Fix #8840: Tenant domain name is not accepted by Key Vault #10418
Conversation
There was a problem hiding this comment.
There was a problem hiding this comment.
+1 for doing the conversion at 'az login' level if possible.
There was a problem hiding this comment.
I have moved the domain resolution logic to az login. @yugangw-msft, please kindly review. Thanks!
az login --service-principal -u {} -p {} -t {}.onmicrosoft.com shows warning 'Resolve tenant domain name %s to GUID %s'.
az keyvault create --name {} -g {} should be good.
| uuid.UUID(guid) | ||
| return True | ||
| except ValueError: | ||
| pass |
There was a problem hiding this comment.
nit: you can return False here
There was a problem hiding this comment.
Good point! All _is_guids are fixed.
|
This is a user facing change, please add a releasing note |
rajarshi-singh
left a comment
rajarshi-singh
left a comment
There was a problem hiding this comment.
Thanks again for taking care of this. :)
| if not _is_guid(namespace.tenant): | ||
| import requests | ||
| active_directory_endpoint = cmd.cli_ctx.cloud.endpoints.active_directory | ||
| url = '{}/{}/.well-known/openid-configuration'.format(active_directory_endpoint, namespace.tenant) |
There was a problem hiding this comment.
v1.0 endpoint is now deprecated, so we need to migrate to v2.0:
https://login.microsoftonline.com/azuresdkteam.onmicrosoft.com/.well-known/openid-configuration ->
https://login.microsoftonline.com/azuresdkteam.onmicrosoft.com/v2.0/.well-known/openid-configuration
Official documentation on /.well-known/openid-configuration: https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#find-your-apps-openid-configuration-document-uri
4 participants
Fix #8840: Convert tenant domain name to GUID if it is not.