Azure / Azure/azure-cli

Federated Credentials for GitHub fails with CLi 2.42

Open
#25,291 6 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad Auto-Assign Graph question Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62

**Related command**
```sh
export CREDENTIAL_NAME="gha_aca_run"
export GH_USER_NAME="yourGitHubAccount"
export SUBJECT="repo:$GH_USER_NAME/aca-java-petclinic-mic-srv:ref:refs/heads/main" # "repo:organization/repository:environment:Production"
export DESCRIPTION="GitHub Action Runner for Petclinic ACA demo"

echo $SPN_OBJECT_ID # to check its value

az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/$SPN_OBJECT_ID/federatedIdentityCredentials' --body '{"name":"$CREDENTIAL_NAME","issuer":"https://token.actions.githubusercontent.com","subject":"$SUBJECT","description":"$DESCRIPTION","audiences":["api://AzureADTokenExchange"]}'

```

```console
Bad Request({"error":{"code":"BadRequest","message":"The request URI is not valid. Since the segment 'applications' refers to a collection, this must be the last segment in the req
uest URI or it must be followed by an function or action that can be bound to it otherwise all intermediate segments must refer to a single resource.","innerError":{"date":"2023-01
-30T17:36:25","request-id":"13ced77d-517c-4416-81ab-d90a59f816ea","client-request-id":"13ced77d-517c-4416-81ab-d90a59f816ea"}}})
```

**Describe the bug**

**To Reproduce**
```sh
export CREDENTIAL_NAME="gha_aca_run"
export GH_USER_NAME="yourGitHubAccount"
export SUBJECT="repo:$GH_USER_NAME/aca-java-petclinic-mic-srv:ref:refs/heads/main" # "repo:organization/repository:environment:Production"
export DESCRIPTION="GitHub Action Runner for Petclinic ACA demo"

az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/$SPN_OBJECT_ID/federatedIdentityCredentials' --body '{"name":"$CREDENTIAL_NAME","issuer":"https://token.actions.githubusercontent.com","subject":"$SUBJECT","description":"$DESCRIPTION","audiences":["api://AzureADTokenExchange"]}'

```

**Expected behavior**
Based on the [docs](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Cwindows#use-the-azure-login-action-with-openid-connect) CLI should work

**Environment summary**
From VS Code / WSL :

```sh
az version
{
"azure-cli": "2.42.0",
"azure-cli-core": "2.42.0",
"azure-cli-telemetry": "1.0.8",
"extensions": {}
}
```

**Additional context**

I could sucessfully create Federated Credentials from the Portal using the same values.
Note: I use an MS FTE Tenant (named AppInnoLabs) with external subscription

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.