RBAC: role assignment creation

[yugangw-msft]

Notes:

1. The main focus is on the role assignment creation. The PR also contains graph object query command and user create so that i can test end to end
2. The new command greatly simplifies the interface, with no function loss, this PR shrinks parameters number from 10 down to 4
   xplat's

 role assignment create [objectId] [signInName] [spn] [roleName] [roleId] [scope] [resource-group] [resource-type] [resource-name]

cli's

  role assignment create <assignee> <role> [resource_group] [resource_id]
  Arguments
    --assignee [Required]: Represent a user, group, or service principal. supported format: object
                           id, user sign-in name, or service principal name.
    --role     [Required]: Role name or id.
    --resource-group -g  : Name of resource group.
    --resource-id        : Resource id.

[yugangw-msft]

/CC:@BurtBiel @derekbekoe @JasonRShaver

[BurtBiel]

mail_nick_name [](start = 61, length = 14)

minor naming: should be mail_nickname

[BurtBiel]

[derekbekoe]

More than one roles match the given name [](start = 19, length = 40)

Think this should be "More than one role matches the given name" for grammar

[derekbekoe]

"More than one roles match the given name '{}'. Please pick a value from '{}'" [](start = 18, length = 78)

If I fall into this case, how would I resolve it with the error message that's provided?
Do I have to provide resource-id, set a different role, etc.?

If it would be clear for the context of the user of this command the action they need to take, it's fine. I was asking for clarification as I'm not sure the error message is the clearest.

[yugangw-msft]

Role name conflicts should be very rare. If it happens, you use az role list to see the role details, pick the one, and still use --role parameter but use the role id for value, which should be a unique guid

[derekbekoe]

🕐

[johanste]

The preferred place to put argument validation is either in a validator (for validation that needs all parsed argument values) or in a type parameter (for individual argument values). This way, you get a consistent error message and usage statement instead of a single line of error text.

[yugangw-msft]

This is the only place we need to sniff the role-id at this moment, once i have more than 1, i will maintain the consistency by sharing the code, and i will consider validators.

[derekbekoe]