Azure / Azure/azure-powershell
First lookup of new AD user fails?
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
I have software that dynamically creates new users and assigns them rights to a new resource group that is also dynamically created. Once that is done, an event is fired, and I have a script that attempts to use New-AzureRmRoleAssignment to grant that new user permissions to a pre-existing resource group. The command being fired is a simple one-liner:
```PowerShell
New-AzureRmRoleAssignment -SignInName $upn -ResourceGroup name $rgName -RoleDefinitionName Contributor
```
When this fires, the invocation fails every time with an error indicating "The provided information does not map to an AD object ID", meaning that it could not find the user from the UPN. If, however, I modify the script to try to look up the user repeatedly with delay, and then once the user is found create the new role assignment, it works fine. In both cases, however, I know that the user exists because I can sign in with them immediately in the Azure portal. Here is a revised version of the same script that works after a single retry:
```PowerShell
$totalDelay = 0
while (-not ($user = Get-AzureRmADUser -UserPrincipalName $upn)) {
Start-Sleep -Milliseconds 250
$totalDelay += 250
if ($totalDelay -gt 60000) {
break
}
}
Write-Verbose -Message "Total delay: ${totalDelay} ms"
if (-not $user) {
throw "Failed to lookup Azure AD User '${upn}' within 60 seconds."
}
New-AzureRmRoleAssignment -ObjectId $user.Id -ResourceGroupName $rgName -RoleDefinitionName Contributor
```
This second version is much more complicated and shouldn't be necessary because the user already exists (100% guaranteed because we assign the user rights to the resource group we dynamically create before my script is invoked, which wouldn't be possible if the user did not exist). Also note that the second version works the second time it is invoked (a 250ms delay is all it takes).
All of this to say, there appears to be an issue when looking up new AD users the first time using Azure PowerShell.
### Script/Steps for Reproduction
See above.
### Module Version
6.2.1
### Environment Data
|Name|Value|
|--|--|
|PSVersion|5.1.17134.112|
|PSEdition|Desktop|
|PSCompatibleVersions|{1.0, 2.0, 3.0, 4.0...}|
|BuildVersion|10.0.17134.112|
|CLRVersion|4.0.30319.42000|
|WSManStackVersion|3.0|
|PSRemotingProtocolVersion|2.3|
|SerializationVersion|1.1.0.1|
### Debug Output
```
DEBUG: 10:38:52 PM - NewAzureRoleAssignmentCommand begin processing with ParameterSet 'ResourceGroupWithSignInNameParameterSet'.
DEBUG: 10:38:52 PM - using account id 'ffad39fb-92b7-424e-95fb-25d3f2da9a3b'...
DEBUG: [Common.Authentication]: Authenticating using Account: 'ffad39fb-92b7-424e-95fb-25d3f2da9a3b', environment: 'AzureCloud', tenant: '8eb87a6e-8055-4135-b69d-f19c799ec045'
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: - TokenCache: Serializing token cache with 2 items.
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: 9ff62f09-8d33-4a50-b41e-ff9997ddacde - AcquireTokenHandlerBase: === Token Acquisition finished successfully. An access token was retuned: Access Token Hash: g9sGz7XlSaKzVUrU45cJma/Lwg8ymkuOIK11ss/TPrc= Refresh Token Hash: [No Refresh Token] Expiration Time: 06/19/2018 23:32:47 +00:00 User Hash: null
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: 9ff62f09-8d33-4a50-b41e-ff9997ddacde - TokenCache: A matching item (access token or refresh token or both) was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: 9ff62f09-8d33-4a50-b41e-ff9997ddacde - TokenCache: 53.918714275 minutes left until token in cache expires
DEBUG: 06/19/2018 22:38:52: 9ff62f09-8d33-4a50-b41e-ff9997ddacde - AcquireTokenHandlerBase: === Token Acquisition started: Authority: https://login.microsoftonline.com/8eb87a6e-8055-4135-b69d-f19c799ec045/ Resource: https://management.core.windows.net/ ClientId: ffad39fb-92b7-424e-95fb-25d3f2da9a3b CacheType: Microsoft.Azure.Commands.Common.Authentication.AuthenticationStoreTokenCache (2 items) Authentication Target: Client
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: ============================ HTTP REQUEST ============================ HTTP Method: GET Absolute Uri: https://graph.windows.net/8eb87a6e-8055-4135-b69d-f19c799ec045/users?$filter=userPrincipalName eq 'Morgan-45932%40cloudslice.onmicrosoft.com'&api-version=1.6 Headers: x-ms-client-request-id : 07a7bc1b-62b0-4034-93ec-69224d7b8da7 accept-language : en-US Body:
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: b35af023-fbbc-4f5b-8b5d-71e6a42c4a64 - TokenCache: An item matching the requested resource was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 06/19/2018 22:38:52: 9ff62f09-8d33-4a50-b41e-ff9997ddacde - TokenCache: Looking up cache for a token...
