Azure / Azure/Synapse-workspace-deployment
Multiple user assigned identities exist
- Dominant language
- TypeScript
- Stars
- 29
- Forks
- 50
- PR merge metrics
- No merged PRs in 30d
Description
Hello Team,
I'd like to describe a case that I faced with.
**The environment description:**
- GitHub Actions
- Azure Linux VM as a runtime for self-hosted GitHub runners
- VM has multiple User Assigned Managed Identities
- A workflow for Azure Synapse workspace deployment
**The workflow steps:**
1. actions/download-artifact@v4
2. azure/login@v2
3. bash command to stop Synapse Triggers
4. Azure/Synapse-workspace-deployment@V1.9.1
5. bash command to star Synapse Triggers that were previously stopped
**The error appearing in the log:**
Unable to fetch managed identity bearer token, status: 400; status message: Bad Request
{"error":"invalid_request","error_description":"Multiple user assigned identities exist, please specify the clientId / resourceId of the identity in the token request"}
deploy operation failed
Action failed -> Error: Failed to fetch Bearer: Failed

From what I found in the code [getManagedIdentityBearer](https://github.com/Azure/Synapse-workspace-deployment/blob/V1.9.1/build_and_deploy/utils/service_principal_client_utils.ts#L57) is responsible for getting Managed Identity Bearer token and there is a [default URL](https://github.com/Azure/Synapse-workspace-deployment/blob/V1.9.1/build_and_deploy/utils/service_principal_client_utils.ts#L65) for API call to Azure with **resource** parameter.
According to [Azure documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http) the URL can user one of these three parameters **object_id**, **client_id** or **msi_res_id** to precisely identify Managed Identity for the API request.
Could you please consider an option to include at least one of the parameters into the code as a parameter for the task.
In case there are some workarounds that I might not know, please share.
Contributor guide
Research direction
Start with build_and_deploy/utils/service_principal_client_utils.ts, especially getManagedIdentityBearer and the default token URL at the referenced lines. Review the Azure managed identity token documentation and how task parameters reach this utility. Done means the deployment task can specify an identity parameter and the token request uses it when multiple user-assigned identities are present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, github-actions, typescript
- Domain
- cloud, devops
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100