above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope
+// for the specified principal.
+func (client RoleAssignmentsClient) ListForResourceGroup(ctx context.Context, resourceGroupName string, filter string) (result RoleAssignmentListResultPage, err error) {
+	result.fn = client.listForResourceGroupNextResults
+	req, err := client.ListForResourceGroupPreparer(ctx, resourceGroupName, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForResourceGroup", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListForResourceGroupSender(req)
+	if err != nil {
+		result.ralr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForResourceGroup", resp, "Failure sending request")
+		return
+	}
+
+	result.ralr, err = client.ListForResourceGroupResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForResourceGroup", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListForResourceGroupPreparer prepares the ListForResourceGroup request.
+func (client RoleAssignmentsClient) ListForResourceGroupPreparer(ctx context.Context, resourceGroupName string, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"resourceGroupName": autorest.Encode("path", resourceGroupName),
+		"subscriptionId":    autorest.Encode("path", client.SubscriptionID),
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleAssignments", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListForResourceGroupSender sends the ListForResourceGroup request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) ListForResourceGroupSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		azure.DoRetryWithRegistration(client.Client))
+}
+
+// ListForResourceGroupResponder handles the response to the ListForResourceGroup request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) ListForResourceGroupResponder(resp *http.Response) (result RoleAssignmentListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listForResourceGroupNextResults retrieves the next set of results, if any.
+func (client RoleAssignmentsClient) listForResourceGroupNextResults(lastResults RoleAssignmentListResult) (result RoleAssignmentListResult, err error) {
+	req, err := lastResults.roleAssignmentListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForResourceGroupNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListForResourceGroupSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForResourceGroupNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListForResourceGroupResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForResourceGroupNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListForResourceGroupComplete enumerates all values, automatically crossing page boundaries as required.
+func (client RoleAssignmentsClient) ListForResourceGroupComplete(ctx context.Context, resourceGroupName string, filter string) (result RoleAssignmentListResultIterator, err error) {
+	result.page, err = client.ListForResourceGroup(ctx, resourceGroupName, filter)
+	return
+}
+
+// ListForScope gets role assignments for a scope.
+// Parameters:
+// scope - the scope of the role assignments.
+// filter - the filter to apply on the operation. Use $filter=atScope() to return all role assignments at or
+// above the scope. Use $filter=principalId eq {id} to return all role assignments at, above or below the scope
+// for the specified principal.
+func (client RoleAssignmentsClient) ListForScope(ctx context.Context, scope string, filter string) (result RoleAssignmentListResultPage, err error) {
+	result.fn = client.listForScopeNextResults
+	req, err := client.ListForScopePreparer(ctx, scope, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForScope", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListForScopeSender(req)
+	if err != nil {
+		result.ralr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForScope", resp, "Failure sending request")
+		return
+	}
+
+	result.ralr, err = client.ListForScopeResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "ListForScope", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListForScopePreparer prepares the ListForScope request.
+func (client RoleAssignmentsClient) ListForScopePreparer(ctx context.Context, scope string, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"scope": scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleAssignments", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListForScopeSender sends the ListForScope request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleAssignmentsClient) ListForScopeSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListForScopeResponder handles the response to the ListForScope request. The method always
+// closes the http.Response Body.
+func (client RoleAssignmentsClient) ListForScopeResponder(resp *http.Response) (result RoleAssignmentListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listForScopeNextResults retrieves the next set of results, if any.
+func (client RoleAssignmentsClient) listForScopeNextResults(lastResults RoleAssignmentListResult) (result RoleAssignmentListResult, err error) {
+	req, err := lastResults.roleAssignmentListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForScopeNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListForScopeSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForScopeNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListForScopeResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleAssignmentsClient", "listForScopeNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListForScopeComplete enumerates all values, automatically crossing page boundaries as required.
+func (client RoleAssignmentsClient) ListForScopeComplete(ctx context.Context, scope string, filter string) (result RoleAssignmentListResultIterator, err error) {
+	result.page, err = client.ListForScope(ctx, scope, filter)
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/roledefinitions.go

@@ -0,0 +1,408 @@
+package authorization
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+import (
+	"context"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"net/http"
+)
+
+// RoleDefinitionsClient is the role based access control provides you a way to apply granular level policy
+// administration down to individual resources or resource groups. These operations enable you to manage role
+// definitions and role assignments. A role definition describes the set of actions that can be performed on resources.
+// A role assignment grants access to Azure Active Directory users.
+type RoleDefinitionsClient struct {
+	BaseClient
+}
+
+// NewRoleDefinitionsClient creates an instance of the RoleDefinitionsClient client.
+func NewRoleDefinitionsClient(subscriptionID string) RoleDefinitionsClient {
+	return NewRoleDefinitionsClientWithBaseURI(DefaultBaseURI, subscriptionID)
+}
+
+// NewRoleDefinitionsClientWithBaseURI creates an instance of the RoleDefinitionsClient client.
+func NewRoleDefinitionsClientWithBaseURI(baseURI string, subscriptionID string) RoleDefinitionsClient {
+	return RoleDefinitionsClient{NewWithBaseURI(baseURI, subscriptionID)}
+}
+
+// CreateOrUpdate creates or updates a role definition.
+// Parameters:
+// scope - the scope of the role definition.
+// roleDefinitionID - the ID of the role definition.
+// roleDefinition - the values for the role definition.
+func (client RoleDefinitionsClient) CreateOrUpdate(ctx context.Context, scope string, roleDefinitionID string, roleDefinition RoleDefinition) (result RoleDefinition, err error) {
+	req, err := client.CreateOrUpdatePreparer(ctx, scope, roleDefinitionID, roleDefinition)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "CreateOrUpdate", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.CreateOrUpdateSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "CreateOrUpdate", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.CreateOrUpdateResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "CreateOrUpdate", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// CreateOrUpdatePreparer prepares the CreateOrUpdate request.
+func (client RoleDefinitionsClient) CreateOrUpdatePreparer(ctx context.Context, scope string, roleDefinitionID string, roleDefinition RoleDefinition) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleDefinitionId": autorest.Encode("path", roleDefinitionID),
+		"scope":            scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsContentType("application/json; charset=utf-8"),
+		autorest.AsPut(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}", pathParameters),
+		autorest.WithJSON(roleDefinition),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// CreateOrUpdateSender sends the CreateOrUpdate request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleDefinitionsClient) CreateOrUpdateSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// CreateOrUpdateResponder handles the response to the CreateOrUpdate request. The method always
+// closes the http.Response Body.
+func (client RoleDefinitionsClient) CreateOrUpdateResponder(resp *http.Response) (result RoleDefinition, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK, http.StatusCreated),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Delete deletes a role definition.
+// Parameters:
+// scope - the scope of the role definition.
+// roleDefinitionID - the ID of the role definition to delete.
+func (client RoleDefinitionsClient) Delete(ctx context.Context, scope string, roleDefinitionID string) (result RoleDefinition, err error) {
+	req, err := client.DeletePreparer(ctx, scope, roleDefinitionID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "Delete", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.DeleteSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "Delete", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.DeleteResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "Delete", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// DeletePreparer prepares the Delete request.
+func (client RoleDefinitionsClient) DeletePreparer(ctx context.Context, scope string, roleDefinitionID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleDefinitionId": autorest.Encode("path", roleDefinitionID),
+		"scope":            scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsDelete(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// DeleteSender sends the Delete request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleDefinitionsClient) DeleteSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// DeleteResponder handles the response to the Delete request. The method always
+// closes the http.Response Body.
+func (client RoleDefinitionsClient) DeleteResponder(resp *http.Response) (result RoleDefinition, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// Get get role definition by name (GUID).
+// Parameters:
+// scope - the scope of the role definition.
+// roleDefinitionID - the ID of the role definition.
+func (client RoleDefinitionsClient) Get(ctx context.Context, scope string, roleDefinitionID string) (result RoleDefinition, err error) {
+	req, err := client.GetPreparer(ctx, scope, roleDefinitionID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "Get", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "Get", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "Get", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetPreparer prepares the Get request.
+func (client RoleDefinitionsClient) GetPreparer(ctx context.Context, scope string, roleDefinitionID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleDefinitionId": autorest.Encode("path", roleDefinitionID),
+		"scope":            scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetSender sends the Get request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleDefinitionsClient) GetSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetResponder handles the response to the Get request. The method always
+// closes the http.Response Body.
+func (client RoleDefinitionsClient) GetResponder(resp *http.Response) (result RoleDefinition, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// GetByID gets a role definition by ID.
+// Parameters:
+// roleID - the fully qualified role definition ID. Use the format,
+// /subscriptions/{guid}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for subscription
+// level role definitions, or /providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId} for tenant
+// level role definitions.
+func (client RoleDefinitionsClient) GetByID(ctx context.Context, roleID string) (result RoleDefinition, err error) {
+	req, err := client.GetByIDPreparer(ctx, roleID)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "GetByID", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.GetByIDSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "GetByID", resp, "Failure sending request")
+		return
+	}
+
+	result, err = client.GetByIDResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "GetByID", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// GetByIDPreparer prepares the GetByID request.
+func (client RoleDefinitionsClient) GetByIDPreparer(ctx context.Context, roleID string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"roleId": roleID,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{roleId}", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// GetByIDSender sends the GetByID request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleDefinitionsClient) GetByIDSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// GetByIDResponder handles the response to the GetByID request. The method always
+// closes the http.Response Body.
+func (client RoleDefinitionsClient) GetByIDResponder(resp *http.Response) (result RoleDefinition, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// List get all role definitions that are applicable at scope and above.
+// Parameters:
+// scope - the scope of the role definition.
+// filter - the filter to apply on the operation. Use atScopeAndBelow filter to search below the given scope as
+// well.
+func (client RoleDefinitionsClient) List(ctx context.Context, scope string, filter string) (result RoleDefinitionListResultPage, err error) {
+	result.fn = client.listNextResults
+	req, err := client.ListPreparer(ctx, scope, filter)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "List", nil, "Failure preparing request")
+		return
+	}
+
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.rdlr.Response = autorest.Response{Response: resp}
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "List", resp, "Failure sending request")
+		return
+	}
+
+	result.rdlr, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "List", resp, "Failure responding to request")
+	}
+
+	return
+}
+
+// ListPreparer prepares the List request.
+func (client RoleDefinitionsClient) ListPreparer(ctx context.Context, scope string, filter string) (*http.Request, error) {
+	pathParameters := map[string]interface{}{
+		"scope": scope,
+	}
+
+	const APIVersion = "2018-01-01-preview"
+	queryParameters := map[string]interface{}{
+		"api-version": APIVersion,
+	}
+	if len(filter) > 0 {
+		queryParameters["$filter"] = autorest.Encode("query", filter)
+	}
+
+	preparer := autorest.CreatePreparer(
+		autorest.AsGet(),
+		autorest.WithBaseURL(client.BaseURI),
+		autorest.WithPathParameters("/{scope}/providers/Microsoft.Authorization/roleDefinitions", pathParameters),
+		autorest.WithQueryParameters(queryParameters))
+	return preparer.Prepare((&http.Request{}).WithContext(ctx))
+}
+
+// ListSender sends the List request. The method will close the
+// http.Response Body if it receives an error.
+func (client RoleDefinitionsClient) ListSender(req *http.Request) (*http.Response, error) {
+	return autorest.SendWithSender(client, req,
+		autorest.DoRetryForStatusCodes(client.RetryAttempts, client.RetryDuration, autorest.StatusCodesForRetry...))
+}
+
+// ListResponder handles the response to the List request. The method always
+// closes the http.Response Body.
+func (client RoleDefinitionsClient) ListResponder(resp *http.Response) (result RoleDefinitionListResult, err error) {
+	err = autorest.Respond(
+		resp,
+		client.ByInspecting(),
+		azure.WithErrorUnlessStatusCode(http.StatusOK),
+		autorest.ByUnmarshallingJSON(&result),
+		autorest.ByClosing())
+	result.Response = autorest.Response{Response: resp}
+	return
+}
+
+// listNextResults retrieves the next set of results, if any.
+func (client RoleDefinitionsClient) listNextResults(lastResults RoleDefinitionListResult) (result RoleDefinitionListResult, err error) {
+	req, err := lastResults.roleDefinitionListResultPreparer()
+	if err != nil {
+		return result, autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "listNextResults", nil, "Failure preparing next results request")
+	}
+	if req == nil {
+		return
+	}
+	resp, err := client.ListSender(req)
+	if err != nil {
+		result.Response = autorest.Response{Response: resp}
+		return result, autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "listNextResults", resp, "Failure sending next results request")
+	}
+	result, err = client.ListResponder(resp)
+	if err != nil {
+		err = autorest.NewErrorWithError(err, "authorization.RoleDefinitionsClient", "listNextResults", resp, "Failure responding to next results request")
+	}
+	return
+}
+
+// ListComplete enumerates all values, automatically crossing page boundaries as required.
+func (client RoleDefinitionsClient) ListComplete(ctx context.Context, scope string, filter string) (result RoleDefinitionListResultIterator, err error) {
+	result.page, err = client.List(ctx, scope, filter)
+	return
+}

