search

tayganr / purviewcli

Microsoft Purview CLI
https://aka.ms/purviewcli
MIT License
48 stars 27 forks source link

Seems to need to assign Collection admins role to identity #15

Closed nakazax closed 3 years ago

nakazax commented 3 years ago

Issue detail

I've tested with a newly created Purview account on October 21, 2021. Firstly I've assigned Data curators role and Data source admins role to a Service Principal from the Azure portal, and ran pv scan readDatasources for newly created Purview account with the SP, and got the following error message.

$ pv scan readDatasources
[Error]
Access to the requested resource is forbidden (HTTP status code 403).

[Resource]
[GET] https://purview-hinakaza-openhack-mdw.scan.purview.azure.com/datasources

[Response]
{'error': {'code': 'Unauthorized', 'message': 'Not authorized to access account'}}

[Credentials]
{
    "applicationId": "c89381ee-b8ad-4f60-a230-2e083061dc83",
    "objectId": "ab58b655-1a8f-44c5-9ae3-4bc4dfd2c99d",
    "tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47"
}

I've assigned Collection admins role to the SP, and re-ran the command, the command was succeeded.

Idea for modification

From the above, it seems to need to assign Collection admins role to identity executing Azure Purview CLI commands. If true, I think the "Authorization" section in README.md should be modified. https://github.com/tayganr/purviewcli#authorization

Tested version

tayganr commented 3 years ago

Thanks @nakazax . Just updated the README to include the Collection Admin role as a requirement.