Azure / Azure/azure-rest-api-specs

[BUG] API for Role Assignments - Create return 500 with invalidate principalId

Open
#37,009 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

### API Spec link

https://learn.microsoft.com/en-us/rest/api/authorization/role-assignments/create?view=rest-authorization-2022-04-01&tabs=HTTP

### API Spec version

2022-04-01

### Describe the bug

When create role assignment for an AD group, value of `properties.principalId` should be the object_id (GUID only) of the AD group.

When pass the id of the AD group (`/groups/`), the API will return 500 error, and no detail message will returned in the response.

For example, pass the request body with principalId value as below:
```json
{
"properties": {
"principalId": "/groups/00000000-0000-0000-0000-000000000000",
"principalType": "Group",
// ...
}
}
```

I guess it's caused by the API did not validate if it's a valid GUID and try to convert to GUID directly and failed.

### Expected behavior

Should return an error message that the principalId is not valid.

### Actual behavior

The response just show "InternalServerError":
```
{
"error": {
"code": "InternalServerError",
"message": "Encountered internal server error. Diagnostic information: timestamp '...', subscription id '...', tracking id '...', request correlation id '...'."
}
}
```

### Reproduction Steps

Simple powershell script to reproduce the problem:
```powershell
# Login with az CLI first
$token = (az account get-access-token | ConvertFrom-Json).accessToken

$headers = @{
Authorization = "Bearer $token"
Accept = "application/json"
"Content-Type" = "application/json"
}

$adGroup_object_Id = "" # replace with a real ad group object id in GUID
$roleDefinitionId = "" # replace with a real role definition id

$body = @{
properties = @{
principalId = "/groups/$($adGroup_object_Id)" # Should be $adGroup_object_Id only
principalType = "Group"
roleDefinitionId = $roleDefinitionId
}
} | ConvertTo-Json

$scope = ""
$roleAssignmentId = (New-Guid).Guid
$url = "https://management.azure.com/$($scope)/providers/Microsoft.Authorization/roleAssignments/$($roleAssignmentId)?api-version=2022-04-01"

# Will get 500 response without detail message
Invoke-WebRequest -Method PUT -Uri $url -Headers $headers -Body $body
```

### Environment

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Microsoft.Authorization role-assignments Create definition for API version 2022-04-01, using the linked REST API specification and the PowerShell reproduction as the behavioral reference. Check whether invalid properties.principalId values and the resulting client error are represented in the specification; the work is done when the expected validation behavior is accurately captured or the required service-side change is clearly identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, openapi, powershell
Domain
api, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.