search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.24k stars 21.41k forks source link

AppRole value should not contain spaces #22360

Open thomasdc opened 5 years ago

thomasdc commented 5 years ago

It took me a while to realize that adding an AppRole with a value containing spaces is NOT allowed. It will give you the following error when you try to save the Manifest: "Failed to update application .... Error details: One or more properties contains invalid values.".

Please document this.

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

MarileeTurscak-MSFT commented 5 years ago

@thomasdc Thanks for your feedback! We will investigate and update as appropriate.

jgmicallef commented 5 years ago

Can confirm this is correct, I get Error details: Request_BadRequest when ever the value has a space in it. Will this limitation get fixed in a future Azure release?

kalyankrishna1 commented 5 years ago

Changes pushed to PR -https://github.com/MicrosoftDocs/azure-docs-pr/pull/75185

tfosmark commented 5 years ago

@thomasdc The change has been submitted for publication and will be live on May 6. Thank you!

vsdotnetguy commented 2 years ago

@tfosmark Can this issue be reopened as the exact same issue is happening with AD B2C Applications where AppRole.Value contains spaces? It occurs whether editing the manifest manually or using MS Graph. Once I removed the space from the value, the MS Graph Application UpdateAsync worked without error.

MicrosoftGuyJFlo commented 2 years ago

@kalyankrishna1 can you provide any feedback on this issue?

antoineozenne commented 2 years ago

Same issue for me. Some applications use spaces in their role names (MongoDB Atlas for example). Therefore, we cannot take full advantage of the mapping with Azure. It's even more frustrating when using Terraform.

wpinegar commented 2 years ago

We can confirm that this problem still exists. We need a way to send role claims for Azure SAML apps with spaces in the role value. Some apps that we are using need spaces in the values in the role claims. Is there a supported method to accomplish this?

pkrumwiedePX commented 1 year ago

@kalyankrishna1 Is there any update to this ticket? This is still an issue where the role claims cant contain spaces.

wpinegar commented 1 year ago

The only fix we have found for this is to create the AD groups as mail enabled groups (limitation at our company), sync the groups with Azure and then setup the SAML role claim to use SAMAccountName as the role names. That works perfectly for roles that need embedded spaces. Nested groups aren't supported in this configuration. Nothing else works. I have no idea why the Azure team designed it this way.

Seems to be a known issue.

cilwerner commented 1 year ago

@kalyankrishna1, @wpinegar has this issue been addressed in another PR which can be linked?

chris-zenfolio commented 6 months ago

I am running into this same issue trying to set up New Relic to use App Roles for permissions. The workaround (as suggested by New Relic) is to use a user property like "Job Title" and map it to their property that defines the user type. However, this is not a viable workaround because that is specifically a user-centric solution. New Relic's user types (that I control the licensing with) are Basic User, Core User, or Full User. Because of the spaces, I cannot leverage the app roles. Suggestions to work around?

chris-zenfolio commented 6 months ago

Because of the specific New Relic user types, I was able to make 3 app roles with Name:Values of Basic User:Basic, Core User:Core, and Full User:Full. Then I used the following expression SingleAppRoleAssignment([appRoleAssignments]) to get the result I want. This function returned the name (not value) of the role. It only works if there is a single app role assigned. It's a kludgey workaround when compared to a direct assignment.

wpinegar commented 6 months ago

When we researched this a few years back, it appears that the almost universal fix was to setup the AD groups as OnPrem groups in Active Directory. Those groups can contain spaces and then you sync those groups with Azure. You can use the synced AD groups, which contain spaces, as Roles within the SAML claim.

That's what we are doing for any SAML claims where the roles need to contain spaces. Unfortunately you have to name the OnPrem groups exactly what the app expects the role name to be, but so far it's worked out fine.