Azure / Azure/azure-powershell

[Feature]: New-AzAutomationSourceControl should support OAuth instead of Personal Access Token

Open
#23,527 2 comments 0 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad Automation customer-reported feature-request Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description of the new feature

In the documentation: https://learn.microsoft.com/en-us/powershell/module/az.automation/new-azautomationsourcecontrol?view=azps-10.4.1#example-1 it is stated to use a VSTS Personal Access Token to link a VsoGit repository. With the support of Service Principals and Managed Identities, it would be useful to use OAuth instead. Now you have to do a bit of a workaround when using for example a UAMI. You can't grant the Azure DevOps API permission and granted admin consent on a UAMI.

Therefore, you've to build your custom API call like so:
```powershell
$AccessToken = (Get-AzAccessToken).Token
$Body = @{
name = $SourceControlName
properties = @{
repoUrl = $RepoUrl
sourceType = 0
branch = $Branch
folderPath = $FolderPath
autoSync = $false
publishRunbook = $true
securityToken = @{
accessToken = $AccessToken
refreshToken = $AccessToken
tokenType = 'oauth'
}
}
}

$PayLoad = ($Body | ConvertTo-Json -Depth 100 -Compress)

$Headers = @{
'Authorization' = "Bearer $AccessToken"
'Content-Type' = 'application/json; charset=utf-8'
}

Write-Information -MessageData ("Invoking 'Invoke-RestMethod' against URI [ {0} ]" -f $ApiUri) -InformationAction Continue
$Res = Invoke-RestMethod -Method Put -Uri $ApiUri -Body $PayLoad -Headers $headers
```
### Proposed implementation details (optional)

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the New-AzAutomationSourceControl entry point and the linked Microsoft Learn example for its current Personal Access Token flow. Compare that documented request with the OAuth payload and Invoke-RestMethod example in the issue, then identify the repository's existing source-control tests or implementation before choosing a design. Done means the cmdlet supports the requested OAuth authentication path without requiring the workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
authentication, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.