Skip to content

Conversation

@jiasli
Copy link
Member

@jiasli jiasli commented Jun 30, 2020

Description
Fix #12797: Cannot grant admin consent for an app role permission

If ad app permission grant is called for an app without a corresponding service principal, it will fail:

# Create the app
$ appId=$(az ad app create --display-name "myapp0630" --query appId -o tsv)

# Grant permission but it fails due to the lack of service principal 
$ az ad app permission grant --id $appId --api 00000003-0000-0000-c000-000000000000
Operation failed with status: 'Not Found'. Details: 404 Client Error: Not Found for url: https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/oauth2PermissionGrants?$filter=clientId%20eq%20%27c9a8ddb5-d410-4de2-a7ca-0c5d55ff3a6b%27&api-version=1.6

To fix it, we need to create a corresponding service principal first:

# Create corresponding service principal
$ az ad sp create --id $appId

# Now granting permission works
$ az ad app permission grant --id $appId --api 00000003-0000-0000-c000-000000000000
{
  "clientId": "a201d009-477f-41d9-b683-799c29190706",
  "consentType": "AllPrincipals",
  "expiryTime": "2021-06-30T04:23:14.521719",
  "objectId": "CdABon9H2UG2g3mcKRkHBonI76O38TJFngGR4y0QOfQ",
  "odata.metadata": "https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/$metadata#oauth2PermissionGrants/@Element",
  "odatatype": null,
  "principalId": null,
  "resourceId": "a3efc889-f1b7-4532-9e01-91e32d1039f4",
  "scope": "user_impersonation",
  "startTime": "2020-06-30T04:23:14.521719"
}

This PR adds this prerequisite to the help message.

@jiasli jiasli requested a review from qianwens June 30, 2020 04:36
@jiasli jiasli requested a review from arrownj June 30, 2020 04:37
/src/azure-cli/azure/cli/command_modules/profile/ @jiasli @arrownj
/src/azure-cli/azure/cli/command_modules/resource/ @Juliehzl @zhoxing-ms @qianwens
/src/azure-cli/azure/cli/command_modules/role/ @jiasli
/src/azure-cli/azure/cli/command_modules/role/ @jiasli @qianwens @arrownj
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@yungezz, @yonzhan, Adding code owners @qianwens @arrownj.

@jiasli jiasli requested review from yonzhan and yungezz June 30, 2020 04:38
@jiasli jiasli self-assigned this Jun 30, 2020
@jiasli jiasli added this to the S172 milestone Jun 30, 2020
@jiasli jiasli added the Graph az ad label Jun 30, 2020
Copy link
Collaborator

@yonzhan yonzhan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@yonzhan
Copy link
Collaborator

yonzhan commented Jun 30, 2020

add to S172

@jiasli jiasli merged commit 943596c into Azure:dev Jul 6, 2020
@jiasli jiasli deleted the permission-grant branch July 6, 2020 05:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Graph az ad

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Cannot grant admin consent for an app role permission

4 participants