Admin Consent is not working in Cloud Shell

[logachev]

This is autogenerated. Please review and update as needed.

Describe the bug

Command Name
az ad app permission admin-consent

Errors:

400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token
Traceback (most recent call last):
python3.6/site-packages/knack/cli.py, ln 215, in invoke
    cmd_result = self.invocation.execute(args)
cli/core/commands/__init__.py, ln 654, in execute
    raise ex
cli/core/commands/__init__.py, ln 718, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
cli/core/commands/__init__.py, ln 709, in _run_job
    cmd_copy.exception_handler(ex)
...
python3.6/site-packages/msrestazure/azure_active_directory.py, ln 486, in get_msi_token
    result.raise_for_status()
python3.6/site-packages/requests/models.py, ln 940, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Use Cloud Shell to run az cli
• az ad app permission admin-consent --id {}

Expected Behavior

It works as locally

Environment Summary

Linux-4.15.0-1089-azure-x86_64-with-debian-stretch-sid
Python 3.6.10
Installer: DEB

azure-cli 2.8.0

Additional Context

[logachev]

Looks like MSI doesn't like this GUID: https://github.com/Azure/azure-cli/blob/dev/src/azure-cli/azure/cli/command_modules/role/custom.py#L907

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @maertendMSFT.

[yonzhan]

Cloud Shell

[jiasli]

It is a known issue that resource='74658136-14ec-4630-ad9b-26e160ff0fc6' or https://main.iam.ad.ext.azure.com/ is not accepted by Cloud Shell's managed identity. You will need to manually run az login before using this command.

For more information, you could check #9942 (comment).

[maertendMSFT]

This should be fixed now. I cannot repro, please close.

[jiasli]

Hi @maertendMSFT, I am afraid I am still facing this issue:

$ az ad app permission admin-consent --id b9df9246-f8c2-4505-8556-814b7ecc95a9 --debug

Retrieving token for resource 74658136-14ec-4630-ad9b-26e160ff0fc6
urllib3.connectionpool : Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool : http://localhost:50342 "POST /oauth2/token HTTP/1.1" 400 587
msrestazure.azure_active_directory : MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': '74658136-14ec-4630-ad9b-26e160ff0fc6'}
msrestazure.azure_active_directory : MSI: Failed to retrieve a token from 'http://localhost:50342/oauth2/token' with an error of '400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token'. This could be caused by the MSI extension not yet fully provisioned.

The command failed with an unexpected error. Here is the traceback:

400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token
Traceback (most recent call last):
  File "/opt/az/lib/python3.6/site-packages/knack/cli.py", line 215, in invoke
    cmd_result = self.invocation.execute(args)
  ...
  File "/opt/az/lib/python3.6/site-packages/requests/models.py", line 940, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token

It looks like resource ID 74658136-14ec-4630-ad9b-26e160ff0fc6 is still not allowed by Cloud Shell.

https://github.com/Azure/azure-cli/blob/82adb273120968a85b973c9c84f90c205e355362/src/azure-cli/azure/cli/command_modules/role/custom.py#L929