User input for "microsoftGraphResourceId" leads to unexpected behavior

Open

#26,405 opened on May 11, 2023 1 comment 0 reactions 1 assignee Assigned to @jiasli View on GitHub

act-identity-squad Auto-Assign Azure CLI Team Graph potential-pruning question

Dominant language: Python
Stars: 4.6k
Forks: 3.5k
Avg merge: 3d 2h
Merged PRs (30d): 60

Description

### **This is autogenerated. Please review and update as needed.**

## Describe the bug
The endpoint `microsoftGraphResourceId` can be set by the user to anything. If it is set to empty string or if the user never set it, then the code flow enters the following:
https://github.com/Azure/azure-cli/blob/7ef8f9e702b107b343a53065b178c7193244fbb4/src/azure-cli-core/azure/cli/core/util.py#L945
The above sets the URL to the `resource_manager` endpoint, which obviously is not the Microsoft graph endpoint. This results in a misleading `The api-version query parameter (?api-version=) is required for all requests.` error. If the user input `microsoftGraphResourceId` has a typo, it will also throw the same error as it tries to access a URL that is incorrect.

To my understanding, the Microsoft graph endpoint should always be one URL, which is currently `https://graph.microsoft.com`, so I am also wondering why it needs to be set by the user in the first place.

**Command Name**
`az keyvault create`

**Errors:**
```
PS C:\Users\Administrator.N26R2105-DVM> az keyvault create --name $keyvaultName --resource-group $WlkUtilitiesRG --location $ResourceLocation --sku standard --enabled-for-deployment true --enabled-for-template-deployment true --debug
cli.knack.cli: Command arguments: ['keyvault', 'create', '--name', 'clicanurgkv', '--resource-group', 'clicanurg', '--location', 'redmond', '--sku', 'standard', '--enabled-for-deployment', 'true', '--enabled-for-template-deployment', 'true', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
Enable VT mode.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [, , ]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'keyvault': ['azure.cli.command_modules.keyvault']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: keyvault 0.012 11 69
cli.azure.cli.core: Total (1) 0.012 11 69
cli.azure.cli.core: Loaded 11 groups, 69 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : keyvault create
cli.azure.cli.core: Command table: keyvault create
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate []
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\Administrator.N26R2105-DVM\.azure\commands\2023-05-11.01-57-56.keyvault_create.1336.log'.
az_command_data_logger: command args: keyvault create --name {} --resource-group {} --location {} --sku {} --enabled-for-deployment {} --enabled-for-template-deployment {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [.add_subscription_parameter at 0x04101730>]
cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/profiles/_shared.py", line 637, in _get_attr
File "importlib\__init__.py", line 126, in import_module
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 1004, in _find_and_load_unlocked
ModuleNotFoundError: No module named 'azure.mgmt.keyvault.v2016_10_01.azure'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/profiles/_shared.py", line 637, in _get_attr
File "importlib\__init__.py", line 126, in import_module
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 992, in _find_and_load_unlocked
File "", line 241, in _call_with_frames_removed
File "", line 1050, in _gcd_import
File "", line 1027, in _find_and_load
File "", line 1004, in _find_and_load_unlocked
ModuleNotFoundError: No module named 'azure.mgmt.keyvault.v2016_10_01.azure'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/profiles/_shared.py", line 641, in _get_attr
AttributeError: module 'azure.keyvault.v2016_10_01.models' has no attribute 'SasTokenType'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/profiles/_shared.py", line 641, in _get_attr
AttributeError: module 'azure.mgmt.keyvault.v2016_10_01.models' has no attribute 'NetworkRuleBypassOptions'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/profiles/_shared.py", line 641, in _get_attr
AttributeError: module 'azure.mgmt.keyvault.v2016_10_01.models' has no attribute 'NetworkRuleAction'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/profiles/_shared.py", line 641, in _get_attr
AttributeError: module 'azure.mgmt.keyvault.v2016_10_01.models' has no attribute 'PublicNetworkAccess'

cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [.add_ids_arguments at 0x04111850>, .add_cache_arguments at 0x041118E0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [, , .parse_ids_arguments at 0x04111898>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=KeyVaultManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\\Users\\Administrator.N26R2105-DVM\\.azure\\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\Administrator.N26R2105-DVM\.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: openid_config = {'issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/authorize/', 'token_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/token/', 'jwks_uri': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/discovery/keys', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'client_secret_basic', 'private_key_jwt', 'windows_client_authentication'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token', 'code token', 'code id_token token'], 'response_modes_supported': ['query', 'fragment', 'form_post'], 'grant_types_supported': ['authorization_code', 'refresh_token', 'client_credentials', 'urn:ietf:params:oauth:grant-type:jwt-bearer', 'implicit', 'password', 'srv_challenge', 'urn:ietf:params:oauth:grant-type:device_code', 'device_code'], 'subject_types_supported': ['pairwise'], 'scopes_supported': ['profile', 'logon_cert', '.default', 'allatclaims', 'email', 'winhello_cert', 'aza', 'openid', 'vpn_cert', 'user_impersonation'], 'id_token_signing_alg_values_supported': ['RS256'], 'token_endpoint_auth_signing_alg_values_supported': ['RS256'], 'access_token_issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'claims_supported': ['aud', 'iss', 'iat', 'exp', 'auth_time', 'nonce', 'at_hash', 'c_hash', 'sub', 'upn', 'unique_name', 'pwd_url', 'pwd_exp', 'mfa_auth_time', 'sid', 'nbf'], 'microsoft_multi_refresh_token': True, 'userinfo_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/userinfo', 'capabilities': ['kdf_ver2'], 'end_session_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/logout', 'as_access_token_token_binding_supported': False, 'as_refresh_token_token_binding_supported': False, 'resource_access_token_token_binding_supported': False, 'op_id_token_token_binding_supported': False, 'rp_id_token_token_binding_supported': False, 'frontchannel_logout_supported': True, 'frontchannel_logout_session_supported': True, 'device_authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/devicecode'}
msal.application: Broker enabled? False
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default',), kwargs={}
cli.azure.cli.core.auth.msal_authentication: UserCredential.get_token: scopes=('https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default',), claims=None, kwargs={}
msal.application: Found 1 RTs matching {'environment': 'adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com', 'home_account_id': 'kgLL9vgbqbYobKrCU5jKhcASc6k1BI4lbVd1Eg1GIVk=', 'client_id': '04b07795-8ddb-461a-bbee-02f9e1bf7b46'}
msal.telemetry: Generate or reuse correlation_id: 4afc9b06-ce56-4c0c-bce1-73ea8830d7d3
msal.application: Cache attempts an RT
urllib3.connectionpool: Starting new HTTPS connection (1): adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443
urllib3.connectionpool: https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443 "POST /adfs/oauth2/token/ HTTP/1.1" 200 4616
msal.token_cache: event={
"client_id": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"data": {
"claims": "{\"access_token\": {\"xms_cc\": {\"values\": [\"CP1\"]}}}",
"refresh_token": "********",
"scope": [
"openid",
"profile",
"offline_access",
"https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default"
]
},
"environment": "adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com",
"grant_type": "refresh_token",
"params": null,
"response": {
"access_token": "********",
"expires_in": 3600,
"id_token": "********",
"scope": "profile openid https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default",
"token_type": "bearer"
},
"scope": [
"profile",
"openid",
"https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default"
],
"skip_account_creation": true,
"token_endpoint": "https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/token/"
}
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com/subscriptions/ebfd4179-5c7e-464e-933f-d53b817253cc/resourceGroups/clicanurg/providers/Microsoft.KeyVault/vaults/clicanurgkv?api-version=2016-10-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '3fccf8fd-ef9f-11ed-9f07-00155d50fe42'
cli.azure.cli.core.sdk.policies: 'CommandName': 'keyvault create'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --resource-group --location --sku --enabled-for-deployment --enabled-for-template-deployment --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.48.1 (MSI) azsdk-python-azure-mgmt-keyvault/10.2.0 Python/3.10.10 (Windows-10-10.0.20348-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443
urllib3.connectionpool: https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443 "GET /subscriptions/ebfd4179-5c7e-464e-933f-d53b817253cc/resourceGroups/clicanurg/providers/Microsoft.KeyVault/vaults/clicanurgkv?api-version=2016-10-01 HTTP/1.1" 404 218
cli.azure.cli.core.sdk.policies: Response status: 404
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-failure-cause': 'gateway'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '7a12d33b-1bf7-4b6d-9362-191cd4ce5970'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '7a12d33b-1bf7-4b6d-9362-191cd4ce5970'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'REDMOND:20230511T015757Z:7a12d33b-1bf7-4b6d-9362-191cd4ce5970'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 11 May 2023 01:57:57 GMT'
cli.azure.cli.core.sdk.policies: 'Content-Length': '218'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"error":{"code":"ResourceNotFound","message":"The Resource 'Microsoft.KeyVault/vaults/clicanurgkv' under resource group 'clicanurg' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"}}
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: openid_config = {'issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/authorize/', 'token_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/token/', 'jwks_uri': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/discovery/keys', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'client_secret_basic', 'private_key_jwt', 'windows_client_authentication'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token', 'code token', 'code id_token token'], 'response_modes_supported': ['query', 'fragment', 'form_post'], 'grant_types_supported': ['authorization_code', 'refresh_token', 'client_credentials', 'urn:ietf:params:oauth:grant-type:jwt-bearer', 'implicit', 'password', 'srv_challenge', 'urn:ietf:params:oauth:grant-type:device_code', 'device_code'], 'subject_types_supported': ['pairwise'], 'scopes_supported': ['profile', 'logon_cert', '.default', 'allatclaims', 'email', 'winhello_cert', 'aza', 'openid', 'vpn_cert', 'user_impersonation'], 'id_token_signing_alg_values_supported': ['RS256'], 'token_endpoint_auth_signing_alg_values_supported': ['RS256'], 'access_token_issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'claims_supported': ['aud', 'iss', 'iat', 'exp', 'auth_time', 'nonce', 'at_hash', 'c_hash', 'sub', 'upn', 'unique_name', 'pwd_url', 'pwd_exp', 'mfa_auth_time', 'sid', 'nbf'], 'microsoft_multi_refresh_token': True, 'userinfo_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/userinfo', 'capabilities': ['kdf_ver2'], 'end_session_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/logout', 'as_access_token_token_binding_supported': False, 'as_refresh_token_token_binding_supported': False, 'resource_access_token_token_binding_supported': False, 'op_id_token_token_binding_supported': False, 'rp_id_token_token_binding_supported': False, 'frontchannel_logout_supported': True, 'frontchannel_logout_session_supported': True, 'device_authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/devicecode'}
msal.application: Broker enabled? False
cli.azure.cli.core.util: No subscription ID specified in the URL https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com/v1.0/me