vendor/github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization/version.go

@@ -0,0 +1,30 @@
+package authorization
+
+import "github.com/Azure/azure-sdk-for-go/version"
+
+// Copyright (c) Microsoft and contributors.  All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Code generated by Microsoft (R) AutoRest Code Generator.
+// Changes may cause incorrect behavior and will be lost if the code is regenerated.
+
+// UserAgent returns the UserAgent string to use when sending http.Requests.
+func UserAgent() string {
+	return "Azure-SDK-For-Go/" + version.Number + " authorization/2018-01-01-preview"
+}
+
+// Version returns the semantic version (see http://semver.org) of the client.
+func Version() string {
+	return version.Number
+}

vendor/github.com/hashicorp/vault-plugin-secrets-azure/Gopkg.lock

@@ -0,0 +1,345 @@
+# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
+
+
+[[projects]]
+  name = "github.com/Azure/azure-sdk-for-go"
+  packages = [
+    "profiles/latest/compute/mgmt/compute",
+    "services/compute/mgmt/2018-04-01/compute",
+    "services/graphrbac/1.6/graphrbac",
+    "services/preview/authorization/mgmt/2018-01-01-preview/authorization",
+    "version"
+  ]
+  revision = "7971189ecf5a584b9211f2527737f94bb979644e"
+  version = "v17.4.0"
+
+[[projects]]
+  name = "github.com/Azure/go-autorest"
+  packages = [
+    "autorest",
+    "autorest/adal",
+    "autorest/azure",
+    "autorest/azure/auth",
+    "autorest/date",
+    "autorest/to",
+    "autorest/validation",
+    "logger",
+    "version"
+  ]
+  revision = "39013ecb48eaf6ced3f4e3e1d95515140ce6b3cf"
+  version = "v10.15.2"
+
+[[projects]]
+  name = "github.com/SermoDigital/jose"
+  packages = [
+    ".",
+    "crypto",
+    "jws",
+    "jwt"
+  ]
+  revision = "f6df55f235c24f236d11dbcf665249a59ac2021f"
+  version = "1.1"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/armon/go-radix"
+  packages = ["."]
+  revision = "7fddfc383310abc091d79a27f116d30cf0424032"
+
+[[projects]]
+  name = "github.com/dgrijalva/jwt-go"
+  packages = ["."]
+  revision = "06ea1031745cb8b3dab3f6a236daf2b0aa468b7e"
+  version = "v3.2.0"
+
+[[projects]]
+  name = "github.com/dimchansky/utfbom"
+  packages = ["."]
+  revision = "5448fe645cb1964ba70ac8f9f2ffe975e61a536c"
+  version = "v1.0.0"
+
+[[projects]]
+  name = "github.com/go-test/deep"
+  packages = ["."]
+  revision = "6592d9cc0a499ad2d5f574fde80a2b5c5cc3b4f5"
+  version = "v1.0.1"
+
+[[projects]]
+  name = "github.com/golang/protobuf"
+  packages = [
+    "proto",
+    "ptypes",
+    "ptypes/any",
+    "ptypes/duration",
+    "ptypes/timestamp"
+  ]
+  revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
+  version = "v1.1.0"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/golang/snappy"
+  packages = ["."]
+  revision = "2e65f85255dbc3072edf28d6b5b8efc472979f5a"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/errwrap"
+  packages = ["."]
+  revision = "d6c0cd88035724dd42e0f335ae30161c20575ecc"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-cleanhttp"
+  packages = ["."]
+  revision = "d5fe4b57a186c716b0e00b8c301cbd9b4182694d"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-hclog"
+  packages = ["."]
+  revision = "ff2cf002a8dd750586d91dddd4470c341f981fe1"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-immutable-radix"
+  packages = ["."]
+  revision = "7f3cd4390caab3250a57f30efdb2a65dd7649ecf"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-multierror"
+  packages = ["."]
+  revision = "3d5d8f294aa03d8e98859feac328afbdf1ae0703"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-plugin"
+  packages = ["."]
+  revision = "a4620f9913d19f03a6bf19b2f304daaaf83ea130"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-retryablehttp"
+  packages = ["."]
+  revision = "e651d75abec6fbd4f2c09508f72ae7af8a8b7171"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-rootcerts"
+  packages = ["."]
+  revision = "6bb64b370b90e7ef1fa532be9e591a81c3493e00"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-sockaddr"
+  packages = ["."]
+  revision = "6d291a969b86c4b633730bfc6b8b9d64c3aafed9"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-uuid"
+  packages = ["."]
+  revision = "27454136f0364f2d44b1276c552d69105cf8c498"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/go-version"
+  packages = ["."]
+  revision = "270f2f71b1ee587f3b609f00f422b76a6b28f348"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/golang-lru"
+  packages = [
+    ".",
+    "simplelru"
+  ]
+  revision = "0fb14efe8c47ae851c0034ed7a448854d3d34cf3"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/hcl"
+  packages = [
+    ".",
+    "hcl/ast",
+    "hcl/parser",
+    "hcl/scanner",
+    "hcl/strconv",
+    "hcl/token",
+    "json/parser",
+    "json/scanner",
+    "json/token"
+  ]
+  revision = "ef8a98b0bbce4a65b5aa4c368430a80ddc533168"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/vault"
+  packages = [
+    "api",
+    "helper/certutil",
+    "helper/compressutil",
+    "helper/consts",
+    "helper/errutil",
+    "helper/hclutil",
+    "helper/jsonutil",
+    "helper/locksutil",
+    "helper/logging",
+    "helper/mlock",
+    "helper/parseutil",
+    "helper/pathmanager",
+    "helper/pluginutil",
+    "helper/salt",
+    "helper/strutil",
+    "helper/useragent",
+    "helper/wrapping",
+    "logical",
+    "logical/framework",
+    "logical/plugin",
+    "logical/plugin/pb",
+    "physical",
+    "physical/inmem",
+    "version"
+  ]
+  revision = "7f2a5c2f76890edf10c7e1b3b451fbe1469265ea"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/hashicorp/yamux"
+  packages = ["."]
+  revision = "3520598351bb3500a49ae9563f5539666ae0a27c"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/mitchellh/go-homedir"
+  packages = ["."]
+  revision = "58046073cbffe2f25d425fe1331102f55cf719de"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/mitchellh/go-testing-interface"
+  packages = ["."]
+  revision = "a61a99592b77c9ba629d254a693acffaeb4b7e28"
+
+[[projects]]
+  branch = "master"
+  name = "github.com/mitchellh/mapstructure"
+  packages = ["."]
+  revision = "f15292f7a699fcc1a38a80977f80a046874ba8ac"
+
+[[projects]]
+  name = "github.com/oklog/run"
+  packages = ["."]
+  revision = "4dadeb3030eda0273a12382bb2348ffc7c9d1a39"
+  version = "v1.0.0"
+
+[[projects]]
+  name = "github.com/ryanuber/go-glob"
+  packages = ["."]
+  revision = "572520ed46dbddaed19ea3d9541bdd0494163693"
+  version = "v0.1"
+
+[[projects]]
+  branch = "master"
+  name = "golang.org/x/crypto"
+  packages = [
+    "pkcs12",
+    "pkcs12/internal/rc2"
+  ]
+  revision = "de0752318171da717af4ce24d0a2e8626afaeb11"
+
+[[projects]]
+  branch = "master"
+  name = "golang.org/x/net"
+  packages = [
+    "context",
+    "http/httpguts",
+    "http2",
+    "http2/hpack",
+    "idna",
+    "internal/timeseries",
+    "trace"
+  ]
+  revision = "aaf60122140d3fcf75376d319f0554393160eb50"
+
+[[projects]]
+  branch = "master"
+  name = "golang.org/x/sys"
+  packages = ["unix"]
+  revision = "1c9583448a9c3aa0f9a6a5241bf73c0bd8aafded"
+
+[[projects]]
+  name = "golang.org/x/text"
+  packages = [
+    "collate",
+    "collate/build",
+    "internal/colltab",
+    "internal/gen",
+    "internal/tag",
+    "internal/triegen",
+    "internal/ucd",
+    "language",
+    "secure/bidirule",
+    "transform",
+    "unicode/bidi",
+    "unicode/cldr",
+    "unicode/norm",
+    "unicode/rangetable"
+  ]
+  revision = "f21a4dfb5e38f5895301dc265a8def02365cc3d0"
+  version = "v0.3.0"
+
+[[projects]]
+  branch = "master"
+  name = "golang.org/x/time"
+  packages = ["rate"]
+  revision = "fbb02b2291d28baffd63558aa44b4b56f178d650"
+
+[[projects]]
+  branch = "master"
+  name = "google.golang.org/genproto"
+  packages = ["googleapis/rpc/status"]
+  revision = "d0a8f471bba2dbb160885b0000d814ee5d559bad"
+
+[[projects]]
+  name = "google.golang.org/grpc"
+  packages = [
+    ".",
+    "balancer",
+    "balancer/base",
+    "balancer/roundrobin",
+    "codes",
+    "connectivity",
+    "credentials",
+    "encoding",
+    "encoding/proto",
+    "grpclog",
+    "health",
+    "health/grpc_health_v1",
+    "internal",
+    "internal/backoff",
+    "internal/channelz",
+    "internal/envconfig",
+    "internal/grpcrand",
+    "internal/transport",
+    "keepalive",
+    "metadata",
+    "naming",
+    "peer",
+    "resolver",
+    "resolver/dns",
+    "resolver/passthrough",
+    "stats",
+    "status",
+    "tap"
+  ]
+  revision = "32fb0ac620c32ba40a4626ddf94d90d12cce3455"
+  version = "v1.14.0"
+
+[solve-meta]
+  analyzer-name = "dep"
+  analyzer-version = 1
+  inputs-digest = "15ffa51112eb2207ad27db0fb960075fbd5e7008337c5077921f8e0735dfb0a3"
+  solver-name = "gps-cdcl"
+  solver-version = 1

vendor/github.com/hashicorp/vault-plugin-secrets-azure/Gopkg.toml

@@ -0,0 +1,46 @@
+# Gopkg.toml example
+#
+# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
+# for detailed Gopkg.toml documentation.
+#
+# required = ["github.com/user/thing/cmd/thing"]
+# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
+#
+# [[constraint]]
+#   name = "github.com/user/project"
+#   version = "1.0.0"
+#
+# [[constraint]]
+#   name = "github.com/user/project2"
+#   branch = "dev"
+#   source = "github.com/myfork/project2"
+#
+# [[override]]
+#   name = "github.com/x/y"
+#   version = "2.4.0"
+#
+# [prune]
+#   non-go = false
+#   go-tests = true
+#   unused-packages = true
+
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/hashicorp/errwrap"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/hashicorp/go-multierror"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/hashicorp/vault"
+
+[[constraint]]
+  name = "github.com/Azure/azure-sdk-for-go"
+  version = "17.4.0"
+
+[prune]
+  go-tests = true
+  unused-packages = true

vendor/github.com/hashicorp/vault-plugin-secrets-azure/LICENSE

@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.

vendor/github.com/hashicorp/vault-plugin-secrets-azure/Makefile

@@ -0,0 +1,62 @@
+TOOL?=vault-plugin-secrets-azure
+TEST?=$$(go list ./... | grep -v /vendor/)
+VETARGS?=-asmdecl -atomic -bool -buildtags -copylocks -methods -nilfunc -printf -rangeloops -shift -structtags -unsafeptr
+EXTERNAL_TOOLS=\
+	github.com/mitchellh/gox \
+	github.com/kardianos/govendor
+BUILD_TAGS?=${TOOL}
+GOFMT_FILES?=$$(find . -name '*.go' | grep -v vendor)
+
+# bin generates the releaseable binaries for this plugin
+bin: fmtcheck generate
+	@CGO_ENABLED=0 BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"
+
+default: dev
+
+# dev creates binaries for testing Vault locally. These are put
+# into ./bin/ as well as $GOPATH/bin, except for quickdev which
+# is only put into /bin/
+quickdev: generate
+	@CGO_ENABLED=0 go build -i -tags='$(BUILD_TAGS)' -o bin/vault-plugin-secrets-azure
+dev: fmtcheck generate
+	@CGO_ENABLED=0 BUILD_TAGS='$(BUILD_TAGS)' VAULT_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"
+dev-dynamic: generate
+	@CGO_ENABLED=1 BUILD_TAGS='$(BUILD_TAGS)' VAULT_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"
+
+testcompile: fmtcheck generate
+	@for pkg in $(TEST) ; do \
+		go test -v -c -tags='$(BUILD_TAGS)' $$pkg -parallel=4 ; \
+	done
+
+# test runs all tests
+test: fmtcheck generate
+	@if [ "$(TEST)" = "./..." ]; then \
+		echo "ERROR: Set TEST to a specific package"; \
+		exit 1; \
+	fi
+	VAULT_ACC=1 go test -tags='$(BUILD_TAGS)' $(TEST) -v $(TESTARGS) -timeout 45m
+
+# generate runs `go generate` to build the dynamically generated
+# source files.
+generate:
+	go generate $(go list ./... | grep -v /vendor/)
+
+# bootstrap the build by downloading additional tools
+bootstrap:
+	@for tool in  $(EXTERNAL_TOOLS) ; do \
+		echo "Installing/Updating $$tool" ; \
+		go get -u $$tool; \
+	done
+
+fmtcheck:
+	@sh -c "'$(CURDIR)/scripts/gofmtcheck.sh'"
+
+fmt:
+	gofmt -w $(GOFMT_FILES)
+
+# TODO: remove once the docs are moved into the Vault repo
+copy_website:
+	cp website-docs/docs.html.md ../vault/website/source/docs/secrets/azure/index.html.md
+	cp website-docs/api.html.md ../vault/website/source/api/secret/azure/index.html.md
+
+.PHONY: bin default generate test vet bootstrap fmt fmtcheck

