bug: Cognitive Services OpenAI User role not assigned to managed identity — 401 on all chat completions
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 58/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- azure
调研方向
定位用于设置容器应用系统分配的托管标识和 AZURE_OPENAI_AUTH=managed-identity 的 Bicep 配置；首先跟踪 Azure OpenAI 资源和容器应用的依赖关系。添加 Cognitive Services OpenAI User 角色分配，并按要求进行排序，然后验证已部署的应用在 RBAC 传播后可以完成聊天请求。
由索引模型根据 Issue 内容生成。
描述
Summary
After a successful devclaw up / devclaw deploy, the container starts and the gateway reports ready — but every chat message fails with a 401. The container app's managed identity is never granted the Cognitive Services OpenAI User role on the Azure OpenAI resource.
Error seen in container logs
[agent/embedded] embedded run agent end: isError=true model=gpt-5.4-mini
error=LLM request failed. rawError=401 The principal `<principalId>` lacks
the required data action `Microsoft.CognitiveServices/accounts/OpenAI/
deployments/chat/completions/action` to perform
`POST /openai/v1/chat/completions` operation.
Steps to reproduce
- Complete
devclaw up(even successfully) - Open the WebChat UI — gateway shows Online, model shows
gpt-5.4-mini - Send any message
- Assistant returns
[assistant turn failed before producing content] - Container logs show 401 on every
/openai/v1/chat/completionscall
Root cause
Same pattern as the AcrPull gap. Bicep configures the container app to use AZURE_OPENAI_AUTH=managed-identity but does not create the Cognitive Services OpenAI User role assignment on the Azure OpenAI resource for the container app's principalId. The gateway has no API key to fall back to (by design), so every model call fails.
Expected behaviour
Bicep should create a Cognitive Services OpenAI User role assignment on the Azure OpenAI resource for the container app's system-assigned managed identity, with correct dependsOn so it is in place before the first request.
Manual workaround
PRINCIPAL_ID=$(az containerapp show -n <app> -g <rg> --query 'identity.principalId' -o tsv)
OPENAI_ID=$(az cognitiveservices account list -g <rg> --query '[0].id' -o tsv)
az role assignment create \
--assignee-object-id $PRINCIPAL_ID \
--assignee-principal-type ServicePrincipal \
--role "Cognitive Services OpenAI User" \
--scope $OPENAI_ID
Note: RBAC propagation takes ~90 seconds after assignment. The gateway does not need to be restarted.
Related
Same root cause as #22 (AcrPull not assigned). Both point to Bicep RBAC sequencing gaps that surface when azd up exits before full propagation.
Environment
- Region:
southindia - Restricted corporate subscription with Azure Policy assignments active
- 主要语言
- Shell
- 星标
- 25
- 派生
- 3
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
microsoft/openclaw-dev 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 85/100
microsoft/openclaw-dev#34 ·
-
bug: BOOTSTRAP.md write fails in ephemeral fallback mode (SKIP_STORAGE=true / no Azure Files mount)未关闭
难度 2/5 1-3 小时 新手友好度 82/100
microsoft/openclaw-dev#24 ·
-
难度 1/5 1 小时以内 新手友好度 88/100
-
难度 1/5 1 小时以内 新手友好度 25/100
microsoft/openclaw-dev#35 ·
-
难度 4/5 3-5 天 新手友好度 55/100
microsoft/openclaw-dev#22 ·
查看 microsoft/openclaw-dev 的全部 Issue
相似的 Issue
-
docs: AGENTS.md has no rule against running deploy scripts into the owner's game install可能已有人在做 @thesprockee 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 85/100
EchoTools/nevr-runtime#524 ·
维护者通常 1 天内回复
-
Install software-properties-common before adding the Suricata PPA可能已有人在做 @himanishpuri 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
Ergane-Foundation/vajra#55 · 2 条评论 ·
维护者通常 2 天内回复
-
[cifuzz] "Minimizing crashes reduces fuzzing time" is logged for every batch run, even with minimize-crashes off可能已有人在做 @martinfrancois 今天认领。 未关闭
难度 1/5 1 小时以内 新手友好度 90/100
维护者通常 1 天内回复
-
enhancement
难度 1/5 1 小时以内 新手友好度 85/100
alunduil/alunduil-chezmoi#914 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 78/100
obra/superpowers#2505 ·
维护者通常 3 天内回复