search

hashicorp / go-azure-helpers

This repository contains various helpers and wrappers for working with Azure and the Azure SDK for Go.
Mozilla Public License 2.0
58 stars 44 forks source link

Azure CLI Tokens + Azure Stack Terraform Provider in ADFS/Disconnected mode #28

Open jbpaux opened 5 years ago

jbpaux commented 5 years ago

Hello, I'm struggling in authenticate in an ADFS Disconnected Azure Stack with Azure Stack Terraform Provider using Azure CLI Tokens.

Versions:

Steps performed:

2019-06-20T11:38:45.076+0200 [DEBUG] plugin.terraform-provider-azurestack: 2019/06/20 11:38:45 Testing if Service Principal / Client Certificate is applicable for Authentication.. 2019-06-20T11:38:45.076+0200 [DEBUG] plugin.terraform-provider-azurestack: 2019/06/20 11:38:45 Testing if Service Principal / Client Secret is applicable for Authentication.. 2019-06-20T11:38:45.076+0200 [DEBUG] plugin.terraform-provider-azurestack: 2019/06/20 11:38:45 Testing if Managed Service Identity is applicable for Authentication.. 2019-06-20T11:38:45.076+0200 [DEBUG] plugin.terraform-provider-azurestack: 2019/06/20 11:38:45 Testing if Obtaining a token from the Azure CLI is applicable for Authentication.. 2019-06-20T11:38:45.076+0200 [DEBUG] plugin.terraform-provider-azurestack: 2019/06/20 11:38:45 Using Obtaining a token from the Azure CLI for Authentication 2019-06-20T11:38:45.077+0200 [DEBUG] plugin.terraform-provider-azurestack: 2019/06/20 11:38:45 [DEBUG] Resource "https://management.adfs.azstack.local/4851e0c9-ca1e-405e-9589-976d89f72324" isn't for the correct Tenant 2019/06/20 11:38:45 [ERROR] : eval: terraform.EvalConfigProvider, err: Error building ARM Client: Error populating Client ID from the Azure CLI: No Authorization Tokens were found - please re-authenticate using az login. 2019/06/20 11:38:45 [ERROR] : eval: terraform.EvalSequence, err: Error building ARM Client: Error populating Client ID from the Azure CLI: No Authorization Tokens were found - please re-authenticate using az login. 2019/06/20 11:38:45 [ERROR] : eval: terraform.EvalOpFilter, err: Error building ARM Client: Error populating Client ID from the Azure CLI: No Authorization Tokens were found - please re-authenticate using az login. 2019/06/20 11:38:45 [ERROR] : eval: terraform.EvalSequence, err: Error building ARM Client: Error populating Client ID from the Azure CLI: No Authorization Tokens were found - please re-authenticate using az login.

Tenant id is correct. I don't know why it add https://management.adfs.azstack.local/ in front of it but why not.

jbpaux commented 5 years ago

Ok I think I figured it out. In the token, the Autority ends with / like in my case https://adfs.region.fqdn/tenantid/ while in the code it's looking as only the tenant id as suffix: https://github.com/hashicorp/go-azure-helpers/blob/5e51ac013932f1c9434224349e74d77be738739c/authentication/azure_cli_access_token.go#L29

jbpaux commented 5 years ago

@tombuildsstuff if you can have a look ;)

jbpaux commented 5 years ago

It may be related to this also. Azure cli remove the tenantid in the stored token :( https://github.com/Azure/azure-cli/issues/9779

Matt45D commented 4 years ago

Any update on this issue? I running into this exact issue with my connected ADFS Azure Stack environment.