vendor/github.com/hashicorp/vault-plugin-secrets-azure/README.md

@@ -0,0 +1,124 @@
+# Vault Plugin: Azure Secrets Backend [![Build Status](https://travis-ci.org/hashicorp/vault-plugin-secrets-azure.svg?branch=master)](https://travis-ci.org/hashicorp/vault-plugin-secrets-azure)
+
+This is a standalone backend plugin for use with [Hashicorp Vault](https://www.github.com/hashicorp/vault).
+This plugin generates revocable, time-limited Service Principals for Microsoft Azure.
+
+**Please note**: We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, _please responsibly disclose_ by contacting us at [security@hashicorp.com](mailto:security@hashicorp.com).
+
+## Quick Links
+- [Vault Website](https://www.vaultproject.io)
+- [Azure Secrets Docs](https://www.vaultproject.io/docs/secrets/azure/index.html)
+- [Vault Github Project](https://www.github.com/hashicorp/vault)
+
+## Getting Started
+
+This is a [Vault plugin](https://www.vaultproject.io/docs/internals/plugins.html)
+and is meant to work with Vault. This guide assumes you have already installed Vault
+and have a basic understanding of how Vault works.
+
+Otherwise, first read this guide on how to [get started with Vault](https://www.vaultproject.io/intro/getting-started/install.html).
+
+To learn specifically about how plugins work, see documentation on [Vault plugins](https://www.vaultproject.io/docs/internals/plugins.html).
+
+## Usage
+
+Please see [documentation for the plugin](https://www.vaultproject.io/docs/secrets/azure/index.html)
+on the Vault website.
+
+This plugin is currently built into Vault and by default is accessed
+at `azure`. To enable this in a running Vault server:
+
+```sh
+$ vault secrets enable azure
+Success! Enabled the azure secrets engine at: azure/
+```
+
+
+## Developing
+
+If you wish to work on this plugin, you'll first need
+[Go](https://www.golang.org) installed on your machine
+(version 1.10+ is *required*).
+
+For local dev first make sure Go is properly installed, including
+setting up a [GOPATH](https://golang.org/doc/code.html#GOPATH).
+Next, clone this repository into
+`$GOPATH/src/github.com/hashicorp/vault-plugin-secrets-azure`.
+You can then download any required build tools by bootstrapping your
+environment:
+
+```sh
+$ make bootstrap
+```
+
+To compile a development version of this plugin, run `make` or `make dev`.
+This will put the plugin binary in the `bin` and `$GOPATH/bin` folders. `dev`
+mode will only generate the binary for your platform and is faster:
+
+```sh
+$ make
+$ make dev
+```
+
+Put the plugin binary into a location of your choice. This directory
+will be specified as the [`plugin_directory`](https://www.vaultproject.io/docs/configuration/index.html#plugin_directory)
+in the Vault config used to start the server.
+
+```json
+...
+plugin_directory = "path/to/plugin/directory"
+...
+```
+
+Start a Vault server with this config file:
+```sh
+$ vault server -config=path/to/config.json ...
+...
+```
+
+Once the server is started, register the plugin in the Vault server's [plugin catalog](https://www.vaultproject.io/docs/internals/plugins.html#plugin-catalog):
+
+```sh
+$ vault write sys/plugins/catalog/azure \
+        sha_256=<expected SHA256 Hex value of the plugin binary> \
+        command="vault-plugin-secrets-azure"
+...
+Success! Data written to: sys/plugins/catalog/azure
+```
+
+Note you should generate a new sha256 checksum if you have made changes
+to the plugin. Example using openssl:
+
+```sh
+openssl dgst -sha256 $GOPATH/vault-plugin-secrets-azure
+...
+SHA256(.../go/bin/vault-plugin-secrets-azure)= 896c13c0f5305daed381952a128322e02bc28a57d0c862a78cbc2ea66e8c6fa1
+```
+
+Enable the auth plugin backend using the secrets enable plugin command:
+
+```sh
+$ vault secrets enable -plugin-name='azure' plugin
+...
+
+Successfully enabled 'plugin' at 'azure'!
+```
+
+#### Tests
+
+If you are developing this plugin and want to verify it is still
+functioning (and you haven't broken anything else), we recommend
+running the tests.
+
+To run the tests, invoke `make test`:
+
+```sh
+$ make test
+```
+
+You can also specify a `TESTARGS` variable to filter tests like so:
+
+```sh
+$ make test TESTARGS='--run=TestConfig'
+```
+

vendor/github.com/hashicorp/vault-plugin-secrets-azure/backend.go

@@ -0,0 +1,83 @@
+package azuresecrets
+
+import (
+	"context"
+	"strings"
+	"sync"
+
+	"github.com/hashicorp/vault/logical"
+	"github.com/hashicorp/vault/logical/framework"
+)
+
+type azureSecretBackend struct {
+	*framework.Backend
+
+	getProvider func(*clientSettings) (AzureProvider, error)
+	settings    *clientSettings
+	lock        sync.RWMutex
+}
+
+func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
+	b := backend()
+	if err := b.Setup(ctx, conf); err != nil {
+		return nil, err
+	}
+	return b, nil
+}
+
+func backend() *azureSecretBackend {
+	var b = azureSecretBackend{}
+
+	b.Backend = &framework.Backend{
+		Help: strings.TrimSpace(backendHelp),
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config",
+			},
+		},
+		Paths: framework.PathAppend(
+			pathsRole(&b),
+			[]*framework.Path{
+				pathConfig(&b),
+				pathServicePrincipal(&b),
+			},
+		),
+		Secrets: []*framework.Secret{
+			secretServicePrincipal(&b),
+		},
+		BackendType: logical.TypeLogical,
+		Invalidate:  b.invalidate,
+	}
+
+	b.getProvider = newAzureProvider
+
+	return &b
+}
+
+// reset clears the backend's Provider
+// This is useful when the configuration changes and a new Provider should be
+// created with the updated settings.
+func (b *azureSecretBackend) reset() {
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	b.settings = nil
+}
+
+func (b *azureSecretBackend) invalidate(ctx context.Context, key string) {
+	switch key {
+	case "config":
+		b.reset()
+	}
+}
+
+const backendHelp = `
+The Azure secrets backend dynamically generates Azure service
+principals. The SP credentials have a configurable lease and
+are automatically revoked at the end of the lease.
+
+After mounting this backend, credentials to manage Azure resources
+must be configured with the "config/" endpoints and policies must be
+written using the "roles/" endpoints before any credentials can be
+generated.
+`

vendor/github.com/hashicorp/vault-plugin-secrets-azure/client.go

@@ -0,0 +1,295 @@
+package azuresecrets
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac"
+	"github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization"
+	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/date"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/hashicorp/errwrap"
+	multierror "github.com/hashicorp/go-multierror"
+	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/logical"
+)
+
+const appNamePrefix = "vault-"
+
+// client offers higher level Azure operations that provide a simpler interface
+// for handlers. It in turn relies on a Provider interface to access the lower level
+// Azure Client SDK methods.
+type client struct {
+	provider AzureProvider
+	settings *clientSettings
+}
+
+func (b *azureSecretBackend) getClient(ctx context.Context, s logical.Storage) (*client, error) {
+	b.lock.RLock()
+	unlockFunc := b.lock.RUnlock
+	defer func() { unlockFunc() }()
+
+	if b.settings == nil {
+		// Upgrade lock
+		b.lock.RUnlock()
+		b.lock.Lock()
+		unlockFunc = b.lock.Unlock
+
+		if b.settings == nil {
+			// Create a new client from the stored or empty config
+			config, err := b.getConfig(ctx, s)
+			if err != nil {
+				return nil, err
+			}
+			if config == nil {
+				config = new(azureConfig)
+			}
+
+			settings, err := b.getClientSettings(ctx, config)
+			if err != nil {
+				return nil, err
+			}
+			b.settings = settings
+		}
+	}
+
+	p, err := b.getProvider(b.settings)
+	if err != nil {
+		return nil, err
+	}
+
+	c := &client{
+		provider: p,
+		settings: b.settings,
+	}
+
+	return c, nil
+}
+
+// createApp creates a new Azure application.
+// An Application is a needed to create service principals used by
+// the caller for authentication.
+func (c *client) createApp(ctx context.Context) (app *graphrbac.Application, err error) {
+	name, err := uuid.GenerateUUID()
+	if err != nil {
+		return nil, err
+	}
+
+	name = appNamePrefix + name
+
+	appURL := fmt.Sprintf("https://%s", name)
+
+	result, err := c.provider.CreateApplication(ctx, graphrbac.ApplicationCreateParameters{
+		AvailableToOtherTenants: to.BoolPtr(false),
+		DisplayName:             to.StringPtr(name),
+		Homepage:                to.StringPtr(appURL),
+		IdentifierUris:          to.StringSlicePtr([]string{appURL}),
+	})
+
+	return &result, err
+}
+
+// createSP creates a new service principal.
+func (c *client) createSP(
+	ctx context.Context,
+	app *graphrbac.Application,
+	duration time.Duration) (*graphrbac.ServicePrincipal, string, error) {
+
+	// Generate a random key (which must be a UUID) and password
+	keyID, err := uuid.GenerateUUID()
+	if err != nil {
+		return nil, "", err
+	}
+
+	password, err := uuid.GenerateUUID()
+	if err != nil {
+		return nil, "", err
+	}
+
+	resultRaw, err := retry(ctx, func() (interface{}, bool, error) {
+		now := time.Now()
+		result, err := c.provider.CreateServicePrincipal(ctx, graphrbac.ServicePrincipalCreateParameters{
+			AppID:          app.AppID,
+			AccountEnabled: to.BoolPtr(true),
+			PasswordCredentials: &[]graphrbac.PasswordCredential{
+				graphrbac.PasswordCredential{
+					StartDate: &date.Time{Time: now},
+					EndDate:   &date.Time{Time: now.Add(duration)},
+					KeyID:     to.StringPtr(keyID),
+					Value:     to.StringPtr(password),
+				},
+			},
+		})
+
+		// Propagation delays within Azure can cause this error occasionally, so don't quit on it.
+		if err != nil && strings.Contains(err.Error(), "does not reference a valid application object") {
+			return nil, false, nil
+		}
+
+		return result, true, err
+	})
+
+	result := resultRaw.(graphrbac.ServicePrincipal)
+
+	return &result, password, err
+}
+
+// deleteApp deletes an Azure application.
+func (c *client) deleteApp(ctx context.Context, appObjectID string) error {
+	resp, err := c.provider.DeleteApplication(ctx, appObjectID)
+
+	// Don't consider it an error if the object wasn't present
+	if err != nil && resp.Response != nil && resp.StatusCode == 404 {
+		return nil
+	}
+
+	return err
+}
+
+// assignRoles assigns Azure roles to a service principal.
+func (c *client) assignRoles(ctx context.Context, sp *graphrbac.ServicePrincipal, roles []*azureRole) ([]string, error) {
+	var ids []string
+
+	for _, role := range roles {
+		assignmentID, err := uuid.GenerateUUID()
+		if err != nil {
+			return nil, err
+		}
+
+		resultRaw, err := retry(ctx, func() (interface{}, bool, error) {
+			ra, err := c.provider.CreateRoleAssignment(ctx, role.Scope, assignmentID,
+				authorization.RoleAssignmentCreateParameters{
+					RoleAssignmentProperties: &authorization.RoleAssignmentProperties{
+						RoleDefinitionID: to.StringPtr(role.RoleID),
+						PrincipalID:      sp.ObjectID,
+					},
+				})
+
+			// Propagation delays within Azure can cause this error occasionally, so don't quit on it.
+			if err != nil && strings.Contains(err.Error(), "PrincipalNotFound") {
+				return nil, false, nil
+			}
+
+			return to.String(ra.ID), true, err
+		})
+
+		if err != nil {
+			return nil, errwrap.Wrapf("error while assigning roles: {{err}}", err)
+		}
+
+		ids = append(ids, resultRaw.(string))
+	}
+
+	return ids, nil
+}
+
+// unassignRoles deletes role assignments, if they existed.
+// This is a clean-up operation that isn't essential to revocation. As such, an
+// attempt is made to remove all assignments, and not return immediately if there
+// is an error.
+func (c *client) unassignRoles(ctx context.Context, roleIDs []string) error {
+	var merr *multierror.Error
+
+	for _, id := range roleIDs {
+		if _, err := c.provider.DeleteRoleAssignmentByID(ctx, id); err != nil {
+			merr = multierror.Append(merr, errwrap.Wrapf("error unassigning role: {{err}}", err))
+		}
+	}
+
+	return merr.ErrorOrNil()
+}
+
+// search for roles by name
+func (c *client) findRoles(ctx context.Context, roleName string) ([]authorization.RoleDefinition, error) {
+	return c.provider.ListRoles(ctx, fmt.Sprintf("subscriptions/%s", c.settings.SubscriptionID), fmt.Sprintf("roleName eq '%s'", roleName))
+}
+
+// clientSettings is used by a client to configure the connections to Azure.
+// It is created from a combination of Vault config settings and environment variables.
+type clientSettings struct {
+	SubscriptionID string
+	TenantID       string
+	ClientID       string
+	ClientSecret   string
+	Environment    azure.Environment
+	PluginEnv      *logical.PluginEnvironment
+}
+
+// getClientSettings creates a new clientSettings object.
+// Environment variables have higher precedence than stored configuration.
+func (b *azureSecretBackend) getClientSettings(ctx context.Context, config *azureConfig) (*clientSettings, error) {
+	firstAvailable := func(opts ...string) string {
+		for _, s := range opts {
+			if s != "" {
+				return s
+			}
+		}
+		return ""
+	}
+
+	settings := new(clientSettings)
+
+	settings.ClientID = firstAvailable(os.Getenv("AZURE_CLIENT_ID"), config.ClientID)
+	settings.ClientSecret = firstAvailable(os.Getenv("AZURE_CLIENT_SECRET"), config.ClientSecret)
+	settings.SubscriptionID = firstAvailable(os.Getenv("AZURE_SUBSCRIPTION_ID"))
+
+	settings.SubscriptionID = firstAvailable(os.Getenv("AZURE_SUBSCRIPTION_ID"), config.SubscriptionID)
+	if settings.SubscriptionID == "" {
+		return nil, errors.New("subscription_id is required")
+	}
+
+	settings.TenantID = firstAvailable(os.Getenv("AZURE_TENANT_ID"), config.TenantID)
+	if settings.TenantID == "" {
+		return nil, errors.New("tenant_id is required")
+	}
+
+	envName := firstAvailable(os.Getenv("AZURE_ENVIRONMENT"), config.Environment, "AZUREPUBLICCLOUD")
+	env, err := azure.EnvironmentFromName(envName)
+	if err != nil {
+		return nil, err
+	}
+	settings.Environment = env
+
+	pluginEnv, err := b.System().PluginEnv(ctx)
+	if err != nil {
+		return nil, errwrap.Wrapf("error loading plugin environment: {{err}}", err)
+	}
+	settings.PluginEnv = pluginEnv
+
+	return settings, nil
+}
+
+// retry will repeatedly call f until one of:
+//   * f returns true
+//   * the context is cancelled
+//   * 3 minutes elapse
+//
+// Delays are random but will average 5 seconds. The hardcoded durations are the same
+// ones used in the Azure CLI tool.
+func retry(ctx context.Context, f func() (interface{}, bool, error)) (interface{}, error) {
+	delayTimer := time.NewTimer(0)
+	endCh := time.NewTimer(3 * time.Minute).C
+
+	for {
+		if result, done, err := f(); done {
+			return result, err
+		}
+
+		delay := time.Duration(2000+rand.Intn(6000)) * time.Millisecond
+		delayTimer.Reset(delay)
+
+		select {
+		case <-delayTimer.C:
+		case <-endCh:
+			return nil, errors.New("retry: timeout")
+		case <-ctx.Done():
+			return nil, errors.New("retry: cancelled")
+		}
+	}
+}

vendor/github.com/hashicorp/vault-plugin-secrets-azure/path_config.go

@@ -0,0 +1,202 @@
+package azuresecrets
+
+import (
+	"context"
+	"errors"
+
+	"github.com/Azure/go-autorest/autorest/azure"
+	multierror "github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/vault/logical"
+	"github.com/hashicorp/vault/logical/framework"
+)
+
+const (
+	configStoragePath = "config"
+)
+
+// azureConfig contains values to configure Azure clients and
+// defaults for roles. The zero value is useful and results in
+// environments variable and system defaults being used.
+type azureConfig struct {
+	SubscriptionID string `json:"subscription_id"`
+	TenantID       string `json:"tenant_id"`
+	ClientID       string `json:"client_id"`
+	ClientSecret   string `json:"client_secret"`
+	Environment    string `json:"environment"`
+}
+
+func pathConfig(b *azureSecretBackend) *framework.Path {
+	return &framework.Path{
+		Pattern: "config",
+		Fields: map[string]*framework.FieldSchema{
+			"subscription_id": &framework.FieldSchema{
+				Type: framework.TypeString,
+				Description: `The subscription id for the Azure Active Directory.
+				This value can also be provided with the AZURE_SUBSCRIPTION_ID environment variable.`,
+			},
+			"tenant_id": &framework.FieldSchema{
+				Type: framework.TypeString,
+				Description: `The tenant id for the Azure Active Directory. This value can also
+				be provided with the AZURE_TENANT_ID environment variable.`,
+			},
+			"environment": &framework.FieldSchema{
+				Type: framework.TypeString,
+				Description: `The Azure environment name. If not provided, AzurePublicCloud is used.
+				This value can also be provided with the AZURE_ENVIRONMENT environment variable.`,
+			},
+			"client_id": &framework.FieldSchema{
+				Type: framework.TypeString,
+				Description: `The OAuth2 client id to connect to Azure.
+				This value can also be provided with the AZURE_CLIENT_ID environment variable.`,
+			},
+			"client_secret": &framework.FieldSchema{
+				Type: framework.TypeString,
+				Description: `The OAuth2 client secret to connect to Azure.
+				This value can also be provided with the AZURE_CLIENT_SECRET environment variable.`,
+			},
+		},
+		Callbacks: map[logical.Operation]framework.OperationFunc{
+			logical.ReadOperation:   b.pathConfigRead,
+			logical.CreateOperation: b.pathConfigWrite,
+			logical.UpdateOperation: b.pathConfigWrite,
+			logical.DeleteOperation: b.pathConfigDelete,
+		},
+		ExistenceCheck:  b.pathConfigExistenceCheck,
+		HelpSynopsis:    confHelpSyn,
+		HelpDescription: confHelpDesc,
+	}
+}
+
+func (b *azureSecretBackend) pathConfigWrite(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	var merr *multierror.Error
+
+	config, err := b.getConfig(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+
+	if config == nil {
+		if req.Operation == logical.UpdateOperation {
+			return nil, errors.New("config not found during update operation")
+		}
+		config = new(azureConfig)
+	}
+
+	if subscriptionID, ok := data.GetOk("subscription_id"); ok {
+		config.SubscriptionID = subscriptionID.(string)
+	}
+
+	if tenantID, ok := data.GetOk("tenant_id"); ok {
+		config.TenantID = tenantID.(string)
+	}
+
+	if environment, ok := data.GetOk("environment"); ok {
+		e := environment.(string)
+		if _, err := azure.EnvironmentFromName(e); err != nil {
+			merr = multierror.Append(merr, err)
+		} else {
+			config.Environment = e
+		}
+	}
+
+	if clientID, ok := data.GetOk("client_id"); ok {
+		config.ClientID = clientID.(string)
+	}
+
+	if clientSecret, ok := data.GetOk("client_secret"); ok {
+		config.ClientSecret = clientSecret.(string)
+	}
+
+	if merr.ErrorOrNil() != nil {
+		return logical.ErrorResponse(merr.Error()), nil
+	}
+
+	err = b.saveConfig(ctx, config, req.Storage)
+
+	return nil, err
+}
+
+func (b *azureSecretBackend) pathConfigRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	config, err := b.getConfig(ctx, req.Storage)
+
+	if err != nil {
+		return nil, err
+	}
+
+	if config == nil {
+		config = new(azureConfig)
+	}
+
+	resp := &logical.Response{
+		Data: map[string]interface{}{
+			"subscription_id": config.SubscriptionID,
+			"tenant_id":       config.TenantID,
+			"environment":     config.Environment,
+			"client_id":       config.ClientID,
+		},
+	}
+	return resp, nil
+}
+
+func (b *azureSecretBackend) pathConfigDelete(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	err := req.Storage.Delete(ctx, configStoragePath)
+
+	if err == nil {
+		b.reset()
+	}
+
+	return nil, err
+}
+
+func (b *azureSecretBackend) pathConfigExistenceCheck(ctx context.Context, req *logical.Request, data *framework.FieldData) (bool, error) {
+	config, err := b.getConfig(ctx, req.Storage)
+	if err != nil {
+		return false, err
+	}
+
+	return config != nil, err
+}
+
+func (b *azureSecretBackend) getConfig(ctx context.Context, s logical.Storage) (*azureConfig, error) {
+	entry, err := s.Get(ctx, configStoragePath)
+	if err != nil {
+		return nil, err
+	}
+
+	if entry == nil {
+		return nil, nil
+	}
+
+	config := new(azureConfig)
+	if err := entry.DecodeJSON(config); err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+func (b *azureSecretBackend) saveConfig(ctx context.Context, config *azureConfig, s logical.Storage) error {
+	entry, err := logical.StorageEntryJSON(configStoragePath, config)
+
+	if err != nil {
+		return err
+	}
+
+	err = s.Put(ctx, entry)
+	if err != nil {
+		return err
+	}
+
+	// reset the backend since the client and provider will have been
+	// built using old versions of this data
+	b.reset()
+
+	return nil
+}
+
+const confHelpSyn = `Configure the Azure Secret backend.`
+const confHelpDesc = `
+The Azure secret backend requires credentials for managing applications and
+service principals. This endpoint is used to configure those credentials as
+well as default values for the backend in general.
+`

