azure cli not supported for keyvault? about azure

[jfreeland]

If I had time, I might. I'd strongly prefer to have someone from Microsoft who is incentivized to have paying customers use their products fix it.

[jfreeland]

would love to have a fix here.

[stingpan]

I'm also trying to log in with azure-cli and getting this same error about the client_id despite setting auth_source: "cli".
I would also prefer to log in with azure login so I don't have to worry about storing the Service Principal's credentials locally.

[andrejbrummelhuis]

Wasted a lot of time on this today. Looking at the documentation you expect that this would work but it does not. One year later still no fix in sight? At least remove it from the documentation.

[pierreyvesv]

Hello,
I have update to "azure.azcollection:1.7.0" and my use case still have the issue as well:
#134 (comment)

[Fred-sun]

@rkno82 Thank you for your report, we will investigate and solve your problems as soon as possible. Thank you!

[joaocc]

Hi. Any news on this ticket? I am also facing this issue on ansible 2.10.4.
We have a workaround, but would prefer to be able to use azure-cli external auth to keep playbooks cleaner.

• create a Security Principal
• add credentials to ~/.azure/credentials, either in [default] or [some-sp-profile-name]
• specifying profile: as parameter will get this to work

    azure_rm_keyvaultsecret_info:
        name:   "testsecret"
        profile: "some-sp-profile-name"

Despite working, this takes around 30z-40s to run (comparing to <2s from azure-cli on same machine and same auth), but prob this is a separate ticket.

[pinkgizmo]

It seems the same behaviour occurs with the azure.azcollection.azure_rm_keyvaultsecret plugin. The azure cli is not supported.

[Fiury00]

Are there any plans to get Azure CLI working with all modules i.e. the kv ones?

[pierreyvesv]

Hello,
here is a working example for authentication, but unfortunately as you can see in the result below it provides an empty output.

my azure cli version is 2.25.0
ansible version: 2.10.7
ansible collection requirement have been installed from https://github.com/ansible-collections/azure/blob/dev/requirements-azure.txt

Below is an authentication with a service principal be sure to not add any extra parameter related to Active Directory or the connection will fail

  azure.azcollection.azure_rm_keyvaultsecret_info:
    name: "azure_rm_keyvaultsecret_info"
    vault_uri: "{{ key_vault_URI }}"
    secret: "{{ AZURE_SECRET }}"
    tenant: "{{ AZURE_TENANT }}"
    subscription_id: "{{ AZURE_SUBSCRIPTION_IDP }}"
    client_id: "{{ AZURE_CLIENT_ID }}"
  register: result

output shows empty secret list:

ok: [localhost] => {
    "changed": false,
    "invocation": {
        "module_args": {
            "ad_user": null,
            "adfs_authority_url": null,
            "api_profile": "latest",
            "auth_source": "auto",
            "cert_validation_mode": null,
            "client_id": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "cloud_environment": "AzureCloud",
            "name": "azure_rm_keyvaultsecret_info",
            "password": null,
            "profile": null,
            "secret": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "show_deleted_secret": false,
            "subscription_id": "xxx-xxx-xxx-xxx-xxx",
            "tenant": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "vault_uri": "https://myvault.vault.azure.net/",
            "version": "current"
        }
    },
    "secrets": []
}

[saulobejo]

Same problem. Can the priority be bumped?

[Fred-sun]

@rkno82 @saulobejo It should be your credential permissions problem, or account problem. This should have been fixed. Can you upgrade to the latest version of Azure collection? Thank you very much!

Upgrade method:
ansible-galaxy collection install azure.azcollection --force

Get info:
        "secrets": [
            {
                "attributes": {
                    "created": "2021-07-01T01:16:55+00:00",
                    "enabled": true,
                    "expires": null,
                    "not_before": null,
                    "recovery_level": "Recoverable+Purgeable",
                    "updated": "2021-07-01T01:16:55+00:00"
                },
                "content_type": "Content Type Secret",
                "secret": "mysecret",
                "sid": "https://xxxxx.vault.azure.net/secrets/testsecret/xxxx",
                "tags": {
                    "delete": "on-exit",
                    "testing": "test"
                },
                "version": "xxxx8"
            }
        ]

[saulobejo]

@Fred-sun I've tried upgrading but I was already using version 1.7.

