ServicePrincipal ID: the number of segments didn't match

thomasteoh commented 1 month ago

Is there an existing issue for this?

[X] I have searched the existing issues

Community Note

Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.9.7

AzureRM Provider Version

4.4.0

Affected Resource(s)/Data Source(s)

azuread_service_principal, azuread_service_principal_password

Terraform Configuration Files

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "4.4.0"
    }
  }
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  resource_provider_registrations = "none" # This is only required when the User, Service Principal, or Identity running Terraform lacks the permissions to register Azure Resource Providers.
  features {}
  subscription_id = "<redacted>"
}

# Access configuration of the AzureRM provider
data "azurerm_client_config" "current" {
}

resource "azuread_application_registration" "ent_main" {
  display_name     = "Example Application"
  description      = "My example application"
  sign_in_audience = "AzureADMyOrg"

  homepage_url          = "https://app.hashitown.com/"
  logout_url            = "https://app.hashitown.com/logout"
  marketing_url         = "https://hashitown.com/"
  privacy_statement_url = "https://hashitown.com/privacy"
  support_url           = "https://support.hashitown.com/"
  terms_of_service_url  = "https://hashitown.com/terms"
}

data "azuread_application_published_app_ids" "well_known" {}

data "azuread_service_principal" "msgraph" {
  client_id = data.azuread_application_published_app_ids.well_known.result["MicrosoftGraph"]
}

resource "azuread_service_principal" "ent_main" {
  client_id    = azuread_application_registration.ent_main.client_id
  owners       = [data.azurerm_client_config.current.object_id]
  use_existing = true
}

resource "azuread_service_principal_password" "ent_main_secret" {
  service_principal_id = azuread_service_principal.ent_main.object_id
}

Debug Output/Panic Output

Error: parsing "2eadfd87-945c-4e78-bbbd-fed4496fb0d9": parsing the ServicePrincipal ID: the number of segments didn't match
│ 
│ Expected a ServicePrincipal ID that matched (containing 2 segments):
│ 
│ > /servicePrincipals/servicePrincipalId
│ 
│ However this value was provided (which was parsed into 0 segments):
│ 
│ > 2eadfd87-945c-4e78-bbbd-fed4496fb0d9
│ 
│ The following Segments are expected:
│ 
│ * Segment 0 - this should be the literal value "servicePrincipals"
│ * Segment 1 - this should be the user specified value for this servicePrincipalId [for example "servicePrincipalId"]
│ 
│ The following Segments were parsed:
│ 
│ * Segment 0 - not found
│ * Segment 1 - not found
│ 
│ 
│   with azuread_service_principal_password.ent_main_secret,
│   on temp.tf line 47, in resource "azuread_service_principal_password" "ent_main_secret":
│   47:   service_principal_id = azuread_service_principal.ent_main.object_id

Expected Behaviour

Either the ServicePrincipalId was produced with the number of segments expected by azuread_service_principal_password or the azuread_service_principal_password expects or handles just the objectid of the service principal

Actual Behaviour

Error, number of segments not matching

Steps to Reproduce

terraform apply

Important Factoids

No response

References

Possibly related to other issues from the SDK update hashicorp/terraform-provider-azurerm#27461

rcskosir commented 1 month ago

Thank you for taking the time to open this issue. I am going to move it over to the Terraform AzureAD Repo since that is where these resources are found.

mablouin commented 1 month ago

The new doc shows that it now expects the actual service principal ID but this breaking change is not documented anywhere in the upgrade guide.

resource "azuread_application" "example" {
  display_name = "example"
}

resource "azuread_service_principal" "example" {
  client_id = azuread_application.example.client_id
}

resource "azuread_service_principal_password" "example" {
  service_principal_id = azuread_service_principal.example.id
}

thomasteoh commented 1 month ago

The new doc shows that it now expects the actual service principal ID but this breaking change is not documented anywhere in the upgrade guide.
resource "azuread_application" "example" {
  display_name = "example"
}

resource "azuread_service_principal" "example" {
  client_id = azuread_application.example.client_id
}

resource "azuread_service_principal_password" "example" {
  service_principal_id = azuread_service_principal.example.id
}

Thanks @mablouin - this has fixed the issue for me!

mloskot commented 3 weeks ago

FYA, this PR was merged on Sep 27 updates the usage examples in the documentation:

https://github.com/hashicorp/terraform-provider-azuread/pull/1499

hashicorp / terraform-provider-azuread