Unable to authenticate on Azure China Cloud using CLI based authentication

[bigdatasourav]

Bug Report

• What happened?

Here is my code -

package main

import (
	"context"
	"fmt"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	a "github.com/microsoft/kiota-authentication-azure-go"
	msgraphsdkgo "github.com/microsoftgraph/msgraph-sdk-go"
)

func main() {
	ctx := context.Background()

	// Create Azure CLI credential
	cred, err := azidentity.NewAzureCLICredential(nil)
	if err != nil {
		fmt.Printf("Error creating Azure CLI Credential: %v\n", err)
		return
	}

	tokenOptions := policy.TokenRequestOptions{
		Scopes: []string{"https://management.chinacloudapi.cn/.default"},
	}
	_, err = cred.GetToken(ctx, tokenOptions)
	if err != nil {
		fmt.Printf("Error obtaining token: %v\n", err)
		return
	}

	// Create an authentication provider with the Azure CLI credential
	auth, err := a.NewAzureIdentityAuthenticationProvider(cred)
	if err != nil {
		fmt.Printf("Error creating authentication provider: %v\n", err)
		return
	}

	// Create a request adapter using the authentication provider
	adapter, err := msgraphsdkgo.NewGraphRequestAdapter(auth)
	if err != nil {
		fmt.Printf("Error creating graph adapter: %v\n", err)
		return
	}

	// Create a new Microsoft Graph client with the adapter
	client := msgraphsdkgo.NewGraphServiceClient(adapter)

	// Example of listing users
	users, err := client.Users().Get(ctx, nil)
	if err != nil {
		fmt.Printf("Error getting users: %v\n", err)
		return
	}

	// Iterate through the user list
	for _, user := range users.GetValue() {
		fmt.Printf("User ID: %s, Display Name: %s\n", *user.GetId(), *user.GetDisplayName())
	}
}

• What did you expect or want to happen?
  It should work with Azure China Cloud
• How can we reproduce it?
• Anything we should know about your environment.

[chlowell]

I guess this is about the error mentioned in turbot/steampipe-plugin-azuread#167 (if not, please share details about the error)? That error suggests the CLI requested a token for Graph in Azure Public Cloud from Azure China i.e., someone called AzureCLICredential.GetToken() with the wrong scope. If it was the Graph client making the call, you need to configure that client to pass the correct scope for Azure China (https://graph.chinacloudapi.cn//.default). Looks like microsoftgraph/msgraph-sdk-go#26 shows how to do this.

[github-actions]

Hi @bigdatasourav. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[bigdatasourav]

Thanks for the quick reply @chlowell, So below is the correct way(Set the base URL) to set the China Cloud endpoint? or do I need to update the authentication provider as well -

auth, _ := a.NewAzureIdentityAuthenticationProviderWithScopes(cred, []string{
		"https://microsoftgraph.chinacloudapi.cn/.default",
})

package main

import (
	"context"
	"fmt"

	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	a "github.com/microsoft/kiota-authentication-azure-go"
	msgraphsdkgo "github.com/microsoftgraph/msgraph-sdk-go"
)

func main() {
	ctx := context.Background()

	// Create Azure CLI credential
	cred, err := azidentity.NewAzureCLICredential(nil)
	if err != nil {
		fmt.Printf("Error creating Azure CLI Credential: %v\n", err)
		return
	}

	if err != nil {
		fmt.Printf("Error obtaining token: %v\n", err)
		return
	}

	// Create an authentication provider with the Azure CLI credential
	auth, err := a.NewAzureIdentityAuthenticationProvider(cred)
	if err != nil {
		fmt.Printf("Error creating authentication provider: %v\n", err)
		return
	}

	// Create a request adapter using the authentication provider
	adapter, err := msgraphsdkgo.NewGraphRequestAdapter(auth)
	if err != nil {
		fmt.Printf("Error creating graph adapter: %v\n", err)
		return
	}
	
	// set endpoint
	adapter.SetBaseUrl("https://microsoftgraph.chinaclouapi.cn/v1.0")

	// Create a new Microsoft Graph client with the adapter
	client := msgraphsdkgo.NewGraphServiceClient(adapter)

	// Example of listing users
	users, err := client.Users().Get(ctx, nil)
	if err != nil {
		fmt.Printf("Error getting users: %v\n", err)
		return
	}

	// Iterate through the user list
	for _, user := range users.GetValue() {
		fmt.Printf("User ID: %s, Display Name: %s\n", *user.GetId(), *user.GetDisplayName())
	}
}

[chlowell]

That looks like the right function to me because judging by its name, NewAzureIdentityAccessTokenProviderWithScopes does what you need, but I'm not familiar with these modules (they aren't part of the Azure SDK). You may need to pass https://microsoftgraph.chinacloudapi.cn//.default for the scope--note the empty segment //.

[github-actions]

Hi @bigdatasourav, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.