My code:

- name: Azure secrets - Get secret password
  azure.azcollection.azure_rm_keyvaultsecret_info:
    vault_uri: "{{ vault_uri }}"
    name: "{{ secret_name_password }}"
    subscription_id: "{{ subscription_id }}"
    tenant: "{{ tenant }}"
    auth_source: "cli"

The error remains.

fatal: [my_hostname -> localhost]: FAILED! => {"changed": false, "module_stderr": "Your credentials class does not support session injection. Performance will not be at the maximum.
Traceback (most recent call last):
  File "/root/.ansible/tmp/ansible-tmp-1625127055.925299-13708-188297723953357/AnsiballZ_azure_rm_keyvaultsecret_info.py", line 100, in <module>
    _ansiballz_main()
  File "/root/.ansible/tmp/ansible-tmp-1625127055.925299-13708-188297723953357/AnsiballZ_azure_rm_keyvaultsecret_info.py", line 92, in _ansiballz_main
    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
  File "/root/.ansible/tmp/ansible-tmp-1625127055.925299-13708-188297723953357/AnsiballZ_azure_rm_keyvaultsecret_info.py", line 40, in invoke_module
    runpy.run_module(mod_name='ansible_collections.azure.azcollection.plugins.modules.azure_rm_keyvaultsecret_info', init_globals=dict(_module_fqn='ansible_collections.azure.azcollection.plugins.modules.azure_rm_keyvaultsecret_info', _modlib_path=modlib_path),
  File "/usr/lib/python3.8/runpy.py", line 207, in run_module
    return _run_module_code(code, init_globals, run_name, mod_spec)
  File "/usr/lib/python3.8/runpy.py", line 97, in _run_module_code
    _run_code(code, mod_globals, init_globals,
  File "/usr/lib/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 430, in <module>
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 426, in main
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 236, in __init__
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py", line 466, in __init__
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 257, in exec_module
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 312, in get_secret
  File "/usr/local/lib/python3.8/dist-packages/azure/keyvault/key_vault_client.py", line 1795, in get_secret
    response = self._client.send(request, header_parameters, **operation_config)
  File "/usr/local/lib/python3.8/dist-packages/msrest/service_client.py", line 336, in send
    pipeline_response = self.config.pipeline.run(request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/pipeline/__init__.py", line 197, in run
    return first_node.send(pipeline_request, **kwargs)  # type: ignore
  File "/usr/local/lib/python3.8/dist-packages/msrest/pipeline/__init__.py", line 150, in send
    response = self.next.send(request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/pipeline/requests.py", line 72, in send
    return self.next.send(request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/pipeline/requests.py", line 137, in send
    return self.next.send(request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/pipeline/__init__.py", line 150, in send
    response = self.next.send(request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/pipeline/requests.py", line 193, in send
    self.driver.send(request.http_request, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/universal_http/requests.py", line 333, in send
    return super(RequestsHTTPSender, self).send(request, **requests_kwargs)
  File "/usr/local/lib/python3.8/dist-packages/msrest/universal_http/requests.py", line 139, in send
    response = session.request(
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 533, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 653, in send
    r = dispatch_hook('response', hooks, r, **kwargs)
  File "/usr/lib/python3/dist-packages/requests/hooks.py", line 31, in dispatch_hook
    _hook_data = hook(hook_data, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/azure/keyvault/custom/key_vault_authentication.py", line 146, in _handle_401
    security = self._get_message_security(prep, challenge)
  File "/usr/local/lib/python3.8/dist-packages/azure/keyvault/custom/key_vault_authentication.py", line 169, in _get_message_security
    token = AccessToken(*self._callback(challenge.get_authorization_server(),
  File "/usr/local/lib/python3.8/dist-packages/azure/keyvault/custom/key_vault_authentication.py", line
60, in _auth_callback_compat
    return self._user_callback(server, resource, scope) \\
  File "/tmp/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload_44tdazyl/ansible_azure.azcollection.azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py", line 279, in auth_callback
KeyError: 'client_id'
", "module_stdout": "", "msg": "MODULE FAILURE
See stdout/stderr for the exact error", "rc": 1}

[Fred-sun]

@saulobejo I used a free account to do this operation and got the same mistake as yours, so I can confirm that it is your credentials permissions. Thank you very much!

[saulobejo]

@Fred-sun
I don't understand. did you get the same error?
I'm using the CLI authentication, not the MSI.
There's no client_id to have a KeyError on.

[Fred-sun]

@Fred-sun
I don't understand. did you get the same error?
I'm using the CLI authentication, not the MSI.
There's no client_id to have a KeyError on.

- name: Azure secrets - Get secret password
  azure.azcollection.azure_rm_keyvaultsecret_info:
    vault_uri: "{{ vault_uri }}"
    name: "{{ secret_name_password }}"

[Fred-sun]

@saulobejo Also, make sure you have logged in to the CLI correctly and set up the Subscription to be used. Thank you very much!

