How to grant TrustFrameworkKeySet.Read.All to az cli

Describe the bug

Command Name az rest

Errors:

Forbidden({"error":{"code":"AADB2C","message":"The application does not have any of the required delegated permissions (TrustFrameworkKeySet.Read.All, TrustFrameworkKeySet.ReadWrite.All) to access the resource. ","innerError":{"correlationId":"e3062914-8c45-4904-a81d-7a8dc518323d","date":"2022-06-07T05:34:40","request-id":"fc0244a4-d8d7-4a3d-9f12-b81291542503","client-request-id":"fc0244a4-d8d7-4a3d-9f12-b81291542503"}}})

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az rest --method get --url https://graph.microsoft.com/beta/trustFramework/keySets

Expected Behavior

az cli can retrieve the keyset

Environment Summary

Linux-5.10.102.1-microsoft-standard-WSL2-x86_64-with-glibc2.31, Ubuntu 20.04 LTS
Python 3.10.4
Installer: DEB

azure-cli 2.37.0

Extensions:
containerapp 0.2.0
spring-cloud 2.11.2

Dependencies:
msal 1.18.0b1
azure-mgmt-resource 21.1.0b1

Additional Context

The following commands can be executed successfully.

az rest --method get --url https://graph.microsoft.com/v1.0/applications

[jiasli]

For above options, we did some internal discussion:

1. Applying for TrustFrameworkKeySet.Read.All, TrustFrameworkKeySet.ReadWrite.All delegated permissions is certainly not an easy task for us. We need to work with security team, PM team, and AAD team to review the business justification and go through multiple approvals.

2. Supporting custom client ID will also take some time for development. For now, I think the best shot you can take is to

   1. Create your own AAD application
   2. Grant it TrustFrameworkKeySet.Read.All, TrustFrameworkKeySet.ReadWrite.All delegated permissions
   3. Replace Azure CLI’s client ID at /opt/az/lib/python3.10/site-packages/azure/cli/core/auth/identity.py Line 22 with your own application ID: https://github.com/Azure/azure-cli/blob/1d973cceb38980181eeaa45934497d2148a3e7b2/src/azure-cli-core/azure/cli/core/auth/identity.py#L22

   but this is very hacky and we don’t officially support it.

Workaround

A third option is not to use user identity to log in at all. Instead,

1. Create a service principal
2. Grant it TrustFrameworkKeySet.Read.All, TrustFrameworkKeySet.ReadWrite.All application permissions
3. Log in with that service principal

[m-moris]

Thanks for the discussion.

Indeed, I too think we should be cautious about granting for any authority to az cli tools. I decided to use a workaround and have already written an automated script. This is a bit of a pain to manage the secret, though.