Azure / Azure/azure-rest-api-specs
[BUG] API for Role Assignments - Create return 500 with invalidate principalId
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
### API Spec link
https://learn.microsoft.com/en-us/rest/api/authorization/role-assignments/create?view=rest-authorization-2022-04-01&tabs=HTTP
### API Spec version
2022-04-01
### Describe the bug
When create role assignment for an AD group, value of `properties.principalId` should be the object_id (GUID only) of the AD group.
When pass the id of the AD group (`/groups/`), the API will return 500 error, and no detail message will returned in the response.
For example, pass the request body with principalId value as below:
```json
{
"properties": {
"principalId": "/groups/00000000-0000-0000-0000-000000000000",
"principalType": "Group",
// ...
}
}
```
I guess it's caused by the API did not validate if it's a valid GUID and try to convert to GUID directly and failed.
### Expected behavior
Should return an error message that the principalId is not valid.
### Actual behavior
The response just show "InternalServerError":
```
{
"error": {
"code": "InternalServerError",
"message": "Encountered internal server error. Diagnostic information: timestamp '...', subscription id '...', tracking id '...', request correlation id '...'."
}
}
```
### Reproduction Steps
Simple powershell script to reproduce the problem:
```powershell
# Login with az CLI first
$token = (az account get-access-token | ConvertFrom-Json).accessToken
$headers = @{
Authorization = "Bearer $token"
Accept = "application/json"
"Content-Type" = "application/json"
}
$adGroup_object_Id = "" # replace with a real ad group object id in GUID
$roleDefinitionId = "" # replace with a real role definition id
$body = @{
properties = @{
principalId = "/groups/$($adGroup_object_Id)" # Should be $adGroup_object_Id only
principalType = "Group"
roleDefinitionId = $roleDefinitionId
}
} | ConvertTo-Json
$scope = ""
$roleAssignmentId = (New-Guid).Guid
$url = "https://management.azure.com/$($scope)/providers/Microsoft.Authorization/roleAssignments/$($roleAssignmentId)?api-version=2022-04-01"
# Will get 500 response without detail message
Invoke-WebRequest -Method PUT -Uri $url -Headers $headers -Body $body
```
### Environment
_No response_
Contributor guide
Research direction
Start with the Microsoft.Authorization role-assignments Create definition for API version 2022-04-01, using the linked REST API specification and the PowerShell reproduction as the behavioral reference. Check whether invalid properties.principalId values and the resulting client error are represented in the specification; the work is done when the expected validation behavior is accurately captured or the required service-side change is clearly identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, openapi, powershell
- Domain
- api, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100