DEBUG: 06/19/2018 22:38:52: b35af023-fbbc-4f5b-8b5d-71e6a42c4a64 - TokenCache: 53.9414986866667 minutes left until token in cache expires
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: b35af023-fbbc-4f5b-8b5d-71e6a42c4a64 - TokenCache: A matching item (access token or refresh token or both) was found in the cache
DEBUG: 06/19/2018 22:38:52: b35af023-fbbc-4f5b-8b5d-71e6a42c4a64 - AcquireTokenHandlerBase: === Token Acquisition finished successfully. An access token was retuned: Access Token Hash: 7TZ2QyLwccmU/57kb+x6aVHruExI2WIB8r/bx2xtxtc= Refresh Token Hash: [No Refresh Token] Expiration Time: 06/19/2018 23:32:49 +00:00 User Hash: null
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: - TokenCache: Serializing token cache with 2 items.
DEBUG: [Common.Authentication]: Authenticating using Account: 'ffad39fb-92b7-424e-95fb-25d3f2da9a3b', environment: 'AzureCloud', tenant: '8eb87a6e-8055-4135-b69d-f19c799ec045'
DEBUG: 06/19/2018 22:38:52: b35af023-fbbc-4f5b-8b5d-71e6a42c4a64 - TokenCache: Looking up cache for a token...
DEBUG: 06/19/2018 22:38:52: b35af023-fbbc-4f5b-8b5d-71e6a42c4a64 - AcquireTokenHandlerBase: === Token Acquisition started: Authority: https://login.microsoftonline.com/8eb87a6e-8055-4135-b69d-f19c799ec045/ Resource: https://graph.windows.net/ ClientId: ffad39fb-92b7-424e-95fb-25d3f2da9a3b CacheType: Microsoft.Azure.Commands.Common.Authentication.AuthenticationStoreTokenCache (2 items) Authentication Target: Client
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 06/19/2018 22:38:52: 9ff62f09-8d33-4a50-b41e-ff9997ddacde - TokenCache: An item matching the requested resource was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: ============================ HTTP RESPONSE ============================ Status Code: OK Headers: Pragma : no-cache ocp-aad-diagnostics-server-name: jgkTREa8VkJkXrnKFVYN6GLgBytsPCC0/I/2wc2dZSk= request-id : 2f30a522-27d6-42dd-96ad-ec7f615536e5 client-request-id : 4b2e2776-6909-425e-86ab-ce6024b49ddd x-ms-dirapi-data-contract-version: 1.6 ocp-aad-session-key : 74LvubaOO1gb2QTmjrTtAOahLKwAc-mnft61y5828WErLihmda9vLgFAEDSvSkJCSE0bV2UdN6ezLGbH0GM5hy9UyUewOsdunjh-eSstSAcvniW54JD8HKeAEJ8DPRkH.uEFYVQbPoc-YwnNk5iubzvTc_fjlCmVUPOcwwAjJ8Pw X-Content-Type-Options : nosniff DataServiceVersion : 3.0; Strict-Transport-Security : max-age=31536000; includeSubDomains Access-Control-Allow-Origin : * Duration : 446509 Cache-Control : no-cache Server : Microsoft-IIS/10.0 X-AspNet-Version : 4.0.30319 X-Powered-By : ASP.NET,ASP.NET Date : Tue, 19 Jun 2018 22:38:52 GMT Body: { "odata.metadata": "https://graph.windows.net/8eb87a6e-8055-4135-b69d-f19c799ec045/$metadata#directoryObjects/Microsoft.DirectoryServices.User", "value": [] }
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 06/19/2018 22:38:52: - TokenCache: Serializing token cache with 2 items.
```
Contributor guide
Assessment
This issue has not been assessed yet.