Azure / Azure/azure-rest-api-specs

[Role] RoleAssignmentProperties.principalType contains invalid values

Open
#11,830 1 comment 0 reactions 0 assignees View on GitHub
Authorization Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
6k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

Reported by https://github.com/Azure/azure-cli/issues/11594

Since `2018-09-01-preview` API, an `Enum` called `PrincipalType` is introduced.

https://github.com/Azure/azure-rest-api-specs/blob/b02ad2011daebdaa4ffc1b0b338181a464d49c47/specification/authorization/resource-manager/Microsoft.Authorization/preview/2020-04-01-preview/authorization-RoleAssignmentsCalls.json#L508-L522

It is used by the role assignment create API.

However, When I really use `--assignee-principal-type MSI` in a CLI command, it returns error:

```powershell
> az role assignment create --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111 --role "Reader" --assignee-principal-type MSI --assignee-object-id 2fdcd421-c744-440d-b253-3daf68c697eb --debug

msrest.http_logger : Request URL: 'https://management.azure.com/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111/providers/Microsoft.Authorization/roleAssignments/0a5f880e-f02f-4a3e-8799-0a09fd95cf29?api-version=2020-04-01-preview'
msrest.http_logger : Request method: 'PUT'
msrest.http_logger : Request body:
msrest.http_logger : {"properties": {"roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7", "principalId": "2fdcd421-c744-440d-b253-3daf68c697eb", "principalType": "MSI"}}

msrest.http_logger : Response status: 400
msrest.http_logger : Response content:
msrest.http_logger : {"error":{"code":"InvalidPrincipalType","message":"The PrincipalType property 'MSI' is not valid. It must be 'User', 'Group' or 'ServicePrincipal'."}}
```

If I remove `--assignee-principal-type MSI`, the command starts to work.

```powershell
> az role assignment create --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111 --role "Reader" --assignee-object-id 2fdcd421-c744-440d-b253-3daf68c697eb --debug

{
"canDelegate": null,
"condition": null,
"conditionVersion": null,
"description": null,
"id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111/providers/Microsoft.Authorization/roleAssignments/07f17302-3df0-4b50-9597-b006ad7ccbcd",
"name": "07f17302-3df0-4b50-9597-b006ad7ccbcd",
"principalId": "2b0e1505-73c2-4cc4-91c2-53f88521a14f",
"principalName": "http://azure-cli-2020-11-11-05-36-53",
"principalType": "ServicePrincipal",
"resourceGroup": "rg1111",
"roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
"roleDefinitionName": "Reader",
"scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111",
"type": "Microsoft.Authorization/roleAssignments"
}
```

As discussed in the email thread

- _BadRequestError: The PrincipalType property 'MSI' is not valid. It must be 'User', 'Group' or 'ServicePrincipal'_

only `User`, `Group` or `ServicePrincipal` are allowed values and other invalid values (which are used internally by the service) should not be exposed by `principalType`.

Contributor guide

Open the contributing guide

Research direction

Open specification/authorization/resource-manager/Microsoft.Authorization/preview/2020-04-01-preview/authorization-RoleAssignmentsCalls.json around lines 508-522 and inspect the PrincipalType enum used by role assignment creation. Compare its values with the service error and the reported CLI request; done means the specification no longer exposes invalid principalType values.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api, authorization, cloud
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.