cli.azure.cli.core.util: Retrieving token for resource https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: openid_config = {'issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/authorize/', 'token_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/token/', 'jwks_uri': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/discovery/keys', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'client_secret_basic', 'private_key_jwt', 'windows_client_authentication'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token', 'code token', 'code id_token token'], 'response_modes_supported': ['query', 'fragment', 'form_post'], 'grant_types_supported': ['authorization_code', 'refresh_token', 'client_credentials', 'urn:ietf:params:oauth:grant-type:jwt-bearer', 'implicit', 'password', 'srv_challenge', 'urn:ietf:params:oauth:grant-type:device_code', 'device_code'], 'subject_types_supported': ['pairwise'], 'scopes_supported': ['profile', 'logon_cert', '.default', 'allatclaims', 'email', 'winhello_cert', 'aza', 'openid', 'vpn_cert', 'user_impersonation'], 'id_token_signing_alg_values_supported': ['RS256'], 'token_endpoint_auth_signing_alg_values_supported': ['RS256'], 'access_token_issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'claims_supported': ['aud', 'iss', 'iat', 'exp', 'auth_time', 'nonce', 'at_hash', 'c_hash', 'sub', 'upn', 'unique_name', 'pwd_url', 'pwd_exp', 'mfa_auth_time', 'sid', 'nbf'], 'microsoft_multi_refresh_token': True, 'userinfo_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/userinfo', 'capabilities': ['kdf_ver2'], 'end_session_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/logout', 'as_access_token_token_binding_supported': False, 'as_refresh_token_token_binding_supported': False, 'resource_access_token_token_binding_supported': False, 'op_id_token_token_binding_supported': False, 'rp_id_token_token_binding_supported': False, 'frontchannel_logout_supported': True, 'frontchannel_logout_session_supported': True, 'device_authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/devicecode'}
msal.application: Broker enabled? False
cli.azure.cli.core.auth.msal_authentication: UserCredential.get_token: scopes=('https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default',), claims=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 2b79e4fa-e5a6-4d13-a9ed-7c01d2686f9d
cli.azure.cli.core.util: Request URL: 'https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com/v1.0/me'
cli.azure.cli.core.util: Request method: 'GET'
cli.azure.cli.core.util: Request headers:
cli.azure.cli.core.util: 'User-Agent': 'python/3.10.10 (Windows-10-10.0.20348-SP0) AZURECLI/2.48.1 (MSI)'
cli.azure.cli.core.util: 'Accept-Encoding': 'gzip, deflate'
cli.azure.cli.core.util: 'Accept': '*/*'
cli.azure.cli.core.util: 'Connection': 'keep-alive'
cli.azure.cli.core.util: 'x-ms-client-request-id': '00df908e-ec6a-41eb-a55b-e94b7baa4187'
cli.azure.cli.core.util: 'CommandName': 'keyvault create'
cli.azure.cli.core.util: 'ParameterSetName': '--name --resource-group --location --sku --enabled-for-deployment --enabled-for-template-deployment --debug'
cli.azure.cli.core.util: 'Authorization': 'Bearer eyJ0eXAiOiJKV...'
cli.azure.cli.core.util: Request body:
cli.azure.cli.core.util: None
urllib3.connectionpool: Starting new HTTPS connection (1): management.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443
urllib3.connectionpool: https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443 "GET /v1.0/me HTTP/1.1" 400 137
cli.azure.cli.core.util: Response status: 400
cli.azure.cli.core.util: Response headers:
cli.azure.cli.core.util: 'Cache-Control': 'no-cache'
cli.azure.cli.core.util: 'Pragma': 'no-cache'
cli.azure.cli.core.util: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.util: 'Expires': '-1'
cli.azure.cli.core.util: 'x-ms-failure-cause': 'gateway'
cli.azure.cli.core.util: 'x-ms-request-id': 'b28b4bcd-140d-4901-a650-4605e43d40d6'
cli.azure.cli.core.util: 'x-ms-correlation-request-id': 'b28b4bcd-140d-4901-a650-4605e43d40d6'
cli.azure.cli.core.util: 'x-ms-routing-request-id': 'REDMOND:20230511T015757Z:b28b4bcd-140d-4901-a650-4605e43d40d6'
cli.azure.cli.core.util: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.util: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.util: 'Date': 'Thu, 11 May 2023 01:57:57 GMT'
cli.azure.cli.core.util: 'Content-Length': '137'
cli.azure.cli.core.util: Response content:
cli.azure.cli.core.util: {"error":{"code":"MissingApiVersionParameter","message":"The api-version query parameter (?api-version=) is required for all requests."}}
cli.azure.cli.core.util: No subscription ID specified in the URL https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com/v1.0/users?$filter=userPrincipalName%20eq%20%27CloudAdmin%40n26r2105.masd.stbtest.microsoft.com%27
