Azure CLI --sdk-auth is getting deprecated about inletsctl

[d0pare]

There is no alternative to --sdk-auth. The only difference between these flags is the JSON output of the executed command.

JSON with flag

{
  "clientId": "",
  "clientSecret": "",
  "subscriptionId": "",
  "tenantId": "",
  "activeDirectoryEndpointUrl": "",
  "resourceManagerEndpointUrl": "",
  "activeDirectoryGraphResourceId": "",
  "sqlManagementEndpointUrl": "",
  "galleryEndpointUrl": "",
  "managementEndpointUrl": ""
}

JSON without flag

{
  "appId": "",
  "displayName": "",
  "password": "",
  "tenant": ""
}

So, the --sdk-auth should be removed from the command, and the inlets controller should be changed to handle new JSON.

SUBSCRIPTION_ID="YOUR_SUBSCRIPTION_ID"
az ad sp create-for-rbac --role Contributor --scopes "/subscriptions/$SUBSCRIPTION_ID" \
  > $HOME/Downloads/client_credentials.json

[alexellis]

So what do you suggest using instead of passing --sdk-auth to obtain the initial token?

I.e. what replaces?

SUBSCRIPTION_ID="YOUR_SUBSCRIPTION_ID"
az ad sp create-for-rbac --role Contributor --scopes "/subscriptions/$SUBSCRIPTION_ID" --sdk-auth \
  > $HOME/Downloads/client_credentials.json

And is this just a docs change or does code need to change also? I suspect the former?

cc @zechenbit

[alexellis]

/add label: helpwanted

[zechen0]

Thanks @d0pare for raising this and putting useful information together. I found some related discussions in Azure CLI repository:

• How the fields are mapping with and without --sdk-auth: Azure/azure-cli#22297
• Azure/azure-cli#20743

Per their discussion (Azure/azure-cli#21693 (comment)), the --sdk-auth won't be removed in near future. Many tools are still relying on this such as https://github.com/marketplace/actions/azure-login.

If it is just the naming, then maybe we can just change our fileToEnvMap: https://github.com/inlets/cloud-provision/blob/master/provision/azure.go#L35

The NewEnvironmentCredential will eventually call NewClientSecretCredential https://github.com/Azure/azure-sdk-for-go/blob/sdk/azidentity/v1.5.1/sdk/azidentity/environment_credential.go#L80