Unable to append password credential to ServicePrincipal #12561
Comments
|
also referenced/first mentioned here: #7957 (comment) |
x10an14
changed the title
|
A colleague of mine who's more comfortable with Azure Portal than the Azure CLI helped me and managed to add the new password-credential via Portal (this says to me the problem most likely lies within the
|
|
Attempting to add anew with the CLI after having done so via Portal still returns the same error message; |
|
HI @jiasli could you pls have a look? |
|
add to S168 |
|
@x10an14, according to the log provided at #7957 (comment), the response from AD Graph is: This credential was created by Azure Portal with nanosecond When the JSON payload is sent back to AD Graph, it detects Azure Portal has already fixed this issue by limiting the precision to millisecond. 2 ways to solve it:
|
|
Hi! @jiasli suggestion's response
This is not an acceptable solution for us, since in this particular instance that first credential was created along with the Service Principal whose credential(s) this bug-report describes. Why that suggestion won't work for usThe reason why that is not acceptable for us, is that this credential you suggest we delete is the credential our https://dev.azure.com utilizes to modify/read our Azure Subscription's. Hence, deleting the credential breaks our Azure DevOps pipelines/forces us to re-authorize them. Next step suggestionThe idea of using the Azure CLI is so that we can automate this need - instead of using Portal - when setting up an automated process somewhere requires the permissions/access this already-created SP has. With my current understanding, this is firmly either
|
|
@x10an14, for the suggestions:
|
|
An alternative is to call MS Graph application: addPassword API with # bash
$ az rest -m "POST" -u https://graph.microsoft.com/v1.0/applications/b4e4d2ab-e2cb-45d5-a31a-98eb3f364001/addPassword --headers "Content-Type=application/json" -b '{"passwordCredential":{"displayName":"Password friendly name"}}'
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.passwordCredential",
"customKeyIdentifier": null,
"displayName": "Password friendly name",
"endDateTime": "2022-03-30T02:26:22.6376224Z",
"hint": "8si",
"keyId": "86a7cf73-ad6f-4e63-b247-b690cca70cd9",
"secretText": "8siLhjYou...",
"startDateTime": "2020-03-30T02:26:22.6376224Z"
}In PowerShell terminal, please replace This will add a new password to the application.
⚠ This API doesn't accept user-created password for security reasons. Manually set a password will trigger an error: $ az rest -m "POST" -u https://graph.microsoft.com/v1.0/applications/b4e4d2ab-e2cb-45d5-a31a-98eb3f364001/addPassword --headers "Content-Type=application/json" -b '{"passwordCredential":{"displayName":"Password friendly name", "secretText":"1ca9a08c-dbf9-4044-8422-bd9fbe05ba49"}}'
Bad Request({
"error": {
"code": "Request_BadRequest",
"message": "The password value is automatically generated and should not be specified.",
"innerError": {
"request-id": "6f6503d0-0228-44d0-ba02-f88e4e7a600b",
"date": "2020-03-30T02:22:26"
}
}
})⚠ The password can ONLY be retrieved while creating, not afterward. To retrieve it, use $ passwordText=$(az rest -m "POST" -u https://graph.microsoft.com/v1.0/applications/b4e4d2ab-e2cb-45d5-a31a-98eb3f364001/addPassword --headers "Content-Type=application/json" -b '{"passwordCredential":{"displayName":"Password friendly name"}}' --query secretText --output tsv)
$ echo $passwordText
d0Xd8B:... |
|
@jiasli; If this below claim of yours is correct, then how is it possible for us to have ended up in this situation?
We did not create this SP (and the credential the error message pertains to) in Azure Portal Next stepsPick your poison;
|
|
If the service principal is created by DevOps, you may contact the DevOps support and share this issue with them. The extra precision digit is possibly caused by .NET which uses 100-nanosecond intervals. Azure CLI relies on Azure Python SDK which is generated from the REST spec which defines Since AAD's focus has been moved to MS Graph, they are not actively maintaining AD Graph anymore. We actually did discuss with AAD team about limiting this on the service's side, but they recommended using MS Graph with Thanks for your understanding. |
|
We will track MS Graph issues at #12946 |
This is autogenerated. Please review and update as needed.
Describe the bug
Unable to append a new password credential to a Service Principal (read:
az ad appAzure Application).Command Name
az ad sp credential resetErrors:
To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.
az ad sp credential reset --append --name 1fabc626-4309-49e4-bb47-ec9e67251a4a --debug --query "password" -o tsvHopefully scrubbed-for-sensitive-details debug output
Expected Behavior
An output in the terminal which would've been equivalent to
echo "$NEW_PASSWORD".Environment Summary
Additional Context
Said SP/App has been created by Azure DevOps, as an Azure DevOps Service Connection/Endpoint's attached (and created for said Service Connection/Endpoint) ServicePrincipal.
This has worked for us multiple times previously, as late as last week.
The text was updated successfully, but these errors were encountered: