work around AAD service principal race condition #716

bmc-msft · 2021-03-23T02:22:00Z

This works around an issue in AAD service principal creation. The race condition in AAD shows up as:

INFO:deploy:checking if RBAC already exists
INFO:deploy:creating Application registration
INFO:deploy:creating service principal
Traceback (most recent call last):
  File "deploy.py", line 926, in <module>
    main()
  File "deploy.py", line 920, in main
    state[1](client)
  File "deploy.py", line 303, in setup_rbac
    client.service_principals.create(service_principal_params)
  File "/tmp/tmpp2x7ybfg/deploy-venv/lib/python3.8/site-packages/azure/graphrbac/operations/service_principals_operations.py", line 87, in create
    raise models.GraphErrorException(self._deserialize, response)
azure.graphrbac.models.graph_error_py3.GraphErrorException: When using this permission, the backing application of the service principal being created must in the local tenant

The azure-cli has the same issue, as seen in Azure/azure-cli#14767

src/deployment/deploy.py

…tion

ghost · 2021-03-23T21:02:33Z

Hello @bmc-msft!

Because this pull request has the auto-merge label, I will be glad to assist with helping to merge this pull request once all check-in policies pass.

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (`@msftbot`) and give me an instruction to get started! Learn more here.

work around AAD service principal race condition

93dfa9c

bmc-msft requested a review from chkeita March 23, 2021 02:22

jiasli mentioned this pull request Mar 23, 2021

{Role} ad sp create-for-rbac: Retry Service Principal creation for "must in the local tenant" error Azure/azure-cli#17412

Merged

ranweiler reviewed Mar 23, 2021

View reviewed changes

src/deployment/deploy.py Outdated Show resolved Hide resolved

try retrying more frequently

ddc561a

ranweiler approved these changes Mar 23, 2021

View reviewed changes

Merge branch 'main' into work-around-aad-service-principal-race-condi…

402e7a1

…tion

bmc-msft added auto-merge passed-integration-tests labels Mar 23, 2021

ghost merged commit de5c843 into microsoft:main Mar 23, 2021

bmc-msft deleted the work-around-aad-service-principal-race-condition branch March 23, 2021 21:03

ghost locked as resolved and limited conversation to collaborators Apr 23, 2021

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

work around AAD service principal race condition #716

work around AAD service principal race condition #716

bmc-msft commented Mar 23, 2021

ghost commented Mar 23, 2021

work around AAD service principal race condition #716

work around AAD service principal race condition #716

Conversation

bmc-msft commented Mar 23, 2021

ghost commented Mar 23, 2021

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (@msftbot) and give me an instruction to get started! Learn more here.

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (`@msftbot`) and give me an instruction to get started! Learn more here.