# login in and choices account
az login 
# Set account subscription
az account set -s "*********************"
# Show account Info
az account show

result:
{
  "environmentName": "AzureCloud",
  "homeTenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
  "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxx", ---------------------------az account set -s sub
  "isDefault": true,
  "managedByTenants": [
    {
      "tenantId": "tenant_id"
    }
  ],
  "name": "OSS Integration DevINT with TTL = 7 Days",
  "state": "Enabled",
  "tenantId": "Tenant_id",
  "user": {
    "name": "account_mail",
    "type": "user"
  }

[saulobejo]

@Fred-sun

I'm logged in and the azure_rm inventory works perfectly. The only problem is the keyvault.

I'm also able to use the CLI for azure_identity

import os
import sys
import cmd
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential(
        exclude_environment_credential=True,
        exclude_managed_identity_credential=True,
        exclude_powershell_credential=True,
        exclude_visual_studio_code_credential=True,
        exclude_shared_token_cache_credential=True,
        exclude_interactive_browser_credential=True
)

client = SecretClient(vault_url=KVUri, credential=credential)

retrieved_secret = client.get_secret(secretName)

and the CLI is also working perfect.

az account show

{
  "environmentName": "AzureCloud",
  "homeTenantId": "xxxxxxxxxx-xxxxxxxxxxx-xxxxxxxxxx",
  "id": "yyyyyyyyyyyyyy-yyyyyyyyyyy-yyyyyyyyyy",
  "isDefault": true,
  "managedByTenants": [
    {
      "tenantId": "zzzzzzzzzzzz-zzzzzzzz-zzzzzzzz"
    }
  ],
  "name": "Subscription name",
  "state": "Enabled",
  "tenantId": "xxxxxxxxxx-xxxxxxxxxxx-xxxxxxxxxx",
  "user": {
    "name": "email@company",
    "type": "user"
  }
}

[saulobejo]

az --version
azure-cli                         2.25.0

core                              2.25.0
telemetry                          1.0.6

Python location '/opt/az/bin/python3'
Extensions directory '/root/.azure/cliextensions'

Python (Linux) 3.6.10 (default, Jun 11 2021, 05:19:38)

ansible --version
ansible [core 2.11.2]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.8/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.8.5 (default, May 27 2021, 13:30:53) [GCC 9.3.0]
  jinja version = 3.0.1
  libyaml = True

[Fred-sun]

@saulobejo I will recheck it! Thank you very much!

[dznz]

It looks like KeyVault client library is a few years old and uses a slightly outdated mechanism for auth.
That said, it does look like even the old library has the capability to support CLI auth:

https://stackoverflow.com/questions/65072094/getting-an-access-token-for-azure-key-vault-in-rider-using-azure-cli

One would want to modify the logic in e.g.
https://github.com/ansible-collections/azure/blob/45259c47f11ac78e334047cc3bb011904906e827/plugins/modules/azure_rm_keyvaultsecret_info.py#L266:299 to switch on auth_source to then do something like:

var tokenProvider = new AzureServiceTokenProvider(RunAs=Developer; DeveloperTool=AzureCli);
var client = new KeyVaultClient(
        new KeyVaultClient.AuthenticationCallback(tokenProvider.KeyVaultTokenCallback));

[dznz]

@Fred-sun sorry I haven't submitted a patch - I'm not confident I understand Azure auth and the existing code well enough to actually write the fix. I hope the research helps though!

[Fred-sun]

@jfreeland You are welcome to contribute PR to fix this issue! Thank you very much!

[mashoodakram]

Hello @Fred-sun is this issue likely to be fixed anytime soon? Trying to use azure_rm_keyvault_info.py as per https://docs.microsoft.com/en-us/azure/developer/ansible/key-vault-configure-secrets?tabs=ansible example to get keyvault secret with collection and getting same error as @saulobejo I login with az login successfully then run playbook.

