Support for Managed Identity
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- azure, python
- Domain
- authentication, cloud
Research direction
Start at the Azure CLI authentication entry point and review how the post-provisioning azd hooks obtain credentials for data-plane operations. Compare the current service-principal login with the requested managed-identity login, then run the template validation workflow against a managed identity; done means authentication succeeds and the hooks complete without permission errors.
Written by the indexing model from the issue text.
Description
Template validation action authenticates to Azure CLI using service principal, from logs:
az login --service-principal -u "***" --federated-token $AZURE_AD_TOKEN --tenant "***"
Logged in to Azure as (***)
[
{
"cloudName": "***",
"homeTenantId": "***",
"id": "***",
"isDefault": true,
"managedByTenants": [],
"name": "***",
"state": "Enabled",
"tenantId": "***",
"user": {
"name": "***",
"type": "servicePrincipal"
}
}
]
My template is currently using managed identity to authenticate with the template validation workflow. In this case, -u "***" is the client-id of a managed identity (as opposed to a service principal). az login succeeds, but there seems to be some issue with permissions. The managed identity has Owner permissions on the subscription being deployed to, but the validation is failing claiming that it is missing permissions. The particular location of this failure is within post-provisioning azd hooks. Here, the template is using the local identity (in the case of the validation action, the managed identity) to perform various data-plane operations on Azure.
Perhaps this is related to logging in as a service principal with a managed identity?
Regardless, could the template validation action support managed identity? I imagine that when managed identity authentication is enabled, the az login command would change to:
az login --identity --client-id "***" --federated-token $AZURE_AD_TOKEN --tenant "***"
- Dominant language
- Python
- Stars
- 24
- Forks
- 11
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/template-validation-action
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
-
Difficulty 3/5 1-2 days Newbie friendliness 40/100
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
microsoft/template-validation-action#88 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 38/100
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
microsoft/template-validation-action#74 · 1 comment ·
All issues in microsoft/template-validation-action
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
task
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
danparshall/claude_researcher#87 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
datajoint/datajoint-python#1586 ·
Maintainers usually reply within 1 day
-
1D intercept of length 1 is accepted as `fix_params` in population GLM with more than 1 unitPossibly taken @dhvani7014 claimed this today. Openbug good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
flatironinstitute/nemos#642 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
uniswap-python/uniswap-python#487 ·