microsoftgraph / msgraph-sdk-go

Microsoft Graph SDK for Go
https://docs.microsoft.com/en-us/graph/sdks/sdks-overview
MIT License
214 stars 32 forks source link

Creating Applications with Federated Credentials results in duplicate App Registrations #741

Open Benmartin92 opened 6 days ago

Benmartin92 commented 6 days ago

Describe the bug

I am trying to create an App Registration via GraphServiceClient with a Federated Credential:

func (c *Client) CreateServicePrincipal() (string, error) {
    appRequestBody := graphmodels.NewApplication()
    name := "ben-test-123"
    appRequestBody.SetDisplayName(&name)
    federatedCredential := graphmodels.NewFederatedIdentityCredential()
    issuer := "https://my-issuer.com/oidc"
    federatedCredential.SetIssuer(&issuer)
    audience := "123"
    federatedCredential.SetAudiences([]string{audience})
    sub := "123"
    federatedCredential.SetSubject(&sub)
    fname := "test"
    federatedCredential.SetName(&fname)
    appRequestBody.SetFederatedIdentityCredentials([]graphmodels.FederatedIdentityCredentialable{federatedCredential})
    applications, err := c.graphClient.Applications().Post(context.Background(), appRequestBody, nil)
    if err != nil {
        return "", err
    }
    return *applications.GetAppId(), nil
}

Executing this code results in an error returned by graphClient: Encountered an internal server error. What is more interesting is that even though the client returned an error, the App Registration is created two times with the same name (the Federated Credential is populated fine in both instances).

Simply commenting out the line:

appRequestBody.SetFederatedIdentityCredentials([]graphmodels.FederatedIdentityCredentialable{federatedCredential})

and executing the code again works as expected: a single instance of App Registration (obviously without the Federated Credential) is created and client returns nil error.

Therefore, I strongly suspect that this issue is related to how Federated Credentials are handled in App Registrations.

Expected behavior

The expected behaviour is that only a single instance is created with the Federated Credentials populated. The graphClient should return a nil error, and CreateServicePrincipal() should return the Application (client) ID.

How to reproduce

Just execute the above sample code.

SDK Version

v1.45.0

Latest version known to work for scenario above?

No response

Known Workarounds

I tried to workaround the issue by first creating the application without Federated Credentials and then patching it with Federated Credentials. However, the patching request with Federated Credentials fails with the same error: Encountered an internal server error, and the Federated Credential was not added to the App Registration.

Debug output

Click to expand log ``` ```

Configuration

Apple M1 Pro with 14.5 (23F79) OS version, and with Go version 1.21.

Other information

No response