Azure / Azure/azure-cli

`az ad app credential reset`/`az ad sp create-for-rbac`: `--years` adds 366 days in leap years

Open
#28,520 1 comment 0 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad Auto-Assign Azure CLI Team feature-request Graph
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
`az ad app credential reset`
`az ad sp create-for-rbac`

**Is your feature request related to a problem? Please describe.**
Currently, `--years` is added directly to the current year to compute the credential end date:

https://github.com/Azure/azure-cli/blob/03ad904956bbac343b409da0d2ba6cce7e240f0d/src/azure-cli/azure/cli/command_modules/role/custom.py#L1176-L1177

If the time range contains a leap year, 366 days will be added.

```py
from dateutil.relativedelta import relativedelta
from datetime import datetime

print(datetime(2023, 1, 1) + relativedelta(years=1) - datetime(2023, 1, 1))
# output: 365 days, 0:00:00
print(datetime(2024, 1, 1) + relativedelta(years=1) - datetime(2024, 1, 1))
# output: 366 days, 0:00:00
```

> [!CAUTION]
> **If there is a policy in the tenant that forbids expiry time longer than 365 days, the 366 day expiry time will cause commands to fail.**

Luckily, now is already past 2024-02-29, so the next time it will happen is 2028.

**Describe the solution you'd like**
Use `datetime.timedelta` instead of `dateutil.relativedelta.relativedelta` to add exactly 365 days per year, regardless of leap years, in order to make the computed end date definitive.

Azure Portal uses exactly 365 days:

![image](https://github.com/Azure/azure-cli/assets/4003950/deaf26f1-fdee-41d3-bd5e-f2ba05c11e78)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.