cli.azure.cli.core.util: Retrieving token for resource https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: openid_config = {'issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/authorize/', 'token_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/token/', 'jwks_uri': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/discovery/keys', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'client_secret_basic', 'private_key_jwt', 'windows_client_authentication'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token', 'code token', 'code id_token token'], 'response_modes_supported': ['query', 'fragment', 'form_post'], 'grant_types_supported': ['authorization_code', 'refresh_token', 'client_credentials', 'urn:ietf:params:oauth:grant-type:jwt-bearer', 'implicit', 'password', 'srv_challenge', 'urn:ietf:params:oauth:grant-type:device_code', 'device_code'], 'subject_types_supported': ['pairwise'], 'scopes_supported': ['profile', 'logon_cert', '.default', 'allatclaims', 'email', 'winhello_cert', 'aza', 'openid', 'vpn_cert', 'user_impersonation'], 'id_token_signing_alg_values_supported': ['RS256'], 'token_endpoint_auth_signing_alg_values_supported': ['RS256'], 'access_token_issuer': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/dafbca93-71b6-4072-8135-1e81d4f3b6a1/', 'claims_supported': ['aud', 'iss', 'iat', 'exp', 'auth_time', 'nonce', 'at_hash', 'c_hash', 'sub', 'upn', 'unique_name', 'pwd_url', 'pwd_exp', 'mfa_auth_time', 'sid', 'nbf'], 'microsoft_multi_refresh_token': True, 'userinfo_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/userinfo', 'capabilities': ['kdf_ver2'], 'end_session_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/logout', 'as_access_token_token_binding_supported': False, 'as_refresh_token_token_binding_supported': False, 'resource_access_token_token_binding_supported': False, 'op_id_token_token_binding_supported': False, 'rp_id_token_token_binding_supported': False, 'frontchannel_logout_supported': True, 'frontchannel_logout_session_supported': True, 'device_authorization_endpoint': 'https://adfs.redmond.ext-n26r2105.masd.stbtest.microsoft.com/adfs/oauth2/devicecode'}
msal.application: Broker enabled? False
cli.azure.cli.core.auth.msal_authentication: UserCredential.get_token: scopes=('https://management.adfs.n26r2105.masd.stbtest.microsoft.com/dafbca93-71b6-4072-8135-1e81d4f3b6a1/.default',), claims=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 47cb0027-8ee5-41f9-a37b-5d8083fe2c1c
cli.azure.cli.core.util: Request URL: 'https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com/v1.0/users?$filter=userPrincipalName%20eq%20%27CloudAdmin%40n26r2105.masd.stbtest.microsoft.com%27'
cli.azure.cli.core.util: Request method: 'GET'
cli.azure.cli.core.util: Request headers:
cli.azure.cli.core.util: 'User-Agent': 'python/3.10.10 (Windows-10-10.0.20348-SP0) AZURECLI/2.48.1 (MSI)'
cli.azure.cli.core.util: 'Accept-Encoding': 'gzip, deflate'
cli.azure.cli.core.util: 'Accept': '*/*'
cli.azure.cli.core.util: 'Connection': 'keep-alive'
cli.azure.cli.core.util: 'x-ms-client-request-id': '573a82c9-52a0-4fb0-b1da-8e8467aff783'
cli.azure.cli.core.util: 'CommandName': 'keyvault create'
cli.azure.cli.core.util: 'ParameterSetName': '--name --resource-group --location --sku --enabled-for-deployment --enabled-for-template-deployment --debug'
cli.azure.cli.core.util: 'Authorization': 'Bearer eyJ0eXAiOiJKV...'
cli.azure.cli.core.util: Request body:
cli.azure.cli.core.util: None
urllib3.connectionpool: Starting new HTTPS connection (1): management.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443
urllib3.connectionpool: https://management.redmond.ext-n26r2105.masd.stbtest.microsoft.com:443 "GET /v1.0/users?$filter=userPrincipalName%20eq%20%27CloudAdmin%40n26r2105.masd.stbtest.microsoft.com%27 HTTP/1.1" 400 137
cli.azure.cli.core.util: Response status: 400
cli.azure.cli.core.util: Response headers:
cli.azure.cli.core.util: 'Cache-Control': 'no-cache'
cli.azure.cli.core.util: 'Pragma': 'no-cache'
cli.azure.cli.core.util: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.util: 'Expires': '-1'
cli.azure.cli.core.util: 'x-ms-failure-cause': 'gateway'
cli.azure.cli.core.util: 'x-ms-request-id': 'f670ec71-5d10-499e-b6a1-3055b65d30e9'
