Use Read Write Consistency (RWC) Token to call Microsoft Graph API
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Symptom
As reported in [IcM 294491919](https://portal.microsofticm.com/imp/v3/incidents/details/294491919/home), even though `az ad sp create-for-rbac` has retry logic to create service principal after the application creation replication/propagation is done:
https://github.com/Azure/azure-cli/blob/f8ea47cd3330d1125b322f6c54e3da947596c1c7/src/azure-cli/azure/cli/command_modules/role/custom.py#L1451-L1469
It is still be possible that after `_RETRY_TIMES` (whose value is `36`), the replication is not complete, leading to service principal creation failure:
> The appId 'c807447b-5118-4756-a6c5-90dbdf919d22' of the service principal does not reference a valid application object.
## Possible solution
AAD has a mechanism called **Read Write Consistency (RWC) Token** to solve this:
- https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-architecture#data-consistency
- https://identitydivision.visualstudio.com/IdentityWiki/_wiki/wikis/IdentityWiki.wiki/8106/Read-Write-Consistency-(RWC)-Token
## Problems
- AAD has a very restrictive approach towards onboarding any team on RwcToken.
- Even if we use RwcToken in `az ad sp create-for-rbac`, it is difficult to apply RwcToken to separate command executions like `az ad app create` and `az ad sp create`. Azure CLI will have to save the RwcToken to a local file (because each execution is a separate Python process). How to save this token securely needs to be decided.
## Alternative solutions
Increase `_RETRY_TIMES` to higher value or use exponential backoff in order to increase the max totally retry time (currently 36*5s=180s).
Contributor guide
Assessment
This issue has not been assessed yet.