Azure / Azure/azure-rest-api-specs

roleAssignments API failed to assign role to service principal

Open
#8,320 0 comments 0 reactions 0 assignees View on GitHub
Authorization Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

**Symptom:**
roleAssignments API failed to assign role to service principal and throw error message ""The requested resource does not support http method 'PUT'.

**Root cause:**
After investigated, I found the root cause is if the property "name" in azurerm_role_assignment is specified with character "/" and the client http request url would be appended "AtlasPeeringRoleAssignment/xxxx/xxxx/xxxx". So this request url cannot be found from server side.
After checked, the property "name" should be guid according by the doc(https://docs.microsoft.com/en-us/rest/api/authorization/roleassignments/create). So I think property "name" of roleAssignments API should be added validation logic for property "name" on server side.

**My http request:**
http request url:
PUT https://management.azure.com/%2Fsubscriptions%2Fxxxx-xxxx-xxx-xxxx%2FresourceGroups%2Fneiltest-resources%2Fproviders%2FMicrosoft.Network%2FvirtualNetworks%2Fneil-network1/providers/Microsoft.Authorization/roleAssignments/AtlasPeeringRoleAssignment%2Fxxxx-xxxx-xxxx-xxxx%2Fneiltest-resources%2Fneil-network1?api-version=2015-07-01
Authorization:
Content-type: application/json

http request body:
{
"properties": {
"roleDefinitionId": "/subscriptions/xxx-xxx-xxx-xxx/resourceGroups/neiltest-resources/providers/Microsoft.Network/virtualNetworks/neil-network1/providers/Microsoft.Authorization/roleDefinitions/xxxx-xxxx-xxx-xxx",
"principalId": "xxx-xxxx-xxxx-xxxxx"
}
}

response header:
allow: GET
cache-control: no-cache
content-length: 72
content-type: application/json; charset=utf-8
date: Thu, 06 Feb 2020 01:58:04 GMT
expires: -1
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-ms-correlation-request-id: xxxx-xxx-xxx-xxx
x-ms-ratelimit-remaining-subscription-writes: 1198
x-ms-request-id: xxxx-xxx-xxx-xxx
x-ms-routing-request-id: SOUTHEASTASIA:20200206T015805Z:xxxx-xxx-xxx-xxx

response body:
{
"message": "The requested resource does not support http method 'PUT'."
}

Contributor guide

Open the contributing guide

Research direction

Inspect the roleAssignments API specification and the Create role assignment documentation linked in the issue, focusing on the name property and the example request URL. Reproduce the shown PUT request or review the specification's validation rules; done means names containing '/' are rejected or constrained to the documented GUID format before producing an invalid endpoint.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, openapi
Domain
api, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.