-
Notifications
You must be signed in to change notification settings - Fork 3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
{Profile} az login
: Update examples and history note
#30291
Conversation
️✔️AzureCLI-FullTest
|
Hi @jiasli, |
️✔️AzureCLI-BreakingChangeTest
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
@@ -36,11 +36,11 @@ | |||
- name: Log in interactively. | |||
text: az login | |||
- name: Log in with username and password. This doesn't work with Microsoft accounts or accounts that have two-factor authentication enabled. Use -p=secret if the first character of the password is '-'. | |||
text: az login -u johndoe@contoso.com -p VerySecret | |||
- name: Log in with a service principal using client secret. Use -p=secret if the first character of the password is '-'. | |||
text: az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since #18312, identifierUris
such as http://azure-cli-2016-08-05-14-31-15
are no longer set on the service principal created by az ad sp create-for-rbac
, so it cannot be used as --username
. Only App ID works now.
text: az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com | ||
text: az login --username johndoe@contoso.com --password VerySecret | ||
- name: Log in with a service principal using client secret. Use --password=secret if the first character of the password is '-'. | ||
text: az login --service-principal --username APP_ID --password CLIENT_SECRET --tenant TENANT_ID |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
TENANT_ID
is preferred. Otherwise, a domain name will trigger the extra tenant discovery process:
def validate_tenant(cmd, namespace): | |
""" | |
Make sure tenant is a GUID. If domain name is provided, resolve to GUID. | |
https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#find-your-apps-openid-configuration-document-uri | |
""" | |
from azure.cli.core.util import is_guid | |
if namespace.tenant is not None and not is_guid(namespace.tenant): | |
import requests | |
active_directory_endpoint = cmd.cli_ctx.cloud.endpoints.active_directory | |
url = '{}/{}/v2.0/.well-known/openid-configuration'.format(active_directory_endpoint, namespace.tenant) | |
response = requests.get(url, verify=not should_disable_connection_verify()) | |
if response.status_code != 200: | |
from knack.util import CLIError | |
raise CLIError("Failed to resolve tenant '{}'.\n\nError detail: {}".format(namespace.tenant, response.text)) | |
# Example issuer: https://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/v2.0 | |
tenant_id = response.json()['issuer'].split("/")[3] | |
logger.debug('Resolved tenant domain name %s to GUID %s', namespace.tenant, tenant_id) | |
namespace.tenant = tenant_id |
az login
: Update examplesaz login
: Update examples and history note
@@ -76,7 +76,7 @@ Release History | |||
|
|||
**Profile** | |||
|
|||
* `az login`: Passing the service principal certificate with `--password` is deprecated and will be removed by version 2.74. Please use `--certificate` instead. (#30091) | |||
* `az login`: Passing the service principal certificate with `--password` is deprecated and will be removed in version 2.67.0. Please use `--certificate` instead. (#30091) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changed to align with MicrosoftDocs/azure-docs-cli#4727.
Related command
az login
Description
To align with MicrosoftDocs/azure-docs-cli#4756