Azure / Azure/azure-cli

Use Read Write Consistency (RWC) Token to call Microsoft Graph API

Open
#21,674 1 comment 0 reactions 1 assignee Assigned to @jiasli View on GitHub
AAD act-identity-squad Auto-Assign feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

## Symptom

As reported in [IcM 294491919](https://portal.microsofticm.com/imp/v3/incidents/details/294491919/home), even though `az ad sp create-for-rbac` has retry logic to create service principal after the application creation replication/propagation is done:

https://github.com/Azure/azure-cli/blob/f8ea47cd3330d1125b322f6c54e3da947596c1c7/src/azure-cli/azure/cli/command_modules/role/custom.py#L1451-L1469

It is still be possible that after `_RETRY_TIMES` (whose value is `36`), the replication is not complete, leading to service principal creation failure:

> The appId 'c807447b-5118-4756-a6c5-90dbdf919d22' of the service principal does not reference a valid application object.

## Possible solution

AAD has a mechanism called **Read Write Consistency (RWC) Token** to solve this:

- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-architecture#data-consistency
- https://identitydivision.visualstudio.com/IdentityWiki/_wiki/wikis/IdentityWiki.wiki/8106/Read-Write-Consistency-(RWC)-Token

## Problems

- AAD has a very restrictive approach towards onboarding any team on RwcToken.
- Even if we use RwcToken in `az ad sp create-for-rbac`, it is difficult to apply RwcToken to separate command executions like `az ad app create` and `az ad sp create`. Azure CLI will have to save the RwcToken to a local file (because each execution is a separate Python process). How to save this token securely needs to be decided.

## Alternative solutions

Increase `_RETRY_TIMES` to higher value or use exponential backoff in order to increase the max totally retry time (currently 36*5s=180s).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.