Azure / Azure/azure-powershell

New-AzRoleAssignment returns "'PrincipalId' cannot be null" when user's UPN != mail

Open
#23,880 3 comments 0 reactions 0 assignees View on GitHub
act-identity-squad feature-request Resource Authorization Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

If a user's AAD object has
UserPrincipalName = alias@domain.com
mail = first.last@domain.com

And you call New-AzRoleAssignment passing the -SignInName as their mail property, then the "'PrincipalId' cannot be null" error is thrown.

This is because NewAzRoleAssignmentCommand only populates the UPN property of the ADObjectFilterOptions. This means the FilterUsers function in ActiveDirectoryClient.cs will only set the Graph query filter to "u.UserPrincipalName == upnOrMail".

It would be better if FilterUsers would set the Graph query filter to "u.UserPrincipalName == upnOrMail || u.Mail == upnOrMail". Alternatively provide another parameter to New-AzRoleAssignment which would accept a user's Email address (and subsequently set the mail property of the ADObjectFilterOptions) instead of SignInName.

### Issue script & Debug output

```PowerShell
PS C:\Users\kwill> New-AzRoleAssignment -SignInName "First.Last@domain.com" -RoleDefinitionName Owner -Scope "/subscriptions/$SubId"
New-AzRoleAssignment : 'PrincipalId' cannot be null.
At line:1 char:1
+ New-AzRoleAssignment -SignInName "First.Last@microsoft.com" -Ro ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [New-AzRoleAssignment], ValidationException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Resources.NewAzureRoleAssignmentCommand
```

### Environment data

```PowerShell
PS C:\Users\kwill> $PSVersionTable

Name Value
---- -----
PSVersion 5.1.22621.2506
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.22621.2506
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
PS C:\Users\kwill> Get-Module Az*

ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 2.13.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}
Script 6.10.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment...}
Binary 2.0.2.149 AzureADPreview {Add-AzureADAdministrativeUnitMember, Add-AzureADApplicationOwner, Add-AzureADApplicationPolicy, Add-AzureADDeviceRegisteredOwner...}
```

### Error output

```PowerShell
Message : 'PrincipalId' cannot be null.
StackTrace : at Microsoft.Azure.Management.Authorization.Models.RoleAssignmentCreateParameters.Validate()
at Microsoft.Azure.Management.Authorization.RoleAssignmentsOperations.d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.Authorization.RoleAssignmentsOperationsExtensions.d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.Authorization.RoleAssignmentsOperationsExtensions.Create(IRoleAssignmentsOperations operations, String scope, String roleAssignmentName, RoleAssignmentCreateParameters parameters)
at Microsoft.Azure.Commands.Resources.Models.Authorization.AuthorizationClient.CreateRoleAssignment(FilterRoleAssignmentsOptions parameters, Guid roleAssignmentId)
at Microsoft.Azure.Commands.Resources.NewAzureRoleAssignmentCommand.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception : Microsoft.Rest.ValidationException
InvocationInfo : {New-AzRoleAssignment}
Line : New-AzRoleAssignment -SignInName "First.Last@microsoft.com" -RoleDefinitionName Owner -Scope "/subscriptions/$SubId" -Debug
Position : At line:1 char:1
+ New-AzRoleAssignment -SignInName "First.Last@microsoft.com" -Ro ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 7
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.