vendor/github.com/hashicorp/vault-plugin-secrets-azure/path_roles.go

@@ -0,0 +1,288 @@
+package azuresecrets
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization"
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/vault/helper/jsonutil"
+	"github.com/hashicorp/vault/logical"
+	"github.com/hashicorp/vault/logical/framework"
+)
+
+const (
+	rolesStoragePath = "roles"
+
+	credentialTypeSP = 0
+)
+
+// Role is a Vault role construct that maps to Azure roles
+type Role struct {
+	CredentialType int           `json:"credential_type"` // Reserved. Always SP at this time.
+	AzureRoles     []*azureRole  `json:"azure_roles"`
+	TTL            time.Duration `json:"ttl"`
+	MaxTTL         time.Duration `json:"max_ttl"`
+}
+
+// azureRole is an Azure Role (https://docs.microsoft.com/en-us/azure/role-based-access-control/overview) applied
+// to a scope. RoleName and RoleID are both traits of the role. RoleID is the unique identifier, but RoleName is
+// more useful to a human (thought it is not unique).
+type azureRole struct {
+	RoleName string `json:"role_name"` // e.g. Owner
+	RoleID   string `json:"role_id"`   // e.g. /subscriptions/e0a207b2-.../providers/Microsoft.Authorization/roleDefinitions/de139f84-...
+	Scope    string `json:"scope"`     // e.g. /subscriptions/e0a207b2-...
+}
+
+func pathsRole(b *azureSecretBackend) []*framework.Path {
+	return []*framework.Path{
+		{
+			Pattern: "roles/" + framework.GenericNameRegex("name"),
+			Fields: map[string]*framework.FieldSchema{
+				"name": {
+					Type:        framework.TypeLowerCaseString,
+					Description: "Name of the role",
+				},
+				"azure_roles": {
+					Type:        framework.TypeString,
+					Description: "JSON list of Azure roles to assign",
+				},
+				"ttl": {
+					Type:        framework.TypeDurationSecond,
+					Description: "Default lease for generated credentials. If not set or set to 0, will use system default.",
+				},
+				"max_ttl": {
+					Type:        framework.TypeDurationSecond,
+					Description: "Maximum time a service principal. If not set or set to 0, will use system default.",
+				},
+			},
+			Callbacks: map[logical.Operation]framework.OperationFunc{
+				logical.ReadOperation:   b.pathRoleRead,
+				logical.CreateOperation: b.pathRoleUpdate,
+				logical.UpdateOperation: b.pathRoleUpdate,
+				logical.DeleteOperation: b.pathRoleDelete,
+			},
+			HelpSynopsis:    roleHelpSyn,
+			HelpDescription: roleHelpDesc,
+			ExistenceCheck:  b.pathRoleExistenceCheck,
+		},
+		{
+			Pattern: "roles/?",
+			Callbacks: map[logical.Operation]framework.OperationFunc{
+				logical.ListOperation: b.pathRoleList,
+			},
+			HelpSynopsis:    roleListHelpSyn,
+			HelpDescription: roleListHelpDesc,
+		},
+	}
+
+}
+
+// pathRoleUpdate creates or updates Vault roles.
+//
+// Basic validity check are made to verify that the provided fields meet requirements
+// and the Azure roles exist. The Azure role lookup step will all the operator to provide
+// a role name or ID.  ID is unambigious and will be used if provided. Given just role name,
+// a search will be performed and if exactly one match is found, that role will be used.
+func (b *azureSecretBackend) pathRoleUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	var resp *logical.Response
+
+	// load or create role
+	name := d.Get("name").(string)
+	role, err := getRole(ctx, name, req.Storage)
+	if err != nil {
+		return nil, errwrap.Wrapf("error reading role: {{err}}", err)
+	}
+
+	if role == nil {
+		if req.Operation == logical.UpdateOperation {
+			return nil, errors.New("role entry not found during update operation")
+		}
+		role = &Role{
+			CredentialType: credentialTypeSP,
+		}
+	}
+
+	// update role with any provided parameters
+	if ttlRaw, ok := d.GetOk("ttl"); ok {
+		role.TTL = time.Duration(ttlRaw.(int)) * time.Second
+	} else if req.Operation == logical.CreateOperation {
+		role.TTL = time.Duration(d.Get("ttl").(int)) * time.Second
+	}
+
+	if maxTTLRaw, ok := d.GetOk("max_ttl"); ok {
+		role.MaxTTL = time.Duration(maxTTLRaw.(int)) * time.Second
+	} else if req.Operation == logical.CreateOperation {
+		role.MaxTTL = time.Duration(d.Get("max_ttl").(int)) * time.Second
+	}
+
+	if roles, ok := d.GetOk("azure_roles"); ok {
+		parsedRoles := make([]*azureRole, 0) // non-nil to avoid a "missing roles" error later
+
+		err := jsonutil.DecodeJSON([]byte(roles.(string)), &parsedRoles)
+		if err != nil {
+			return logical.ErrorResponse("invalid Azure role definitions"), nil
+		}
+		role.AzureRoles = parsedRoles
+	}
+
+	// verify Azure roles, including looking up each role
+	// by ID or name.
+	c, err := b.getClient(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+
+	roleIDs := make(map[string]bool)
+	for _, r := range role.AzureRoles {
+		var roleDef authorization.RoleDefinition
+		if r.RoleID != "" {
+			roleDef, err = c.provider.GetRoleByID(ctx, r.RoleID)
+			if err != nil {
+				if strings.Contains(err.Error(), "RoleDefinitionDoesNotExist") {
+					return logical.ErrorResponse(fmt.Sprintf("no role found for role_id: '%s'", r.RoleID)), nil
+				}
+				return nil, errwrap.Wrapf("unable to lookup Azure role: {{err}}", err)
+			}
+		} else {
+			defs, err := c.findRoles(ctx, r.RoleName)
+			if err != nil {
+				return nil, errwrap.Wrapf("unable to lookup Azure role: {{err}}", err)
+			}
+			if l := len(defs); l == 0 {
+				return logical.ErrorResponse(fmt.Sprintf("no role found for role_name: '%s'", r.RoleName)), nil
+			} else if l > 1 {
+				return logical.ErrorResponse(fmt.Sprintf("multiple matches found for role_name: '%s'. Specify role by ID instead.", r.RoleName)), nil
+			}
+			roleDef = defs[0]
+		}
+
+		roleDefID := to.String(roleDef.ID)
+		roleDefName := to.String(roleDef.RoleName)
+		if roleIDs[roleDefID] {
+			return logical.ErrorResponse(fmt.Sprintf("duplicate role_id: '%s'", *roleDef.ID)), nil
+		}
+		roleIDs[roleDefID] = true
+
+		r.RoleName, r.RoleID = roleDefName, roleDefID
+	}
+
+	// validate role definition constraints
+	if role.MaxTTL != 0 && role.TTL > role.MaxTTL {
+		return logical.ErrorResponse("ttl cannot be greater than max_ttl"), nil
+	}
+
+	if len(role.AzureRoles) == 0 {
+		return logical.ErrorResponse("missing Azure role definitions"), nil
+	}
+
+	// save role
+	err = saveRole(ctx, req.Storage, role, name)
+	if err != nil {
+		return nil, errwrap.Wrapf("error storing role: {{err}}", err)
+	}
+
+	return resp, nil
+}
+
+func (b *azureSecretBackend) pathRoleRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	var data = make(map[string]interface{})
+
+	name := d.Get("name").(string)
+
+	r, err := getRole(ctx, name, req.Storage)
+	if err != nil {
+		return nil, errwrap.Wrapf("error reading role: {{err}}", err)
+	}
+
+	if r == nil {
+		return nil, nil
+	}
+
+	data["ttl"] = r.TTL / time.Second
+	data["max_ttl"] = r.MaxTTL / time.Second
+	data["azure_roles"] = r.AzureRoles
+
+	return &logical.Response{
+		Data: data,
+	}, nil
+}
+
+func (b *azureSecretBackend) pathRoleList(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	roles, err := req.Storage.List(ctx, rolesStoragePath+"/")
+	if err != nil {
+		return nil, errwrap.Wrapf("error listing roles: {{err}}", err)
+	}
+
+	return logical.ListResponse(roles), nil
+}
+
+func (b *azureSecretBackend) pathRoleDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	name := d.Get("name").(string)
+
+	err := req.Storage.Delete(ctx, fmt.Sprintf("%s/%s", rolesStoragePath, name))
+	if err != nil {
+		return nil, errwrap.Wrapf("error deleting role: {{err}}", err)
+	}
+
+	return nil, nil
+}
+
+func (b *azureSecretBackend) pathRoleExistenceCheck(ctx context.Context, req *logical.Request, d *framework.FieldData) (bool, error) {
+	name := d.Get("name").(string)
+
+	role, err := getRole(ctx, name, req.Storage)
+	if err != nil {
+		return false, errwrap.Wrapf("error reading role: {{err}}", err)
+	}
+
+	return role != nil, nil
+}
+
+func saveRole(ctx context.Context, s logical.Storage, c *Role, name string) error {
+	entry, err := logical.StorageEntryJSON(fmt.Sprintf("%s/%s", rolesStoragePath, name), c)
+	if err != nil {
+		return err
+	}
+
+	return s.Put(ctx, entry)
+}
+
+func getRole(ctx context.Context, name string, s logical.Storage) (*Role, error) {
+	entry, err := s.Get(ctx, fmt.Sprintf("%s/%s", rolesStoragePath, name))
+	if err != nil {
+		return nil, err
+	}
+
+	if entry == nil {
+		return nil, nil
+	}
+
+	role := new(Role)
+	if err := entry.DecodeJSON(role); err != nil {
+		return nil, err
+	}
+	return role, nil
+}
+
+const roleHelpSyn = "Manage the Vault roles used to generate Azure credentials."
+const roleHelpDesc = `
+This path allows you to read and write roles that are used to generate Azure login
+credentials. These roles are associated with Azure roles, which are in turn used to
+control permissions to Azure resources.
+
+If the backend is mounted at "azure", you would create a Vault role at "azure/roles/my_role",
+and request credentials from "azure/creds/my_role".
+
+Each Vault role is configured with the standard ttl parameters and a list of Azure
+roles and scopes. These Azure roles will be fetched during the Vault role creation
+and must exist for the request to succeed. Multiple Azure roles may be specified. When
+a used requests credentials against the Vault role, and new service principal is created
+and the configured set of Azure roles are assigned to it.
+`
+const roleListHelpSyn = `List existing roles.`
+const roleListHelpDesc = `List existing roles by name.`

vendor/github.com/hashicorp/vault-plugin-secrets-azure/path_service_principal.go

@@ -0,0 +1,166 @@
+package azuresecrets
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/Azure/go-autorest/autorest/to"
+	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/vault/logical"
+	"github.com/hashicorp/vault/logical/framework"
+)
+
+const (
+	SecretTypeSP = "service_principal"
+)
+
+func secretServicePrincipal(b *azureSecretBackend) *framework.Secret {
+	return &framework.Secret{
+		Type:   SecretTypeSP,
+		Renew:  b.spRenew,
+		Revoke: b.spRevoke,
+	}
+}
+
+func pathServicePrincipal(b *azureSecretBackend) *framework.Path {
+	return &framework.Path{
+		Pattern: fmt.Sprintf("creds/%s", framework.GenericNameRegex("role")),
+		Fields: map[string]*framework.FieldSchema{
+			"role": {
+				Type:        framework.TypeLowerCaseString,
+				Description: "Name of the Vault role",
+			},
+		},
+		Callbacks: map[logical.Operation]framework.OperationFunc{
+			logical.ReadOperation: b.pathSPRead,
+		},
+		HelpSynopsis:    pathServicePrincipalHelpSyn,
+		HelpDescription: pathServicePrincipalHelpDesc,
+	}
+}
+
+// pathSPRead generates Azure an service principal and credentials.
+//
+// This is a multistep process of:
+//   1. Create an Azure application
+//   2. Create a service principal associated with the new App
+//   3. Assign roles
+func (b *azureSecretBackend) pathSPRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	c, err := b.getClient(ctx, req.Storage)
+	if err != nil {
+		return logical.ErrorResponse(err.Error()), nil
+	}
+
+	roleName := d.Get("role").(string)
+	role, err := getRole(ctx, roleName, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+
+	if role == nil {
+		return logical.ErrorResponse(fmt.Sprintf("role '%s' does not exists", roleName)), nil
+	}
+
+	// Create the App, which is the top level object to be tracked in the secret
+	// and deleted upon revocation. If any subsequent step fails, the App is deleted.
+	app, err := c.createApp(ctx)
+	if err != nil {
+		return nil, err
+	}
+	appID := to.String(app.AppID)
+	appObjID := to.String(app.ObjectID)
+
+	// Create the SP. A far future credential expiration is set on the Azure side.
+	sp, password, err := c.createSP(ctx, app, 10*365*24*time.Hour)
+	if err != nil {
+		c.deleteApp(ctx, appObjID)
+		return nil, err
+	}
+
+	raIDs, err := c.assignRoles(ctx, sp, role.AzureRoles)
+	if err != nil {
+		c.deleteApp(ctx, appObjID)
+		return nil, err
+	}
+
+	resp := b.Secret(SecretTypeSP).Response(map[string]interface{}{
+		"client_id":     appID,
+		"client_secret": password,
+	}, map[string]interface{}{
+		"app_object_id":       appObjID,
+		"role_assignment_ids": raIDs,
+		"role":                roleName,
+	})
+
+	resp.Secret.TTL = role.TTL
+	resp.Secret.MaxTTL = role.MaxTTL
+
+	return resp, nil
+}
+
+func (b *azureSecretBackend) spRenew(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	roleRaw, ok := req.Secret.InternalData["role"]
+	if !ok {
+		return nil, errors.New("internal data not found")
+	}
+
+	role, err := getRole(ctx, roleRaw.(string), req.Storage)
+	if err != nil {
+		return nil, err
+	}
+
+	if role == nil {
+		return nil, nil
+	}
+
+	resp := &logical.Response{Secret: req.Secret}
+	resp.Secret.TTL = role.TTL
+	resp.Secret.MaxTTL = role.MaxTTL
+
+	return resp, nil
+}
+
+func (b *azureSecretBackend) spRevoke(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	resp := new(logical.Response)
+
+	appObjectIDRaw, ok := req.Secret.InternalData["app_object_id"]
+	if !ok {
+		return nil, errors.New("internal data not found")
+	}
+
+	appObjectID := appObjectIDRaw.(string)
+
+	var raIDs []string
+	if req.Secret.InternalData["role_assignment_ids"] != nil {
+		for _, v := range req.Secret.InternalData["role_assignment_ids"].([]interface{}) {
+			raIDs = append(raIDs, v.(string))
+		}
+	}
+
+	c, err := b.getClient(ctx, req.Storage)
+	if err != nil {
+		return nil, errwrap.Wrapf("error during revoke: {{err}}", err)
+	}
+
+	// unassigning roles is effectively a garbage collection operation. Errors will be noted but won't fail the
+	// revocation process. Deleting the app, however, *is* required to consider the secret revoked.
+	if err := c.unassignRoles(ctx, raIDs); err != nil {
+		resp.AddWarning(err.Error())
+	}
+
+	err = c.deleteApp(ctx, appObjectID)
+
+	return resp, err
+}
+
+const pathServicePrincipalHelpSyn = `
+Request Service Principal credentials for a given Vault role.
+`
+
+const pathServicePrincipalHelpDesc = `
+This path creates a Service Principal and assigns Azure roles for a
+given Vault role, returning the associated login credentials. The
+Service Principal will be automatically deleted when the lease has expired.
+`

