microsoftgraph / microsoftgraph/msgraph-sdk-go

Creating Applications with Federated Credentials results in duplicate App Registrations

Open
#741 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Needs Attention :wave: type:bug
Dominant language
Go
Stars
335
Forks
43
Avg merge
15h 19m
Merged PRs (30d)
3

Description

Describe the bug

I am trying to create an App Registration via GraphServiceClient with a Federated Credential:

func (c *Client) CreateServicePrincipal() (string, error) {
	appRequestBody := graphmodels.NewApplication()
	name := "ben-test-123"
	appRequestBody.SetDisplayName(&name)
	federatedCredential := graphmodels.NewFederatedIdentityCredential()
	issuer := "https://my-issuer.com/oidc"
	federatedCredential.SetIssuer(&issuer)
	audience := "123"
	federatedCredential.SetAudiences([]string{audience})
	sub := "123"
	federatedCredential.SetSubject(&sub)
	fname := "test"
	federatedCredential.SetName(&fname)
	appRequestBody.SetFederatedIdentityCredentials([]graphmodels.FederatedIdentityCredentialable{federatedCredential})
	applications, err := c.graphClient.Applications().Post(context.Background(), appRequestBody, nil)
	if err != nil {
		return "", err
	}
	return *applications.GetAppId(), nil
}

Executing this code results in an error returned by graphClient: Encountered an internal server error. What is more interesting is that even though the client returned an error, the App Registration is created two times with the same name (the Federated Credential is populated fine in both instances).

Simply commenting out the line:

appRequestBody.SetFederatedIdentityCredentials([]graphmodels.FederatedIdentityCredentialable{federatedCredential})

and executing the code again works as expected: a single instance of App Registration (obviously without the Federated Credential) is created and client returns nil error.

Therefore, I strongly suspect that this issue is related to how Federated Credentials are handled in App Registrations.

Expected behavior

The expected behaviour is that only a single instance is created with the Federated Credentials populated. The graphClient should return a nil error, and CreateServicePrincipal() should return the Application (client) ID.

How to reproduce

Just execute the above sample code.

SDK Version

v1.45.0

Latest version known to work for scenario above?

No response

Known Workarounds

I tried to workaround the issue by first creating the application without Federated Credentials and then patching it with Federated Credentials. However, the patching request with Federated Credentials fails with the same error: Encountered an internal server error, and the Federated Credential was not added to the App Registration.

Debug output
Click to expand log ```
</details>


### Configuration

Apple M1 Pro with 14.5 (23F79) OS version, and with Go version 1.21.

### Other information

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the CreateServicePrincipal sample and the GraphServiceClient Applications().Post call using a FederatedIdentityCredential, then reproduce the behavior on SDK v1.45.0 or the latest version. Done means one App Registration is created with the federated credential and the call returns no error; also compare the create and patch attempts.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.