Azure / Azure/azure-sdk-for-python
azure-ai-translation-text: TextTranslationClient mangles audience string
- Dominant language
- Python
- Stars
- 5.6k
- Forks
- 3.4k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 193
Description
- **Package Name**: azure-ai-translation-text
- **Package Version**: 1.0.1
- **Operating System**: Linux (debian)
- **Python Version**: 3.12
**Describe the bug**
We have a proxy in front of the Azure Translator resource that has it's own scopes and app roles configured via Azure AD.
Scopes (application id uri):
- api://translationhub-dev
- api://translationhub-test
- api://translationhub-live
In live we can see from the `azure.identity` lib logs that the wrong scope is attempted to be used and application cannot be found:
```
DefaultAzureCredential.get_token_info failed: WorkloadIdentityCredential raised unexpected error "Microsoft Entra ID error '(invalid_resource) AADSTS500011: The resource principal named api://translationhub-liv was not found in the tenant named .
```
We can clearly see, that [this logic here in the client library code](https://github.com/Azure/azure-sdk-for-python/blob/a209e4ab54a47b933414583f3cd8a53b556dbc4a/sdk/translation/azure-ai-translation-text/azure/ai/translation/text/_patch.py#L100C71-L100C121) is stripping away part of our scope string. The code was clearly intended to only handle the `/.default` scope as a whole, but in practice strips any of the following characters in any order that are contained in this set: ["/", ".", "d", "e", "f", "a", "u", "l", "t"].
Since "e" in "-live" is part of this set, it is stripped due to the way rstrip("/.default") works ([rstrip docs](https://www.w3schools.com/python/ref_string_rstrip.asp)).
**To Reproduce**
Steps to reproduce the behavior:
```python
from azure.ai.translation.text import TextTranslationClient
from azure.identity import DefaultAzureCredential
client = TextTranslationClient(
audience="api://translationhub-live",
endpoint="https://my-proxy-endpoint.net",
credential=DefaultAzureCredential(),
)
```
**Expected behavior**
The TextTranslationClient when making requests should request oauth tokens for scope "api://translationhub-live/.default", NOT "api://translationhub-liv/.default".
**Screenshots**
**Additional context**
/
Contributor guide
Assessment
This issue has not been assessed yet.