vendor/github.com/hashicorp/vault-plugin-secrets-azure/provider.go

@@ -0,0 +1,190 @@
+package azuresecrets
+
+import (
+	"context"
+
+	"github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac"
+	"github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization"
+	"github.com/Azure/go-autorest/autorest"
+	"github.com/Azure/go-autorest/autorest/azure/auth"
+	"github.com/hashicorp/vault/helper/useragent"
+)
+
+// AzureProvider is an interface to access underlying Azure client objects and supporting services.
+// Where practical the original function signature is preserved. client provides higher
+// level operations atop AzureProvider.
+type AzureProvider interface {
+	ApplicationsClient
+	ServicePrincipalsClient
+	RoleAssignmentsClient
+	RoleDefinitionsClient
+}
+
+type ApplicationsClient interface {
+	CreateApplication(ctx context.Context, parameters graphrbac.ApplicationCreateParameters) (graphrbac.Application, error)
+	DeleteApplication(ctx context.Context, applicationObjectID string) (autorest.Response, error)
+}
+
+type ServicePrincipalsClient interface {
+	CreateServicePrincipal(ctx context.Context, parameters graphrbac.ServicePrincipalCreateParameters) (graphrbac.ServicePrincipal, error)
+}
+
+type RoleAssignmentsClient interface {
+	CreateRoleAssignment(
+		ctx context.Context,
+		scope string,
+		roleAssignmentName string,
+		parameters authorization.RoleAssignmentCreateParameters) (authorization.RoleAssignment, error)
+	DeleteRoleAssignmentByID(ctx context.Context, roleID string) (authorization.RoleAssignment, error)
+}
+
+type RoleDefinitionsClient interface {
+	ListRoles(ctx context.Context, scope string, filter string) ([]authorization.RoleDefinition, error)
+	GetRoleByID(ctx context.Context, roleID string) (result authorization.RoleDefinition, err error)
+}
+
+// provider is a concrete implementation of AzureProvider. In most cases it is a simple passthrough
+// to the appropriate client object. But if the response requires processing that is more practical
+// at this layer, the response signature may different from the Azure signature.
+type provider struct {
+	settings *clientSettings
+
+	appClient *graphrbac.ApplicationsClient
+	spClient  *graphrbac.ServicePrincipalsClient
+	raClient  *authorization.RoleAssignmentsClient
+	rdClient  *authorization.RoleDefinitionsClient
+}
+
+// newAzureProvider creates an azureProvider, backed by Azure client objects for underlying services.
+func newAzureProvider(settings *clientSettings) (AzureProvider, error) {
+	// build clients that use the GraphRBAC endpoint
+	authorizer, err := getAuthorizer(settings, settings.Environment.GraphEndpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	var userAgent string
+	if settings.PluginEnv != nil {
+		userAgent = useragent.PluginString(settings.PluginEnv, "azure-secrets")
+	} else {
+		userAgent = useragent.String()
+	}
+
+	appClient := graphrbac.NewApplicationsClient(settings.TenantID)
+	appClient.Authorizer = authorizer
+	appClient.AddToUserAgent(userAgent)
+
+	spClient := graphrbac.NewServicePrincipalsClient(settings.TenantID)
+	spClient.Authorizer = authorizer
+	spClient.AddToUserAgent(userAgent)
+
+	// build clients that use the Resource Manager endpoint
+	authorizer, err = getAuthorizer(settings, settings.Environment.ResourceManagerEndpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	raClient := authorization.NewRoleAssignmentsClient(settings.SubscriptionID)
+	raClient.Authorizer = authorizer
+	raClient.AddToUserAgent(userAgent)
+
+	rdClient := authorization.NewRoleDefinitionsClient(settings.SubscriptionID)
+	rdClient.Authorizer = authorizer
+	rdClient.AddToUserAgent(userAgent)
+
+	p := &provider{
+		settings: settings,
+
+		appClient: &appClient,
+		spClient:  &spClient,
+		raClient:  &raClient,
+		rdClient:  &rdClient,
+	}
+
+	return p, nil
+}
+
+// getAuthorizer attempts to create an authorizer, preferring ClientID/Secret if present,
+// and falling back to MSI if not.
+func getAuthorizer(settings *clientSettings, resource string) (authorizer autorest.Authorizer, err error) {
+
+	if settings.ClientID != "" && settings.ClientSecret != "" && settings.TenantID != "" {
+		config := auth.NewClientCredentialsConfig(settings.ClientID, settings.ClientSecret, settings.TenantID)
+		config.AADEndpoint = settings.Environment.ActiveDirectoryEndpoint
+		config.Resource = resource
+		authorizer, err = config.Authorizer()
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		config := auth.NewMSIConfig()
+		config.Resource = resource
+		authorizer, err = config.Authorizer()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return authorizer, nil
+}
+
+// CreateApplication create a new Azure application object.
+func (p *provider) CreateApplication(ctx context.Context, parameters graphrbac.ApplicationCreateParameters) (graphrbac.Application, error) {
+	return p.appClient.Create(ctx, parameters)
+}
+
+// DeleteApplication deletes an Azure application object.
+// This will in turn remove the service principal (but not the role assignments).
+func (p *provider) DeleteApplication(ctx context.Context, applicationObjectID string) (autorest.Response, error) {
+	return p.appClient.Delete(ctx, applicationObjectID)
+}
+
+// CreateServicePrincipal creates a new Azure service principal.
+// An Application must be created prior to calling this and pass in parameters.
+func (p *provider) CreateServicePrincipal(ctx context.Context, parameters graphrbac.ServicePrincipalCreateParameters) (graphrbac.ServicePrincipal, error) {
+	return p.spClient.Create(ctx, parameters)
+}
+
+// ListRoles like all Azure roles with a scope (often subscription).
+func (p *provider) ListRoles(ctx context.Context, scope string, filter string) (result []authorization.RoleDefinition, err error) {
+	page, err := p.rdClient.List(ctx, scope, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.Values(), nil
+}
+
+// GetRoleByID fetches the full role definition given a roleID.
+func (p *provider) GetRoleByID(ctx context.Context, roleID string) (result authorization.RoleDefinition, err error) {
+	return p.rdClient.GetByID(ctx, roleID)
+}
+
+// CreateRoleAssignment assigns a role to a service principal.
+func (p *provider) CreateRoleAssignment(ctx context.Context, scope string, roleAssignmentName string, parameters authorization.RoleAssignmentCreateParameters) (authorization.RoleAssignment, error) {
+	return p.raClient.Create(ctx, scope, roleAssignmentName, parameters)
+}
+
+// GetRoleAssignmentByID fetches the full role assignment info given a roleAssignmentID.
+func (p *provider) GetRoleAssignmentByID(ctx context.Context, roleAssignmentID string) (result authorization.RoleAssignment, err error) {
+	return p.raClient.GetByID(ctx, roleAssignmentID)
+}
+
+// DeleteRoleAssignmentByID deletes a role assignment.
+func (p *provider) DeleteRoleAssignmentByID(ctx context.Context, roleAssignmentID string) (result authorization.RoleAssignment, err error) {
+	return p.raClient.DeleteByID(ctx, roleAssignmentID)
+}
+
+// ListRoleAssignments lists all role assignments.
+// There is no need for paging; the caller only cares about the the first match and whether
+// there are 0, 1 or >1 items. Unpacking here is a simpler interface.
+func (p *provider) ListRoleAssignments(ctx context.Context, filter string) ([]authorization.RoleAssignment, error) {
+	page, err := p.raClient.List(ctx, filter)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.Values(), nil
+}

vendor/vendor.json

@@ -96,6 +96,18 @@
 			"revision": "fbe7db0e3f9793ba3e5704efbab84f51436c136e",
 			"revisionTime": "2018-07-03T19:15:42Z"
 		},
+		{
+			"checksumSHA1": "x9ceW8JE2/FgODRSywClj0fRlh8=",
+			"path": "github.com/Azure/azure-sdk-for-go/services/graphrbac/1.6/graphrbac",
+			"revision": "4e8cbbfb1aeab140cd0fa97fd16b64ee18c3ca6a",
+			"revisionTime": "2018-07-27T22:05:59Z"
+		},
+		{
+			"checksumSHA1": "e4hCajXDSuWNkUvwA35jMHGm20E=",
+			"path": "github.com/Azure/azure-sdk-for-go/services/preview/authorization/mgmt/2018-01-01-preview/authorization",
+			"revision": "4e8cbbfb1aeab140cd0fa97fd16b64ee18c3ca6a",
+			"revisionTime": "2018-07-27T22:05:59Z"
+		},
 		{
 			"checksumSHA1": "pbHi9xc373inHdf5me73LGIFV1w=",
 			"path": "github.com/Azure/azure-sdk-for-go/storage",
@@ -1432,6 +1444,12 @@
 			"revision": "6afcfbb25eb6f5adec1b9bba1cf8601f95e89d06",
 			"revisionTime": "2018-06-19T16:09:38Z"
 		},
+		{
+			"checksumSHA1": "26Dup/B+rgnWllUqIAqJk6pvwYI=",
+			"path": "github.com/hashicorp/vault-plugin-secrets-azure",
+			"revision": "1750091e609731c70eed455f6de11df8176b1c4a",
+			"revisionTime": "2018-08-16T17:30:18Z"
+		},
 		{
 			"checksumSHA1": "jOsVXVfsxCgGrUCnwmBMid9SM+Q=",
 			"path": "github.com/hashicorp/vault-plugin-secrets-gcp/plugin",