yonzhan
commented
1 year ago Thank you for opening this issue, we will look into it.
Open TheOnlyWei opened 1 year ago
yonzhan
commented
1 year ago Thank you for opening this issue, we will look into it.
msyyc
commented
1 year ago 
jiasli
commented
1 year ago I am able to repo by running following commands:
> az cloud set --name azurecloud --profile 2020-09-01-hybrid
> az role assignment create --assignee-object-id 7a938a30-4226-420e-996f-4d48bca6d537 --scope /subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590 --role reader --debug
Message: PASRP RoleAssignment request is malformed
az_command_data_logger: (MalformedRoleAssignmentRequest) PASRP RoleAssignment request is malformedThe difference in SDK models from different API versions comes from different x-ms-client-flatten definition.
In 2015-07-01, properties is not flattened, so RoleAssignmentProperties is exposed in the SDK:
"RoleAssignmentCreateParameters": {
"properties": {
"properties": {
"$ref": "#/definitions/RoleAssignmentProperties",
"description": "Role assignment properties."
}
},But in 2022-04-01, properties is flattened, so RoleAssignmentProperties is not exposed in the SDK:
"RoleAssignmentCreateParameters": {
"properties": {
"properties": {
"x-ms-client-flatten": true,
"$ref": "#/definitions/RoleAssignmentProperties",
"description": "Role assignment properties."
}
},Considering following calling pattern:
parameters properties attributes
create ----> RoleAssignmentCreateParameters ----> RoleAssignmentProperties ----> roleDefinitionId, principalIdIn Track 1 SDK, RoleAssignmentProperties is directly passed into create method via properties arg. (parameters is flattened out by code-gen.)
def create(
self, scope, role_assignment_name, properties, custom_headers=None, raw=False, **operation_config):
:param properties: Role assignment properties.
:type properties:
~azure.mgmt.authorization.v2015_07_01.models.RoleAssignmentPropertiesHowever, in Track 2 SDK and newer API versions, RoleAssignmentCreateParameters is passed into create method via parameters arg. (properties is flattened out by the model.)
def create(
self,
scope: str,
role_assignment_name: str,
parameters: Union[_models.RoleAssignmentCreateParameters, IO],
**kwargs: Any
) -> _models.RoleAssignment:This is due to a behavior change in very old versions of code-gen: If RoleAssignmentCreateParameters contains only a few attributes, then these attributes are flattened into the method. In this case, RoleAssignmentCreateParameters only has one attribute - properties, so properties is extracted to the create method. Later on, code-gen dropped this behavior and preserves parameters as is. Meanwhile, newer API flattens RoleAssignmentProperties but 2015-07-01 doesn’t.
This breaking change in create's calling pattern causes this failure during azure-mgmt-authorization's Track2 migration: https://github.com/Azure/azure-cli/pull/25452.
We explicitly called out in our public doc that the latest az role and az ad command groups no longer work with Azure Stack: https://learn.microsoft.com/en-us/cli/azure/microsoft-graph-migration#known-issues
Microsoft Graph related commands like az ad and az role will fail in Azure Stack environments which don't have Microsoft Graph support. Please use Azure CLI 2.36.0 or earlier versions for Azure Stack environments.
Command Name
az role assignment createDescribe the bug This issue is related to this one I filed for azure-sdk-for-python: https://github.com/Azure/azure-sdk-for-python/issues/30256
This comment from Azure Python SDK team says Azure CLI is not using Python SDK model correctly for
az role assignment createcommands (and possibly other commands, but I am only aware of this command currently): https://github.com/Azure/azure-sdk-for-python/issues/30256#issuecomment-1537036568For example, in the following code: https://github.com/Azure/azure-cli/blob/57b3fe1f115e4a32a4ef0c6bbf2c31e3d0588a33/src/azure-cli/azure/cli/command_modules/role/_multi_api_adaptor.py#L53
Python Azure SDK team from the above linked comment says the call for
RoleAssignmentCreateParametersfor an old API such as 2015-07-01 should look like the following instead:For reference, this is the
ResourceType.MGMT_AUTHORIZATIONSDK profile currently in the Azure CLI code: https://github.com/Azure/azure-cli/blob/57b3fe1f115e4a32a4ef0c6bbf2c31e3d0588a33/src/azure-cli-core/azure/cli/core/profiles/_shared.py#L287The Microsoft.Authorization 2015-07-01 API version contract: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/authorization/resource-manager/Microsoft.Authorization/stable/2015-07-01
Note that this issue was discovered on Azure Stack Hub AAD environment. I tested the same commands on an ADFS environment and did not run into this issue, so there are likely diverging code flows between AAD and ADFS environments for the commands related to this issue.
Errors:
To Reproduce Example step to reproduce one of the issues:
Register Azure CLI cloud against 2020-09-01-hybrid profile. PowerShell example:
Set Azure CLI cloud to the profile registered in step 1 and log in.
Run an
az role assignment createcommand.Expected behavior Should not throw an error.
Environment summary