Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

{Profile} az login: Update examples and history note #30291

Merged
merged 1 commit into from
Nov 12, 2024
Merged

{Profile} az login: Update examples and history note #30291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/azure-cli/HISTORY.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ Release History

**Profile**

* `az login`: Passing the service principal certificate with `--password` is deprecated and will be removed by version 2.74. Please use `--certificate` instead. (#30091)
* `az login`: Passing the service principal certificate with `--password` is deprecated and will be removed in version 2.67.0. Please use `--certificate` instead. (#30091)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed to align with MicrosoftDocs/azure-docs-cli#4727.


**RDBMS**

Expand Down
8 changes: 4 additions & 4 deletions src/azure-cli/azure/cli/command_modules/profile/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,11 +36,11 @@
- name: Log in interactively.
text: az login
- name: Log in with username and password. This doesn't work with Microsoft accounts or accounts that have two-factor authentication enabled. Use -p=secret if the first character of the password is '-'.
text: az login -u johndoe@contoso.com -p VerySecret
- name: Log in with a service principal using client secret. Use -p=secret if the first character of the password is '-'.
text: az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since #18312, identifierUris such as http://azure-cli-2016-08-05-14-31-15 are no longer set on the service principal created by az ad sp create-for-rbac, so it cannot be used as --username. Only App ID works now.

text: az login --username johndoe@contoso.com --password VerySecret
- name: Log in with a service principal using client secret. Use --password=secret if the first character of the password is '-'.
text: az login --service-principal --username APP_ID --password CLIENT_SECRET --tenant TENANT_ID
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TENANT_ID is preferred. Otherwise, a domain name will trigger the extra tenant discovery process:

azure-cli/src/azure-cli/azure/cli/command_modules/profile/_validators.py

Lines 12 to 31 in 2548ad6

def validate_tenant(cmd, namespace):
"""
Make sure tenant is a GUID. If domain name is provided, resolve to GUID.
https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#find-your-apps-openid-configuration-document-uri
"""
from azure.cli.core.util import is_guid
if namespace.tenant is not None and not is_guid(namespace.tenant):
import requests
active_directory_endpoint = cmd.cli_ctx.cloud.endpoints.active_directory
url = '{}/{}/v2.0/.well-known/openid-configuration'.format(active_directory_endpoint, namespace.tenant)
response = requests.get(url, verify=not should_disable_connection_verify())
if response.status_code != 200:
from knack.util import CLIError
raise CLIError("Failed to resolve tenant '{}'.\n\nError detail: {}".format(namespace.tenant, response.text))
# Example issuer: https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0
tenant_id = response.json()['issuer'].split("/")[3]
logger.debug('Resolved tenant domain name %s to GUID %s', namespace.tenant, tenant_id)
namespace.tenant = tenant_id

- name: Log in with a service principal using certificate.
text: az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 --certificate ~/mycertfile.pem --tenant contoso.onmicrosoft.com
text: az login --service-principal --username APP_ID --certificate /path/to/cert.pem --tenant TENANT_ID
- name: Log in with a system-assigned managed identity.
text: az login --identity
- name: Log in with a user-assigned managed identity. You must specify the client ID, object ID or resource ID of the user-assigned managed identity with --username.
Expand Down