Azure / Azure/Synapse-workspace-deployment

Multiple user assigned identities exist

Open
#114 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
29
Forks
50
PR merge metrics
No merged PRs in 30d

Description

Hello Team,

I'd like to describe a case that I faced with.

**The environment description:**
- GitHub Actions
- Azure Linux VM as a runtime for self-hosted GitHub runners
- VM has multiple User Assigned Managed Identities
- A workflow for Azure Synapse workspace deployment

**The workflow steps:**
1. actions/download-artifact@v4
2. azure/login@v2
3. bash command to stop Synapse Triggers
4. Azure/Synapse-workspace-deployment@V1.9.1
5. bash command to star Synapse Triggers that were previously stopped

**The error appearing in the log:**
Unable to fetch managed identity bearer token, status: 400; status message: Bad Request
{"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"}
deploy operation failed
Action failed -> Error: Failed to fetch Bearer: Failed

![Image](https://github.com/user-attachments/assets/11376ed8-be59-4686-8910-6561745aadd2)

From what I found in the code [getManagedIdentityBearer](https://github.com/Azure/Synapse-workspace-deployment/blob/V1.9.1/build_and_deploy/utils/service_principal_client_utils.ts#L57) is responsible for getting Managed Identity Bearer token and there is a [default URL](https://github.com/Azure/Synapse-workspace-deployment/blob/V1.9.1/build_and_deploy/utils/service_principal_client_utils.ts#L65) for API call to Azure with **resource** parameter.
According to [Azure documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http) the URL can user one of these three parameters **object_id**, **client_id** or **msi_res_id** to precisely identify Managed Identity for the API request.

Could you please consider an option to include at least one of the parameters into the code as a parameter for the task.

In case there are some workarounds that I might not know, please share.

Contributor guide

Open the contributing guide

Research direction

Start with build_and_deploy/utils/service_principal_client_utils.ts, especially getManagedIdentityBearer and the default token URL at the referenced lines. Review the Azure managed identity token documentation and how task parameters reach this utility. Done means the deployment task can specify an identity parameter and the token request uses it when multiple user-assigned identities are present.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, github-actions, typescript
Domain
cloud, devops
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.