Response from "az login --identity" can display confusing message
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62
**Describe the bug**
When a managed identity is implicitly used to authenticate, a message can be displayed saying incorrectly, that a system assigned identity is being used, when it should say user-assigned. This only happens when there is a single user-assigned identity and no system-assigned identity
**To Reproduce**
1. Create an Azure VM
2. Associate it with a single user-assigned identity, ensure that system-assigned identity is not enabled
3. Access VM using shell
4. Install Azure CLI
5. Authenticate using `az login --identity` (as the user-assigned identity is the only one available, it is used)
6. observe that response says that system-assigned identity was used, instead of user-assigned identity
```
azureuser@temp1:~$ az login --identity
[
{
"environmentName": "AzureCloud",
"homeTenantId": "",
"id": "",
"isDefault": true,
"managedByTenants": [],
"name": "Visual Studio Enterprise Subscription",
"state": "Enabled",
"tenantId": "",
"user": {
"assignedIdentityInfo": "MSI",
"name": "systemAssignedIdentity",
"type": "servicePrincipal"
}
}
]
```
7. Authenticate using `az login --identity -u /subscriptions//resourcegroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/`
8. Observe that the response correctly references the user-assigned identity
```
azureuser@temp1:~$ az login --identity -u /subscriptions//resourceGroups/Revocation/providers/Microsoft.ManagedIdentity/userAssignedIdentities/RevocationUAM
[
{
"environmentName": "AzureCloud",
"homeTenantId": "",
"id": "",
"isDefault": true,
"managedByTenants": [],
"name": "Visual Studio Enterprise Subscription",
"state": "Enabled",
"tenantId": "",
"user": {
"assignedIdentityInfo": "MSIResource-/subscriptions//resourceGroups/Revocation/providers/Microsoft.ManagedIdentity/userAssignedIdentities/RevocationUAM",
"name": "userAssignedIdentity",
"type": "servicePrincipal"
}
}
]
```
9. Result - can cause confusion for new users whether the correct identity is being used / if the VM does actually have a system-assigned identity that is being used
**Expected behavior**
When a user-assigned identity is used to authenticate, the response should correctly contain the details of the identity, even if it was not explicitly referenced in the az login command through the `-u` parameter
**Environment summary**
* VM created from `Ubuntu Server 18.04 LTS` image in portal
* Shell type: OSX terminal, connecting to VM by ssh
* CLI installed using `curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash`
* CLI version:
```
azure-cli 2.25.0
core 2.25.0
telemetry 1.0.6
Python location '/opt/az/bin/python3'
Extensions directory '/home/azureuser/.azure/cliextensions'
Python (Linux) 3.6.10 (default, Jun 11 2021, 05:19:38)
[GCC 9.3.0]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
Please let us know how we are doing: https://aka.ms/azureclihats
and let us know if you're interested in trying out our newest features: https://aka.ms/CLIUXstu
```
**Additional context**
This only happens when there is a single user-assigned identity and no system-assigned identity. The overall behaviour is correct, it's just the message that is returned is confusing, possibly because the user-assigned identity has not been explicitly referenced in the login command.
Contributor guide
Assessment
This issue has not been assessed yet.