Open QBY-ChristianHartmann opened 4 months ago
@QBY-ChristianHartmann
Following is the code where these two fields are applied in the provider:
This is apparently a bug ☝️
This LGTM..
Following is the code where these two fields are read in the provider:
These also LGTM (except the case sensitive quality, but should be fine)
Would mind run terraform plan/apply
with TF_LOG=DEBUG
, and inspect the actual response returned from the API for the properties.domainConfigurationType
, and check whether when you apply, it is set as ResourceTrusting
, while on read it returns FullySynced
.
Hi @magodo,
it seems to be a problems from the API. The request includes the correct input "ResourceTrusting", but the 201 answer shows "FullySynced".
2024-04-12T08:52:27.484+0200 [DEBUG] provider.terraform-provider-azurerm_v3.98.0_x5.exe: AzureRM Request:
PUT /subscriptions/<subscriptionID>/resourceGroups/rg-EntraDomainServices-dev-01/providers/Microsoft.AAD/domainServices/<tenantID>.onmicrosoft.com?api-version=2021-05-01 HTTP/1.1
Host: management.azure.com
User-Agent: HashiCorp/go-azure-sdk (Go-http-Client/1.1 domainservices/2021-05-01) HashiCorp Terraform/1.7.3 (+https://www.terraform.io) Terraform Plugin SDK/2.10.1 terraform-provider-azurerm/3.98.0 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
Content-Length: 834
Content-Type: application/json; charset=utf-8
X-Ms-Correlation-Request-Id: 36fbaa54-bf05-949b-a27b-b0366c48951f
Accept-Encoding: gzip
{"location":"westeurope","properties":{"domainConfigurationType":"ResourceTrusting","domainName":"<tenantID>.onmicrosoft.com","domainSecuritySettings":{"kerberosArmoring":"Disabled","kerberosRc4Encryption":"Disabled","ntlmV1":"Disabled","syncKerberosPasswords":"Enabled","syncNtlmPasswords":"Enabled","syncOnPremPasswords":"Enabled","tlsV1":"Disabled"},"filteredSync":"Disabled","ldapsSettings":{"ldaps":"Disabled"},"notificationSettings":{"additionalRecipients":[],"notifyDcAdmins":"Enabled","notifyGlobalAdmins":"Enabled"},"replicaSets":[{"location":"westeurope","subnetId":"/subscriptions/<subscriptionID>/resourceGroups/rg-EntraDomainServices-dev-01/providers/Microsoft.Network/virtualNetworks/vnet-10-0-0-0-16-westeurope/subnets/snet-10-0-1-0-24-EDS"}],"sku":"Enterprise"},"tags":{"Environment":"dev"}}: timestamp="2024-04-12T08:52:27.483+0200"
2024-04-12T08:52:27.484+0200 [DEBUG] provider.terraform-provider-azurerm_v3.98.0_x5.exe: PUT https://management.azure.com/subscriptions/<subscriptionID>/resourceGroups/rg-EntraDomainServices-dev-01/providers/Microsoft.AAD/domainServices/<tenantID>.onmicrosoft.com?api-version=2021-05-01: timestamp="2024-04-12T08:52:27.483+0200"
2024-04-12T08:52:41.129+0200 [DEBUG] provider.terraform-provider-azurerm_v3.98.0_x5.exe: AzureRM Response for https://management.azure.com/subscriptions/<subscriptionID>/resourceGroups/rg-EntraDomainServices-dev-01/providers/Microsoft.AAD/domainServices/<tenantID>.onmicrosoft.com?api-version=2021-05-01:
HTTP/2.0 201 Created
Content-Length: 1471
Azure-Asyncoperation: https://management.azure.com/subscriptions/<subscriptionID>/providers/Microsoft.AAD/locations/westeurope/operationResults/7992bb03-494d-4cde-845f-3ea3ad23291f?api-version=2021-05-01&t=
Cache-Control: no-cache
Content-Type: application/json; charset=utf-8
Date: Fri, 12 Apr 2024 06:52:40 GMT
Etag: W/"datetime'2024-04-12T06%3A52%3A29.9192534Z'"
Expires: -1
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Ms-Correlation-Request-Id: 36fbaa54-bf05-949b-a27b-b0366c48951f
X-Ms-Ratelimit-Remaining-Subscription-Writes: 1199
X-Ms-Request-Id: 61798f5d-580d-4a3e-9a50-c6942cc53836
X-Ms-Routing-Request-Id: FRANCESOUTH:20240412T065241Z:b1e7609b-6663-49ce-9ca0-6ea17f350354
{"id":"/subscriptions/<subscriptionID>/resourceGroups/rg-EntraDomainServices-dev-01/providers/Microsoft.AAD/domainServices/<tenantID>.onmicrosoft.com","name":"<tenantID>.onmicrosoft.com","type":"Microsoft.AAD/domainServices","etag":"W/\"datetime'2024-04-12T06%3A52%3A29.9192534Z'\"","location":"westeurope","tags":{"Environment":"dev"},"properties":{"version":2,"tenantId":"<TenantId>","domainName":"<tenantID>.onmicrosoft.com","deploymentId":"b9f5035c-c4be-4d23-acf4-1b654a798186","syncOwner":"b9f5035c-c4be-4d23-acf4-1b654a798186","replicaSets":[{"replicaSetId":"b9f5035c-c4be-4d23-acf4-1b654a798186","location":"West Europe","subnetId":"/subscriptions/<subscriptionID>/resourceGroups/rg-EntraDomainServices-dev-01/providers/Microsoft.Network/virtualNetworks/vnet-10-0-0-0-16-westeurope/subnets/snet-10-0-1-0-24-EDS"}],"ldapsSettings":{"ldaps":"Disabled","certificateNotAfter":"0001-01-01T08:00:00Z","externalAccess":"Disabled"},"domainSecuritySettings":{"ntlmV1":"Disabled","tlsV1":"Disabled","syncNtlmPasswords":"Enabled","syncKerberosPasswords":"Enabled","syncOnPremPasswords":"Enabled","kerberosRc4Encryption":"Disabled","kerberosArmoring":"Disabled"},"filteredSync":"Disabled","domainConfigurationType":"FullySynced","notificationSettings":{"notifyGlobalAdmins":"Enabled","notifyDcAdmins":"Enabled","additionalRecipients":[]},"sku":"Enterprise","provisioningState":"Creating"}}: timestamp="2024-04-12T08:52:41.129+0200"
@QBY-ChristianHartmann In this case, you can submit an Azure support ticket, with the X-Ms-Correlation-Request-Id
.
Is there an existing issue for this?
Community Note
Terraform Version
1.7.3
AzureRM Provider Version
3.98.0
Affected Resource(s)/Data Source(s)
azurerm_active_directory_domain_service
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
Microsoft Entra Domain Services is deployed with domain_configuration_type = "ResourceTrusting", filtered_sync_enabled = true. ``
Actual Behaviour
Microsoft Entra Domain Services is deployed with domain_configuration_type = "FullySynced ", filtered_sync_enabled = false. Another terraform apply shows that the Domain services must be replaced since the domain_configuration_type in the terraform code is different than the actual deployed configuration. Plan after apply: resource "azurerm_active_directory_domain_service" "eds" { ~ deployment_id = "90fdfb16-de88-4e98-849a-3a03605896fe" -> (known after apply) ~ domain_configuration_type = "FullySynced" -> "ResourceTrusting" # forces replacement ~ filtered_sync_enabled = false -> true
Steps to Reproduce
Important Factoids
No response
References
No response