Azure / Azure/azure-cli

Re-running create-for-rbac Overwrites Existing 'rbac' Credential

Open
#20,175 1 comment 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad customer-reported feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

Using `az ad sp create-for-rbac` and generating a password credential enters a credential with the `description` or `customKeyIdentifer` value `rbac`. When re-running this and an existing application is patched by adding a new credential, the patch process sees the same `customKeyIdentifer` value and overwrites the existing credential password.

Either this needs to be called out in the documentation (currently the documentation doesn't state it will patch/update an existing application or fail out) or the default behavior should be changed. Possibly changing the description value to `rbac-YYYY-MM-DD` or something similar would be appropriate. The description could also be a CLI parameter.

Description is set here:
https://github.com/Azure/azure-cli/blob/3c3407952bf427c8f3381e4ab27e148bf8b29eb6/src/azure-cli/azure/cli/command_modules/role/custom.py#L1438-L1445

The `customKeyIdentifer` is encoded here:
https://github.com/Azure/azure-cli/blob/3c3407952bf427c8f3381e4ab27e148bf8b29eb6/src/azure-cli/azure/cli/command_modules/role/custom.py#L1204-L1205

Documentation here:
latest/docs-ref-autogen/ad/sp.yml](https://github.com/MicrosoftDocs/azure-docs-cli/blob/master/latest/docs-ref-autogen/ad/sp.yml

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.