microsoftgraph / microsoftgraph/msgraph-sdk-go
Creating Applications with Federated Credentials results in duplicate App Registrations
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 335
- Forks
- 43
- Avg merge
- 15h 19m
- Merged PRs (30d)
- 3
Description
Describe the bug
I am trying to create an App Registration via GraphServiceClient with a Federated Credential:
func (c *Client) CreateServicePrincipal() (string, error) {
appRequestBody := graphmodels.NewApplication()
name := "ben-test-123"
appRequestBody.SetDisplayName(&name)
federatedCredential := graphmodels.NewFederatedIdentityCredential()
issuer := "https://my-issuer.com/oidc"
federatedCredential.SetIssuer(&issuer)
audience := "123"
federatedCredential.SetAudiences([]string{audience})
sub := "123"
federatedCredential.SetSubject(&sub)
fname := "test"
federatedCredential.SetName(&fname)
appRequestBody.SetFederatedIdentityCredentials([]graphmodels.FederatedIdentityCredentialable{federatedCredential})
applications, err := c.graphClient.Applications().Post(context.Background(), appRequestBody, nil)
if err != nil {
return "", err
}
return *applications.GetAppId(), nil
}
Executing this code results in an error returned by graphClient: Encountered an internal server error. What is more interesting is that even though the client returned an error, the App Registration is created two times with the same name (the Federated Credential is populated fine in both instances).
Simply commenting out the line:
appRequestBody.SetFederatedIdentityCredentials([]graphmodels.FederatedIdentityCredentialable{federatedCredential})
and executing the code again works as expected: a single instance of App Registration (obviously without the Federated Credential) is created and client returns nil error.
Therefore, I strongly suspect that this issue is related to how Federated Credentials are handled in App Registrations.
Expected behavior
The expected behaviour is that only a single instance is created with the Federated Credentials populated. The graphClient should return a nil error, and CreateServicePrincipal() should return the Application (client) ID.
How to reproduce
Just execute the above sample code.
SDK Version
v1.45.0
Latest version known to work for scenario above?
No response
Known Workarounds
I tried to workaround the issue by first creating the application without Federated Credentials and then patching it with Federated Credentials. However, the patching request with Federated Credentials fails with the same error: Encountered an internal server error, and the Federated Credential was not added to the App Registration.
Debug output
Click to expand log
```</details>
### Configuration
Apple M1 Pro with 14.5 (23F79) OS version, and with Go version 1.21.
### Other information
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the CreateServicePrincipal sample and the GraphServiceClient Applications().Post call using a FederatedIdentityCredential, then reproduce the behavior on SDK v1.45.0 or the latest version. Done means one App Registration is created with the federated credential and the call returns no error; also compare the create and patch attempts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100