Azure / Azure/azure-sdk-for-python

azure-ai-translation-text: TextTranslationClient mangles audience string

Open
#42,093 1 comment 0 reactions 0 assignees View on GitHub
bug Cognitive - Translator customer-reported needs-team-attention Service Attention
Dominant language
Python
Stars
5.6k
Forks
3.4k
Avg merge
1d 21h
Merged PRs (30d)
193

Description

- **Package Name**: azure-ai-translation-text
- **Package Version**: 1.0.1
- **Operating System**: Linux (debian)
- **Python Version**: 3.12

**Describe the bug**
We have a proxy in front of the Azure Translator resource that has it's own scopes and app roles configured via Azure AD.

Scopes (application id uri):
- api://translationhub-dev
- api://translationhub-test
- api://translationhub-live

In live we can see from the `azure.identity` lib logs that the wrong scope is attempted to be used and application cannot be found:
```
DefaultAzureCredential.get_token_info failed: WorkloadIdentityCredential raised unexpected error "Microsoft Entra ID error '(invalid_resource) AADSTS500011: The resource principal named api://translationhub-liv was not found in the tenant named .
```

We can clearly see, that [this logic here in the client library code](https://github.com/Azure/azure-sdk-for-python/blob/a209e4ab54a47b933414583f3cd8a53b556dbc4a/sdk/translation/azure-ai-translation-text/azure/ai/translation/text/_patch.py#L100C71-L100C121) is stripping away part of our scope string. The code was clearly intended to only handle the `/.default` scope as a whole, but in practice strips any of the following characters in any order that are contained in this set: ["/", ".", "d", "e", "f", "a", "u", "l", "t"].

Since "e" in "-live" is part of this set, it is stripped due to the way rstrip("/.default") works ([rstrip docs](https://www.w3schools.com/python/ref_string_rstrip.asp)).

**To Reproduce**
Steps to reproduce the behavior:
```python
from azure.ai.translation.text import TextTranslationClient
from azure.identity import DefaultAzureCredential

client = TextTranslationClient(
audience="api://translationhub-live",
endpoint="https://my-proxy-endpoint.net",
credential=DefaultAzureCredential(),
)
```

**Expected behavior**
The TextTranslationClient when making requests should request oauth tokens for scope "api://translationhub-live/.default", NOT "api://translationhub-liv/.default".

**Screenshots**

Image

**Additional context**
/

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.