feat: collect Microsoft Entra Domain Services resources - BED-9245

[martinsohn]

Description

Adds Microsoft Entra Domain Services resource collection to az-rm, including accessible Microsoft.AAD/domainServices resources and their direct resource-scope role assignments.

Changes include:

• Add AZEntraDS and AZEntraDSRoleAssignment output kinds and models.
• Enumerate Entra DS resources and direct resource-scope role assignments.
• Collect tenant, domain, synchronization, security, replica, and Secure LDAP configuration.
• Normalize resource and identity identifiers for BloodHound ingest.
• Add unit coverage for enumeration, marshaling, output kinds, and role assignments.

Motivation and Context

BloodHound requires Azure resource, configuration, and authorization data to anchor the Entra DS graph and model hybrid paths across Azure Resource Manager, Microsoft Entra ID, and the managed Active Directory domain.

This PR is part of: BED-9245

How Has This Been Tested?

• go test ./...
• Build AzureHound from this PR head.
• Run az-rm against the lab tenant and confirm the expected records.

Screenshots (if appropriate):

N/A

Types of changes

• Chore
• Bug fix
• New feature
• Breaking change

Summary by CodeRabbit

• New Features

  • Added support for listing Microsoft Entra Domain Services across Azure subscriptions.
  • Added a command to enumerate Domain Services and their role assignments.
  • Included Domain Service details, subscription metadata, resource groups, and role assignment information in output.
  • Added resource types for Domain Services and Domain Service role assignments.

• Bug Fixes

  • Sensitive LDAPS certificate data is excluded from serialized output.

• Tests

  • Added coverage for Domain Service listing, role assignments, metadata, and serialization.

[coderabbitai]

Walkthrough

The change adds Azure Domain Services models, Resource Manager retrieval, CLI commands, role-assignment collection, Azure RM pipeline integration, and related tests.

Changes

Azure Domain Services

Layer / File(s)	Summary
Domain Service models enums/kind.go, models/azure/domain_service.go, models/domain-service.go, models/domain-service_test.go	Adds Azure Domain Services models, resource-group helpers, output metadata, identifier normalization, and JSON serialization tests.
Resource Manager retrieval client/client.go, client/domain_services.go, client/mocks/client.go	Adds the client method, asynchronous Resource Manager retrieval, and GoMock support.
Domain Services listing command cmd/list-domain-services.go, cmd/list-domain-services_test.go	Adds concurrent subscription enumeration, domain-service wrapping, output streaming, and command tests.
Azure RM pipeline integration cmd/list-azure-rm.go	Adds Domain Services and role-assignment streams to subscription fan-out and final output multiplexing.
Domain Service role assignments cmd/list-domain-service-role-assignments.go, cmd/list-domain-service-role-assignments_test.go	Adds concurrent role-assignment retrieval, direct-scope filtering, output handling, and tests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DomainServicesCommand
  participant SubscriptionStream
  participant AzureResourceManagerClient
  participant DomainServiceStream
  participant OutputStream
  DomainServicesCommand->>SubscriptionStream: enumerate subscription IDs
  SubscriptionStream->>AzureResourceManagerClient: ListAzureDomainServices(subscription ID)
  AzureResourceManagerClient-->>DomainServiceStream: stream domain-service results
  DomainServiceStream-->>OutputStream: emit DomainService records

Loading

Possibly related PRs

• SpecterOps/AzureHound#180: Adds similar CLI channel-output tests for role-assignment filtering.

Suggested reviewers: ktstrader

Poem

A rabbit hops through Azure streams,
And gathers services from cloudlit dreams.
Roles are filtered, IDs align,
Channels close in orderly time.
New domain paths now safely bloom.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: collecting Microsoft Entra Domain Services resources.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch microsoft-entra-domain-services

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@models/azure/domain_service.go`:
- Around line 40-49: Add a []DomainServiceReplicaSet field named ReplicaSets to
DomainServiceProperties with the appropriate JSON tag replicaSets, so
ListAzureDomainServices preserves API-returned replica set entries including
location and subnetId during unmarshalling.

In `@models/domain-service_test.go`:
- Around line 34-40: The domain service test fixture currently exercises only
untyped extra fields, so it does not validate typed LDAPS serialization. Update
the typed model setup used by the domain-service test to populate pfxCertificate
and pfxCertificatePassword through DomainServiceLDAPSSettings or the dedicated
API DTO, then assert that MarshalJSON omits both fields while preserving the
existing ldaps and externalAccess serialization.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 93784177-286b-4056-92b4-1c8bb9e77b1a

📥 Commits

Reviewing files that changed from the base of the PR and between 23735c8 and be9117f.

📒 Files selected for processing (12)

• client/client.go
• client/domain_services.go
• client/mocks/client.go
• cmd/list-azure-rm.go
• cmd/list-domain-service-role-assignments.go
• cmd/list-domain-service-role-assignments_test.go
• cmd/list-domain-services.go
• cmd/list-domain-services_test.go
• enums/kind.go
• models/azure/domain_service.go
• models/domain-service.go
• models/domain-service_test.go