cli.azure.cli.core.util: 'x-ms-correlation-request-id': 'f670ec71-5d10-499e-b6a1-3055b65d30e9'
cli.azure.cli.core.util: 'x-ms-routing-request-id': 'REDMOND:20230511T015757Z:f670ec71-5d10-499e-b6a1-3055b65d30e9'
cli.azure.cli.core.util: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.util: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.util: 'Date': 'Thu, 11 May 2023 01:57:57 GMT'
cli.azure.cli.core.util: 'Content-Length': '137'
cli.azure.cli.core.util: Response content:
cli.azure.cli.core.util: {"error":{"code":"MissingApiVersionParameter","message":"The api-version query parameter (?api-version=) is required for all requests."}}
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 52, in _send
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1011, in send_raw_request
azure.cli.core.azclierror.HTTPError: Bad Request({"error":{"code":"MissingApiVersionParameter","message":"The api-version query parameter (?api-version=) is required for all requests."}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 740, in create_vault
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 307, in _get_current_user_object_id
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 224, in signed_in_user_get
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 55, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: The api-version query parameter (?api-version=) is required for all requests.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 52, in _send
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1011, in send_raw_request
azure.cli.core.azclierror.HTTPError: Bad Request({"error":{"code":"MissingApiVersionParameter","message":"The api-version query parameter (?api-version=) is required for all requests."}})

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 663, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 697, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 333, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 533, in create_vault_or_hsm
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 742, in create_vault
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 357, in _get_object_id
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 342, in _get_object_id_from_subscription
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/keyvault/custom.py", line 325, in _get_object_id_by_upn
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 294, in user_list
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 55, in _send
azure.cli.command_modules.role._msgrpah._graph_client.GraphError: The api-version query parameter (?api-version=) is required for all requests.

cli.azure.cli.core.azclierror: The command failed with an unexpected error. Here is the traceback:
az_command_data_logger: The command failed with an unexpected error. Here is the traceback:
cli.azure.cli.core.azclierror: The api-version query parameter (?api-version=) is required for all requests.
Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 52, in _send
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/util.py", line 1011, in send_raw_request
azure.cli.core.azclierror.HTTPError: Bad Request({"error":{"code":"MissingApiVersionParameter","message":"The api-version query parameter (?api-version=) is required for all requests."}})

The above exception was the direct cause of the following exception:

During handling of the above exception, another exception occurred:

The above exception was the direct cause of the following exception:

During handling of the above exception, another exception occurred:

The above exception was the direct cause of the following exception:

## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

- Register 2020-09-01-hybrid profile for Azure Stack Hub. Omit setting `microsoftGraphResourceId` endpoint.
- Set cloud to the registered cloud above.
- Do an `az login`.
- `az keyvault create --name {} --resource-group {} --location {} --sku {} --enabled-for-deployment {} --enabled-for-template-deployment {} --debug`

## Expected Behavior

## Environment Summary
```
Windows-10-10.0.20348-SP0
Python 3.10.10
Installer: MSI

azure-cli 2.48.1
```
## Additional Context

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

User input for "microsoftGraphResourceId" leads to unexpected behavior

Description

Contributor guide

Assessment

Get new issues in your inbox