Repository navigation
Conversation
The identity and the Resource Graph client were created with nil options, so every query targeted the public cloud and Azure Government credentials failed with NoValidSubscriptionsInQueryRequest. The endpoint URLs that az ad sp create-for-rbac --sdk-auth writes into the credentials now select the cloud: the public, Government and China endpoints map to the SDK's own configurations, any other pair is used as given with managementEndpointUrl as the token audience, and the configuration reaches both the credential and the client for service principal and workload identity alike. Signed-off-by: Youssef Omar Bouden <youssef.bouden2002@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
Both credential paths created the
azidentitycredential and thearmresourcegraphclient with nil options, so every query went tologin.microsoftonline.comandmanagement.azure.comwhatever cloud the subscription lived in; with Azure Government credentials that fails withNoValidSubscriptionsInQueryRequest, as reported in #73.The function now reads the endpoint URLs that
az ad sp create-for-rbac --sdk-authwrites into the credentials JSON.activeDirectoryEndpointUrlandresourceManagerEndpointUrlselect the cloud: the public, Government and China endpoints map to the SDK's built-incloud.Configurationvalues, so the Resource Manager audience is the SDK's own; any other pair is used as given, withmanagementEndpointUrlas the token audience when present; and an unknown Resource Manager endpoint without its authority is an error rather than a silent fallback to the public cloud. The configuration is passed to the credential and to the Resource Graph client for both service principal and workload identity credentials. Credentials without these keys behave exactly as before. The README gains a "Sovereign clouds" section.Fixes #73
I have:
TestCloudConfigurationcovers the public, Government and China endpoints (with and without trailing slashes, and with only the authority given), a custom cloud with and withoutmanagementEndpointUrl, and the error case.go test ./...passes and the repository's golangci-lint configuration reports only the goconst findings thatfn_test.goalready has onmain. Not run against a live Azure Government tenant.