microsoft / microsoft/aspire

Aspire AI Foundry permissions

Open
#10,871 1 comment 0 reactions 0 assignees View on GitHub
ai area-integrations
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

I've created an ai foundry resource in my aspire app with a model deployment with a model deployment. When I go into AI foundry and access something like the agents tab for example, I see this:

> Unable to access your agents
> Your project, "[foundry-dev ](https://portal.azure.com/#resource/subscriptions/708f8908-3b0d-4401-b603-ab31a975aec6/resourceGroups/rg-ecodriver-app-dev/providers/Microsoft.CognitiveServices/accounts/ecodriver-foundry-dev)" does not have permission to access the connected Azure OpenAI resource because its connection is set to use role-based authentication. To resolve this issue, you can either assign the role of Azure AI Developer to your project for the resource "foundryfchpwcdks35oo", or change the connection's authentication method to use an API key and try again. If you recently added the role, it could take up to 15 minutes for the roles to update.

And

> The principal `` lacks the required data action `Microsoft.CognitiveServices/accounts/OpenAI/assistants/read` to perform `GET /openai/assistants` operation.

So I guess the project itself needs to have some permissions assigned to it. Would it be a sensible default with aspire, that if you do a model deployment, it creates these permissions for foundry as well?

If I try to assign permissions, so something like:

```
var foundry = builder.AddAzureAIFoundry("foundry");

foundry.WithRoleAssignments(CognitiveServicesBuiltInRole.AzureAIDeveloper)
```

It doesn't like that, for some reason the 'WithRoleAssignments' method on the 'IResourceBuilder' has a parameter of 'params SignalRBuiltInRole[] roles', which doesn't seem correct.

### Expected Behavior

I should be able to access the features of AI Foundry without permission error when there is a model deployment configured (seems like a reasonable default), and if not, be able to assign the permission with the API.

### Steps To Reproduce

Just add foundry and a model deployment to aspire and try to access features of the AI Foundry portal.

### Exceptions (if any)

The principal `` lacks the required data action `Microsoft.CognitiveServices/accounts/OpenAI/assistants/read` to perform `GET /openai/assistants` operation.

### .NET Version info

.NET SDK:
Version: 9.0.304
Commit: f12f5f689e
Workload version: 9.0.300-manifests.ad61bb1c
MSBuild version: 17.14.16+5d8159c5f

Runtime Environment:
OS Name: Windows
OS Version: 10.0.26100
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\9.0.304\

.NET workloads installed:
[android]
Installation Source: SDK 9.0.300, VS 17.14.36401.2, VS 17.14.36401.2
Manifest Version: 35.0.78/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.android\35.0.78\WorkloadManifest.json
Install Type: Msi

[aspire]
Installation Source: SDK 9.0.300, VS 17.14.36401.2
Manifest Version: 8.2.2/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.aspire\8.2.2\WorkloadManifest.json
Install Type: Msi

[ios]
Installation Source: SDK 9.0.300, VS 17.14.36401.2, VS 17.14.36401.2
Manifest Version: 18.5.9214/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.ios\18.5.9214\WorkloadManifest.json
Install Type: Msi

[maccatalyst]
Installation Source: SDK 9.0.300, VS 17.14.36401.2, VS 17.14.36401.2
Manifest Version: 18.5.9214/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.maccatalyst\18.5.9214\WorkloadManifest.json
Install Type: Msi

[maui-windows]
Installation Source: SDK 9.0.300, VS 17.14.36401.2, VS 17.14.36401.2
Manifest Version: 9.0.51/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.maui\9.0.51\WorkloadManifest.json
Install Type: Msi

[wasm-tools]
Installation Source: SDK 9.0.300, VS 17.14.36401.2
Manifest Version: 9.0.8/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.workload.mono.toolchain.current\9.0.8\WorkloadManifest.json
Install Type: Msi

Configured to use loose manifests when installing new manifests.

Host:
Version: 9.0.8
Architecture: x64
Commit: aae90fa090

.NET SDKs installed:
9.0.304 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 8.0.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.19 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 6.0.36 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.19 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.