az feedback auto-generates most of the information requested below, as of CLI version 2.0.62
Describe the bug
Behavior 1 - sometimes, az login -i works, even though the system assigned identity has been eliminated from the VM.
Behavior 2 - sometimes, az login -i reports that "no access was configured", even though az role assignment list correctly tells me that the id is a subscription owner.
To Reproduce
Sadly, this is very hard to produce. See below for more details.
Expected behavior
Behavior 1 - if the system assigned identity is "switched off", regardless of the history of the VM (had a system assigned id before or not), az login -i should fail.
Behavior 2 - if az role assignment list says the identity is a subscription owner, az login -i should work.
Environment summary
Using a linux Azure VM (Ubuntu 20.04), az 2.25.0, bash.
Additional context
I'm doing lots of az login tests. This is in support of development of a tool that wraps terraform (AzureCAF/rover). Each test starts with a "bootstrap identity", which is a client-id/client-secret spn (subscription owner). It sets up the test scenario by assigning the system-assigned id or creating a user-assigned id, or whatever the case may be. After a few tests, things start going wrong.
Describe the bug
Behavior 1 - sometimes,
az login -iworks, even though the system assigned identity has been eliminated from the VM.Behavior 2 - sometimes,
az login -ireports that "no access was configured", even thoughaz role assignment listcorrectly tells me that the id is a subscription owner.To Reproduce
Sadly, this is very hard to produce. See below for more details.
Expected behavior
Behavior 1 - if the system assigned identity is "switched off", regardless of the history of the VM (had a system assigned id before or not),
az login -ishould fail.Behavior 2 - if
az role assignment listsays the identity is a subscription owner,az login -ishould work.Environment summary
Using a linux Azure VM (Ubuntu 20.04), az 2.25.0, bash.
Additional context
I'm doing lots of
az logintests. This is in support of development of a tool that wraps terraform (AzureCAF/rover). Each test starts with a "bootstrap identity", which is a client-id/client-secret spn (subscription owner). It sets up the test scenario by assigning the system-assigned id or creating a user-assigned id, or whatever the case may be. After a few tests, things start going wrong.