azuread_application: DuplicateValue

[magne]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureAD Provider) Version

Terraform v0.12.26

• provider.azuread v0.10.0

Affected Resource(s)

• azuread_application

Terraform Configuration Files

resource "azuread_application" "api" {
  name     = "My App"
  homepage = "https://myapp"

  oauth2_permissions {
    type                       = "User"
    value                      = "API.All"
    admin_consent_description  = "Access to the API."
    admin_consent_display_name = "Access to the API."
  }

  app_role {
    value                = "API.All"
    allowed_member_types = ["Application"]
    description          = "Full access to API"
    display_name         = "Full access to API"
  }
}

Expected Behavior

Expected application to be created

Actual Behavior

Terraform failed with error:

Error: patching Azure AD Application with ID "ebf2530f-e8f9-4c5b-8f79-0e727f830870": graphrbac.ApplicationsClient#Patch: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="Unknown" Message="Unknown service error" Details=[{"odata.error":{"code":"Request_BadRequest","date":"2020-06-09T10:06:21","message":{"lang":"en","value":"Request contains a property with duplicate values."},"requestId":"dab8185c-239f-44dd-8ca3-8bd13e3e67b3","values":[{"item":"PropertyName","value":"oauth2Permissions"},{"item":"PropertyErrorCode","value":"DuplicateValue"}]}}]

The reason is that the value of the oauth2_permission and app_role is the same (API.All). If you're not aware that these occupy the same namespace, this is an error that will take some time to figure out (from own exerience :-(). At the same time, this should be quite easy to validate before sending the request to Azure AD.

Steps to Reproduce

1. terraform init
2. terraform apply

[manicminer]

Hi @magne, just want to check that I understand - are you suggesting we validate values for roles and scopes to check for duplicates before attempting to set them for an application? This is indeed a limitation of Microsoft's implementation. In case it helps, one way I've seen people work around this is to use different app registrations for scopes and roles.

[magne]

@manicminer Yes, I think the provider should validate the values. It is a limitation of Azure AD, and it should be easy for the provider to validate. It may save som poor soul a lot of time, as the Azure AD concepts are, at best, confusing. There is no indication that app_roles and oauth2_permissions live in the same namespace.

[manicminer]

Thanks @magne, that makes sense. I'll look at adding that.

[ghost]

This has been released in version 0.11.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azuread" {
    version = "~> 0.11.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!