Federated Credentials for GitHub fails with CLi 2.42
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62
**Related command**
```sh
export CREDENTIAL_NAME="gha_aca_run"
export GH_USER_NAME="yourGitHubAccount"
export SUBJECT="repo:$GH_USER_NAME/aca-java-petclinic-mic-srv:ref:refs/heads/main" # "repo:organization/repository:environment:Production"
export DESCRIPTION="GitHub Action Runner for Petclinic ACA demo"
echo $SPN_OBJECT_ID # to check its value
az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/$SPN_OBJECT_ID/federatedIdentityCredentials' --body '{"name":"$CREDENTIAL_NAME","issuer":"https://token.actions.githubusercontent.com","subject":"$SUBJECT","description":"$DESCRIPTION","audiences":["api://AzureADTokenExchange"]}'
```
```console
Bad Request({"error":{"code":"BadRequest","message":"The request URI is not valid. Since the segment 'applications' refers to a collection, this must be the last segment in the req
uest URI or it must be followed by an function or action that can be bound to it otherwise all intermediate segments must refer to a single resource.","innerError":{"date":"2023-01
-30T17:36:25","request-id":"13ced77d-517c-4416-81ab-d90a59f816ea","client-request-id":"13ced77d-517c-4416-81ab-d90a59f816ea"}}})
```
**Describe the bug**
**To Reproduce**
```sh
export CREDENTIAL_NAME="gha_aca_run"
export GH_USER_NAME="yourGitHubAccount"
export SUBJECT="repo:$GH_USER_NAME/aca-java-petclinic-mic-srv:ref:refs/heads/main" # "repo:organization/repository:environment:Production"
export DESCRIPTION="GitHub Action Runner for Petclinic ACA demo"
az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/$SPN_OBJECT_ID/federatedIdentityCredentials' --body '{"name":"$CREDENTIAL_NAME","issuer":"https://token.actions.githubusercontent.com","subject":"$SUBJECT","description":"$DESCRIPTION","audiences":["api://AzureADTokenExchange"]}'
```
**Expected behavior**
Based on the [docs](https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure?tabs=azure-cli%2Cwindows#use-the-azure-login-action-with-openid-connect) CLI should work
**Environment summary**
From VS Code / WSL :
```sh
az version
{
"azure-cli": "2.42.0",
"azure-cli-core": "2.42.0",
"azure-cli-telemetry": "1.0.8",
"extensions": {}
}
```
**Additional context**
I could sucessfully create Federated Credentials from the Portal using the same values.
Note: I use an MS FTE Tenant (named AppInnoLabs) with external subscription
Contributor guide
Assessment
This issue has not been assessed yet.