TASK [Get secret value] *********************************************************************************************************************************************************************************************************************
task path: /tmp/az-key-collection.yml:22
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: root
<127.0.0.1> EXEC /bin/sh -c 'echo ~root && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576 `" && echo ansible-tmp-1635496104.0602715-15884-240882296271576="` echo /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576 `" ) && sleep 0'
Using module file /root/.ansible/collections/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py
<127.0.0.1> PUT /root/.ansible/tmp/ansible-local-14948iipgfus1/tmpoeivim7j TO /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/AnsiballZ_azure_rm_keyvaultsecret_info.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/ /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/AnsiballZ_azure_rm_keyvaultsecret_info.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '/usr/bin/python3 /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/AnsiballZ_azure_rm_keyvaultsecret_info.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/ > /dev/null 2>&1 && sleep 0'
fatal: [localhost]: FAILED! => {
    "changed": false,
    "module_stderr": "Your credentials class does not support session injection. Performance will not be at the maximum.\nTraceback (most recent call last):\n  File \"/root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/AnsiballZ_azure_rm_keyvaultsecret_info.py\", line 100, in <module>\n    _ansiballz_main()\n  File \"/root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/AnsiballZ_azure_rm_keyvaultsecret_info.py\", line 92, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/root/.ansible/tmp/ansible-tmp-1635496104.0602715-15884-240882296271576/AnsiballZ_azure_rm_keyvaultsecret_info.py\", line 41, in invoke_module\n    run_name='__main__', alter_sys=True)\n  File \"/usr/lib/python3.6/runpy.py\", line 205, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib/python3.6/runpy.py\", line 96, in _run_module_code\n    mod_name, mod_spec, pkg_name, script_name)\n  File \"/usr/lib/python3.6/runpy.py\", line 85, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 430, in <module>\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 426, in main\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 239, in __init__\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/module_utils/azure_rm_common.py\", line 469, in __init__\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 257, in exec_module\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 315, in get_secret\n  File \"/usr/local/lib/python3.6/dist-packages/azure/keyvault/key_vault_client.py\", line 1795, in get_secret\n    response = self._client.send(request, header_parameters, **operation_config)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/service_client.py\", line 336, in send\n    pipeline_response = self.config.pipeline.run(request, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/pipeline/__init__.py\", line 197, in run\n    return first_node.send(pipeline_request, **kwargs)  # type: ignore\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/pipeline/__init__.py\", line 150, in send\n    response = self.next.send(request, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/pipeline/requests.py\", line 72, in send\n    return self.next.send(request, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/pipeline/requests.py\", line 137, in send\n    return self.next.send(request, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/pipeline/__init__.py\", line 150, in send\n    response = self.next.send(request, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/pipeline/requests.py\", line 193, in send\n    self.driver.send(request.http_request, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/universal_http/requests.py\", line 333, in send\n    return super(RequestsHTTPSender, self).send(request, **requests_kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/msrest/universal_http/requests.py\", line 142, in send\n    **kwargs)\n  File \"/usr/lib/python3/dist-packages/requests/sessions.py\", line 520, in request\n    resp = self.send(prep, **send_kwargs)\n  File \"/usr/lib/python3/dist-packages/requests/sessions.py\", line 637, in send\n    r = dispatch_hook('response', hooks, r, **kwargs)\n  File \"/usr/lib/python3/dist-packages/requests/hooks.py\", line 31, in dispatch_hook\n    _hook_data = hook(hook_data, **kwargs)\n  File \"/usr/local/lib/python3.6/dist-packages/azure/keyvault/custom/key_vault_authentication.py\", line 146, in _handle_401\n    security = self._get_message_security(prep, challenge)\n  File \"/usr/local/lib/python3.6/dist-packages/azure/keyvault/custom/key_vault_authentication.py\", line 172, in _get_message_security\n    scheme))\n  File \"/usr/local/lib/python3.6/dist-packages/azure/keyvault/custom/key_vault_authentication.py\", line 61, in _auth_callback_compat\n    if len(inspect.getargspec(self._user_callback).args) == 3 \\\n  File \"/tmp/ansible_azure_rm_keyvaultsecret_info_payload_u4zvxo8v/ansible_azure_rm_keyvaultsecret_info_payload.zip/ansible_collections/azure/azcollection/plugins/modules/azure_rm_keyvaultsecret_info.py\", line 279, in auth_callback\nKeyError: 'client_id'\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
    "rc": 1
}

[AnishJS]

Any luck with having a look at this @Fred-sun ?

[Fred-sun]

@mashoodakram @saulobejo I have fixed the problem you encountered, please refer to PR#770. Thank you!

[fastlorenzo]

I've made a poc that works with Azure CLI.
For that, I had to use the latest version of python sdk azure-keyvault==4.2.0.
I didn't make a PR yet as the latest SDK is lacking the list secrets features, and it would require to also refactor the other modules related to keyvault.

If someone is interested to work on it, here is the working code: https://gist.github.com/fastlorenzo/8dffdcdee6a927c8ecf5989ddc9f2a3d

[Fred-sun]

I've made a poc that works with Azure CLI. For that, I had to use the latest version of python sdk azure-keyvault==4.2.0. I didn't make a PR yet as the latest SDK is lacking the list secrets features, and it would require to also refactor the other modules related to keyvault.

If someone is interested to work on it, here is the working code: https://gist.github.com/fastlorenzo/8dffdcdee6a927c8ecf5989ddc9f2a3d

fixes by #823