This PR is for debugging the eventual consistency issue and reproduce the error.
This test sends out 100 requests in parallel to create Azure Resource Groups. The test counts how many successful requests were made compared to the failed requests due to providing an invalid secret.
This test can be ran with both app & sp credentials.
Configure the secrets engine with account creds (these creds can be found by logging in to Azure portal (1password) and searching for Team Vault subscription.
To run this test with an app id, you need to register an application in the Azure portal (if you already don’t have one).
App registrations → New registration → Register
You will need to add API permissions to your application. You will need:
Application.ReadWrite.All
GroupMember.ReadWrite.All
Make sure to Grant admin consent for Default Directory
Now go to Team Vault Subscription → Access control (IAM) → Add role assignment → Privileged administrator roles → Select Owner → Go to Members → Select Members → Add the application you just registered → Not constrained Delegation type → Review and assign
There are two ways to configure a role. A role may be set up with either an existing service principal, or a set of Azure roles that will be assigned to a dynamically created service principal.
To configure a role with an already existing service principal, user would have to provide an application_object_id:
I think it's safe to close this PR at this point. This was instrumental in getting us the data points we needed to provide to Microsoft, and may be revisited when a fix is implemented.
This PR is for debugging the eventual consistency issue and reproduce the error.
This test sends out 100 requests in parallel to create Azure Resource Groups. The test counts how many successful requests were made compared to the failed requests due to providing an invalid secret. This test can be ran with both app & sp credentials.
Azure api-docs & docs
Now go to Team Vault Subscription → Access control (IAM) → Add role assignment → Privileged administrator roles → Select Owner → Go to Members → Select Members → Add the application you just registered → Not constrained Delegation type → Review and assign
There are two ways to configure a role. A role may be set up with either an existing service principal, or a set of Azure roles that will be assigned to a dynamically created service principal.
To configure a role with an already existing service principal, user would have to provide an application_object_id: