Exception: invoke of azure-native:authorization:getClientConfig failed:

[Mejato]

Hello!

• Vote on this issue by adding a 👍 reaction
• To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already)

Issue details

When running pulumi up i receive the following error:

Exception: invoke of azure-native:authorization:getClientConfig failed: invocation of azure-native:authorization:getClientConfig returned an error: getting authenticated object ID: Error parsing json result from the Azure CLI: Error retrieving running Azure CLI: WARNING: The underlying Active Directory Graph API will be replaced by Microsoft Graph API in a future version of Azure CLI. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration

Steps to reproduce

1. Run pulumi up command for a existing project.
2. Azure CLI version -> 2.34.1
3. Pulumi version -> 3.25.1

Expected: A working deployment of a existing "working" automation project.
Actual: Receive error above.

[Mejato]

I noticed my Azure CLI version was updated yesterday and rolling it back to version 2.33.1 resolves the above error.

[Mejato]

Isolated the issue to the following code in my automation project:

_current_client_config = azure_native.authorization.get_client_config()

So it looks like the azure_native.authorization.get_client_config() API call doesn't know how to deal with the lovely new informational message that Microsoft introduced with Azure CLI version -> 2.34.1 and i assume this API would eventually need to point to the new Microsoft Graph API?

[lkt82]

Have the same issue.

[robertwe]

same here, rolling back the azure-cli to version 2.33.1 removes the error. @Mejato thx

[guineveresaenger]

Thanks for reporting! We'll take a look.

[walkerk1980]

I had the same issue with the AAD Graph deprecation warning breaking the bootstrap script I wrote for my terraform projects. I was using the AZ cli from within python and I was catching exceptions for output returned from the CLI on STDERR, the AAD Graph warning is printing out on STDERR.

 'az ad sp create-for-rbac --only-show-errors --name {0}'.format(service_principal_name)

The fix for me was to add '--only-show-errors' to any of the AZ cli AAD graph commands I was invoking to suppress the warning. I assume this needs to be added wherever the provider is calling the az cli command, that is if pulumi is actually calling the cli.

Edit: looks like you can work around this issue if you really want to with:

az config set core.only_show_errors=true

Not sure what repercussions turning az cli warnings off globally might have. :)

[viveklak]

Looks like the azure-native provider currently uses an authentication library that falls back to the AZ CLI to retrieve tokens etc. As mentioned earlier by users, starting in az CLI version 2.34.1 a deprecation message has been added for ADAL which is throwing off the library. We will track a work item to decouple the authentication from ADAL to a larger extent here: #1566.

The current workaround is to either:

1. Pin the az CLI to 2.33.1
2. Set the following global config for az CLI: az config set core.only_show_errors=true

Apologies for the inconvenience here.

[xtellurian]

This is going to break a lot of existing pulumi stacks. Preventing upgrading the Azure CLI is OK as a temporary workaround, but not sustainable for very long. If the deprecation message is only a warning, can it just be logged to stderr (or elsewhere) and not throw an error?

[Mejato]

@xtellurian , yes you are correct, existing stacks will break if the az cli is upgraded beyond 2.33.1. The workarounds are only temporary while they migrate to the new authentication model.

There is still time before it completely breaks - https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview

So the developers will currently be looking at the migration effort etc, but yes @xtellurian i agree with you that it might be best to just suppress the notification so that you can at least run the latest version of az cli while they work on migrating to the new authentication model.

@viveklak - fyi

[andrem0]

@viveklak any timeline for when this will be fixed? Great that a workaround exists, but its not sustainable much longer.

[davecluderay]

Is there an issue we can track for the migration, please?

[danielrbradley]

Hi all, thanks for you patience here with the workarounds. We're currently hard at work moving towards a new major version of the provider to address some pressing scaling limitations we're nearing; this issue is currently sitting at the top of our priority list to resolve and will be picked up in the near future.

[kiweezi]

Looks like the azure-native provider currently uses an authentication library that falls back to the AZ CLI to retrieve tokens etc. As mentioned earlier by users, starting in az CLI version 2.34.1 a deprecation message has been added for ADAL which is throwing off the library. We will track a work item to decouple the authentication from ADAL to a larger extent here: #1566.

The current workaround is to either:

1. Pin the az CLI to 2.33.1
2. Set the following global config for az CLI: az config set core.only_show_errors=true

Apologies for the inconvenience here.

Is there a work around for CI?
I'm running the Pulumi GitHub action v3 and getting the same issue.

[viveklak]

@kiweezi Thanks for the response. That certainly makes sense. I have opened an issue in the actions repo and we will get that updated soon! pulumi/actions#710

[kiweezi]

Wow @viveklak, thanks so much for the fast response!
Just woke up this morning to you guys already implementing this. I can confirm it works on my end.
I hope you have a wonderful Friday!

[viveklak]

Thanks @kiweezi. To be precise, the GH action is a native typescript action so doesn't embed the az cli etc. We updated Pulumi's docker image instead to pin the az cli: pulumi/pulumi-docker-containers#106.
Thanks to @RobbieMcKinstry for the quick response there.

We are hard at work fixing the underlying auth library dependency so these workarounds can be removed. Thanks everyone for your patience.

[Sheffer]

Has this issue been resolved? We are still on az CLI 2.33.1, just wondering if we can upgrade.

[danielrbradley]

Yes, this was addressed back in March as part of our MSAL and OIDC work:

• MSAL and OIDC support #2320

[danielrbradley]

I'm going to close this discussion as this should have been resolved as part of our MSAL and OIDC work in March:

• MSAL and OIDC support #2320