sql_management endpoint not set error while trying to create service principal against azurestack

[rakku-ms]

This is autogenerated. Please review and update as needed.

Describe the bug

Command Name
az ad sp create-for-rbac

Errors:

PS C:\> az ad sp create-for-rbac --name "testAPP" --role contributor --scopes /subscriptions/3f2f129d-8e17-4e7d-bf3e-69828d77cf27/resourceGroups/gha-lh01-rg --sdk-auth
Changing "testAPP" to a valid URI of "http://testAPP", which is the required format used for service principal names
Found an existing application instance of "86ab05ef-f6c0-4e60-a94c-719bd4f7c9ae". We will patch it
Creating a role assignment under the scope of "/subscriptions/3f2f129d-8e17-4e7d-bf3e-69828d77cf27/resourceGroups/gha-lh01-rg"
  Role assignment already exists.

The endpoint 'sql_management' for this cloud is not set but is used.
C:\Users\rakku\.azure\clouds.config may be corrupt or invalid.
Resolve the error or delete this file and try again.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Connect to 'https://rr1masd.corp.microsoft.com/' vpn
• Run below cmds

$envName = "AzureStackLH"
az cloud register -n $envName --endpoint-resource-manager "https://management.northwest.azs-longhaul-01.selfhost.corp.microsoft.com/"
az cloud set -n $envName
az cloud update --profile '2019-03-01-hybrid'
az login
az ad sp create-for-rbac --name "testAPP" --role contributor --scopes /subscriptions/3f2f129d-8e17-4e7d-bf3e-69828d77cf27/resourceGroups/gha-lh01-rg --sdk-auth

Expected Behavior

• Workaround: set sql-management endpoint using az cloud update cmd.
• Can we allow the sql-management endpoint to be null?

az cloud update -n $envName --endpoint-sql-management https://notsupported
az ad sp create-for-rbac --name "testAPP" --role contributor --scopes /subscriptions/3f2f129d-8e17-4e7d-bf3e-69828d77cf27/resourceGroups/gha-lh01-rg --sdk-auth

Changing "testAPP" to a valid URI of "http://testAPP", which is the required format used for service principal names
Found an existing application instance of "86ab05ef-f6c0-4e60-a94c-719bd4f7c9ae". We will patch it
Creating a role assignment under the scope of "/subscriptions/3f2f129d-8e17-4e7d-bf3e-69828d77cf27/resourceGroups/gha-lh01-rg"
  Role assignment already exists.

{
  "clientId": "<Redacted>",
  "clientSecret": "<Redacted>",
  "subscriptionId": "<Redacted>",
  "tenantId": "<Redacted>",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com/",
  "resourceManagerEndpointUrl": "https://management.northwest.azs-longhaul-01.selfhost.corp.microsoft.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://notsupported",
  "galleryEndpointUrl": "https://providers.azs-long01-int.selfhost.corp.microsoft.com:30016/",
  "managementEndpointUrl": "https://management.northwest.azs-longhaul-01.selfhost.corp.microsoft.com/"
}

Environment Summary

Windows-10-10.0.18362-SP0
Python 3.6.6
Installer: MSI

azure-cli 2.8.0

Additional Context

[yungezz]

hi @fengzhou-msft could you pls help to look at is the endpoint missing in cloud endpoints? thanks

[fengzhou-msft]

@rakku-ms It seems to me that the issue is caused by the endpoints in "https://management.northwest.azs-longhaul-01.selfhost.corp.microsoft.com/" does not contain one for sqlManagementEndpointUrl?

Technically, we can allow sqlManagementEndpointUrl to be null and fall back to use the endpoint in AzureCloud. Can the environment of AzureStackLH access public internet?

[rakku-ms]

@bganapa what's the desired behavior for sqlManagementEndpointUrl? use null or the endpoint of AzureCloud

[fengzhou-msft]

Currently, the behavior in Azure CLI is to use null for all endpoints not set in a cloud. I'm not sure if it will cause trouble to use endpoint of AzureCloud when it's not set.

[bganapa]

@fengzhou-msft / @rakku-ms AzureStack does not support Sql Azure and setting empty or null is the right thing to do. The issue here is though
az ad sp create-for-rbac should not throw an error for sqlManagementEndpointUrl being empty

[fengzhou-msft]

I see, will investigate why it throws the error.