This sample demonstrates how to create and manage service identities in the Access Control Service for use with Service Bus and how to assign (and revoke) right from these service Identities so that they can send to or receive from a particular Service Bus entity or manage a particular branch of a Service Bus namespace.

The sample consists of a command-line tool and a reusable assembly that share the same code files. The command-line tool references the code files directly instead of using the assembly just to limit the number of files to be copied if the tool needs to be copied for management purposes.

SBAzTool

The tool, SBAzTool.exe, allows managing service identities and authorization rules associated with a Windows Azure Service Bus namespace.

The command structure is generally as follows:

sbaztool.exe [command] [command-arg] ... [command-arg] {option} {option}

Options are generally applicable across commands and supply information such as namespace names or access keys. The command "storeoptions" allows storing the options in the user context for subsequent command invocations. The commands "showoptions" and "clearoptions" allow showing and clearing the stored options.

The following options are defined:

-n <namespace>	<namespace> is the Service Bus namespace to operate on. Required.
-k <key>	<key> is the Access Control management key for the Access Control <namespace>-sb namespace. Required.
-q	Suppresses the logo and all output except errors.

The following commands are defined:

makeid <name> [<key>]	Creates a new service identity with <name> and a 32-byte, base64-encoded <key>. If <key> is not provided, it is generated and displayed.
showid <name>	Gets details for the service identity with <name>
deleteid <name>	Deletes the service identity with <name>
grant <op> <path> <name>	Grants operation <op> on <path> for identity <name>. See remarks below.
revoke <op> <path> <name>	Revokes permission for operation <op> on <path> for service identity <name>. See remarks below.
show <path>	Shows all permissions effective for <path>
storeoptions	Stores the options provided with the command in the user's context. Stored options are sticky across command line sessions and reboots until cleared.
showoptions	Shows the stored options
clearoptions	Clears the stored options.

The defined operations for the "grant" and "revoke" command are

Send	Sending into a queue, topic or relay endpoint.
Listen	Receiving from a queue or subscription or listening on the relay.
Manage	Creating or deleting queues, topics, or subscriptions.

Details about the associated rights can be found in the product documentation. The <path> expression is a relative path on the Service Bus namespace, e.g. /myqueue or /my/endpoint. The leading slash is optional.

Prerequisites

Example Usage