Azure / Azure/azure-rest-api-specs
[Role] RoleAssignmentProperties.principalType contains invalid values
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 6k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 444
Description
Reported by https://github.com/Azure/azure-cli/issues/11594
Since `2018-09-01-preview` API, an `Enum` called `PrincipalType` is introduced.
https://github.com/Azure/azure-rest-api-specs/blob/b02ad2011daebdaa4ffc1b0b338181a464d49c47/specification/authorization/resource-manager/Microsoft.Authorization/preview/2020-04-01-preview/authorization-RoleAssignmentsCalls.json#L508-L522
It is used by the role assignment create API.
However, When I really use `--assignee-principal-type MSI` in a CLI command, it returns error:
```powershell
> az role assignment create --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111 --role "Reader" --assignee-principal-type MSI --assignee-object-id 2fdcd421-c744-440d-b253-3daf68c697eb --debug
msrest.http_logger : Request URL: 'https://management.azure.com/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111/providers/Microsoft.Authorization/roleAssignments/0a5f880e-f02f-4a3e-8799-0a09fd95cf29?api-version=2020-04-01-preview'
msrest.http_logger : Request method: 'PUT'
msrest.http_logger : Request body:
msrest.http_logger : {"properties": {"roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7", "principalId": "2fdcd421-c744-440d-b253-3daf68c697eb", "principalType": "MSI"}}
msrest.http_logger : Response status: 400
msrest.http_logger : Response content:
msrest.http_logger : {"error":{"code":"InvalidPrincipalType","message":"The PrincipalType property 'MSI' is not valid. It must be 'User', 'Group' or 'ServicePrincipal'."}}
```
If I remove `--assignee-principal-type MSI`, the command starts to work.
```powershell
> az role assignment create --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111 --role "Reader" --assignee-object-id 2fdcd421-c744-440d-b253-3daf68c697eb --debug
{
"canDelegate": null,
"condition": null,
"conditionVersion": null,
"description": null,
"id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111/providers/Microsoft.Authorization/roleAssignments/07f17302-3df0-4b50-9597-b006ad7ccbcd",
"name": "07f17302-3df0-4b50-9597-b006ad7ccbcd",
"principalId": "2b0e1505-73c2-4cc4-91c2-53f88521a14f",
"principalName": "http://azure-cli-2020-11-11-05-36-53",
"principalType": "ServicePrincipal",
"resourceGroup": "rg1111",
"roleDefinitionId": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7",
"roleDefinitionName": "Reader",
"scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/rg1111",
"type": "Microsoft.Authorization/roleAssignments"
}
```
As discussed in the email thread
- _BadRequestError: The PrincipalType property 'MSI' is not valid. It must be 'User', 'Group' or 'ServicePrincipal'_
only `User`, `Group` or `ServicePrincipal` are allowed values and other invalid values (which are used internally by the service) should not be exposed by `principalType`.
Contributor guide
Research direction
Open specification/authorization/resource-manager/Microsoft.Authorization/preview/2020-04-01-preview/authorization-RoleAssignmentsCalls.json around lines 508-522 and inspect the PrincipalType enum used by role assignment creation. Compare its values with the service error and the reported CLI request; done means the specification no longer exposes invalid principalType values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api, authorization, cloud
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100