SSO module permissions must be User.Read.All

meshcloud / terraform-azure-meshplatform

Terraform module to integrate Azure as a meshPlatform

Apache License 2.0

2 stars 1 forks source link

SSO module permissions must be User.Read.All #24

Open JohannesRudolph opened 1 year ago

JohannesRudolph commented 1 year ago

Applying this module vanilla fails because User.Read is not a known MS Graph permission

https://github.com/meshcloud/terraform-azure-meshplatform/blob/23e30c9c860303774edf7d4be07c57fe49e247f9/modules/meshcloud-sso/module.tf#L28

The correct one seems to be User.Read.All which also matches instructions at https://docs.meshcloud.io/docs/meshstack.identity-provider.html#azure-ad-aad

JohannesRudolph commented 1 year ago

It also seems that type=Scope is not correct, azure portal does not enable granting admin consent in this case. This can be fixed by changing this to type=Role