Azure / Azure/azure-cli

Response from "az login --identity" can display confusing message

Open
#18,491 2 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad feature-request
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62

**Describe the bug**
When a managed identity is implicitly used to authenticate, a message can be displayed saying incorrectly, that a system assigned identity is being used, when it should say user-assigned. This only happens when there is a single user-assigned identity and no system-assigned identity

**To Reproduce**

1. Create an Azure VM
2. Associate it with a single user-assigned identity, ensure that system-assigned identity is not enabled
3. Access VM using shell
4. Install Azure CLI
5. Authenticate using `az login --identity` (as the user-assigned identity is the only one available, it is used)
6. observe that response says that system-assigned identity was used, instead of user-assigned identity
```
azureuser@temp1:~$ az login --identity
[
{
"environmentName": "AzureCloud",
"homeTenantId": "",
"id": "",
"isDefault": true,
"managedByTenants": [],
"name": "Visual Studio Enterprise Subscription",
"state": "Enabled",
"tenantId": "",
"user": {
"assignedIdentityInfo": "MSI",
"name": "systemAssignedIdentity",
"type": "servicePrincipal"
}
}
]
```
7. Authenticate using `az login --identity -u /subscriptions//resourcegroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/`
8. Observe that the response correctly references the user-assigned identity
```
azureuser@temp1:~$ az login --identity -u /subscriptions//resourceGroups/Revocation/providers/Microsoft.ManagedIdentity/userAssignedIdentities/RevocationUAM
[
{
"environmentName": "AzureCloud",
"homeTenantId": "",
"id": "",
"isDefault": true,
"managedByTenants": [],
"name": "Visual Studio Enterprise Subscription",
"state": "Enabled",
"tenantId": "",
"user": {
"assignedIdentityInfo": "MSIResource-/subscriptions//resourceGroups/Revocation/providers/Microsoft.ManagedIdentity/userAssignedIdentities/RevocationUAM",
"name": "userAssignedIdentity",
"type": "servicePrincipal"
}
}
]
```
9. Result - can cause confusion for new users whether the correct identity is being used / if the VM does actually have a system-assigned identity that is being used

**Expected behavior**
When a user-assigned identity is used to authenticate, the response should correctly contain the details of the identity, even if it was not explicitly referenced in the az login command through the `-u` parameter

**Environment summary**
* VM created from `Ubuntu Server 18.04 LTS` image in portal
* Shell type: OSX terminal, connecting to VM by ssh
* CLI installed using `curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash`
* CLI version:
```
azure-cli 2.25.0

core 2.25.0
telemetry 1.0.6

Python location '/opt/az/bin/python3'
Extensions directory '/home/azureuser/.azure/cliextensions'

Python (Linux) 3.6.10 (default, Jun 11 2021, 05:19:38)
[GCC 9.3.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Please let us know how we are doing: https://aka.ms/azureclihats
and let us know if you're interested in trying out our newest features: https://aka.ms/CLIUXstu
```

**Additional context**
This only happens when there is a single user-assigned identity and no system-assigned identity. The overall behaviour is correct, it's just the message that is returned is confusing, possibly because the user-assigned identity has not been explicitly referenced in the login command.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.