Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add instance_discovery toggle to modules for alternate Azure Clouds #1236

Closed
lm-sig opened this issue Aug 7, 2023 · 2 comments · Fixed by #1442
Closed

Add instance_discovery toggle to modules for alternate Azure Clouds #1236

lm-sig opened this issue Aug 7, 2023 · 2 comments · Fixed by #1442
Labels
has_pr PR fixes have been made medium_priority Medium priority question Further information is requested

Comments

@lm-sig
Copy link

lm-sig commented Aug 7, 2023

SUMMARY

Authentication with Azure passes through two libraries that changed behavior and caused a breakage in an environment I work in.

  • Ansible collection (as of this report) depends on "azure-identity==1.7.0"
  • Ansible collection pulls in MSAL version 1.22.0
  • The MSAL library introduced a "instance_discovery" toggle to the PublicClientApplication function call.
  • The azure-identity library added support for this toggle in version 1.13.0.

As of today the Azure Collection fails to connect in this environment:

  • Network access is allowed to Azure US Government cloud. (login.microsoftonline.us)
  • Network access is not allowed to Azure Public cloud. (login.microsoftonline.com)
  • Trying to use the Azure collection in this environment fails with attempts to connect to login.microsoftonline.com.

Setting "instance_discovery=False" allows the environment to work again.

ISSUE TYPE
  • Feature Idea
COMPONENT NAME

All Azure modules.

ADDITIONAL INFORMATION

It may be possible to add support for this new instance_discovery toggle by checking for the existence of the "AZURE_AUTHORITY_HOST" environment variable.




See also AzureAD/microsoft-authentication-library-for-python#578

      		
    

      
  





        



            

              
            

        

      


      
    








      

    



      

  
          

  

    
  


  

      

    @lm-sig
lm-sig



    mentioned this issue
    
      Aug 7, 2023
    





  


  

      
  
  Closed

  







  




    

    

      
    

    


      

          @Fred-sun
Fred-sun




            added
      

  medium_priority

  Medium priority

      

  work in

  In trying to solve, or in working with contributors

  labels


      Nov 29, 2023

    

  








      

  
      



  

  @Fred-sun





  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      

  
    Collaborator


      

  


  

    

  





      


        


  
    

      
          
@lm-sig Is your problem still there? We previously encountered a similar issue, and it was fixed by specifying the permissions of Azure Active Directory endpoint #1129 when obtaining credentials. Can you update to the latest version to see if your issues are resolved? Thank you.

      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
            

    

      
    

    


      

          @Fred-sun
Fred-sun




          added
  the 

  question

  Further information is requested
 label


      Jan 22, 2024

    

  



  


  
    
  
  

    
  p3ck 

      added a commit
        to p3ck/ansible-collections_azure
      that referenced
      this issue

    
      Feb 13, 2024
    
    

      


  

    

      


  

      
        @p3ck
  





      

        
          Add support for disable_instance_discovery
        

          
            
          

      


      

          

    
    
    

  

    


      


      

      


      
      

        
          1542453
        
      

    

  

    

      
Added support in ansible common to support setting
disable_instance_discovery when using azure clouds and you don't have
access to login.microsoftonline.com.

This can be specified as a module argument, environment variable or in
credential profile.  To enable set to True, default if False which
doesn't change the current behaviour.

fix ansible-collections#1236

    




    

  




  

  

    
  


  

      

    @p3ck
p3ck



    mentioned this issue
    
      Feb 13, 2024
    





  


  

      
   Merged

  







  




    

    

      
    

    


      

          @Fred-sun
Fred-sun




            added
      

  has_pr

  PR fixes have been made

    and removed
      

  work in

  In trying to solve, or in working with contributors

  labels


      Feb 17, 2024

    

  



  


  
    
  
  

    
  p3ck 

      added a commit
        to p3ck/ansible-collections_azure
      that referenced
      this issue

    
      Feb 20, 2024
    
    

      


  

    

      


  

      
        @p3ck
  





      

        
          Add support for disable_instance_discovery
        

          
            
          

      


      

          

    
    
    

  

    


      


      

      


      
      

        
          30efd1b
        
      

    

  

    

      
Added support in ansible common to support setting
disable_instance_discovery when using azure clouds and you don't have
access to login.microsoftonline.com.

This can be specified as a module argument, environment variable or in
credential profile.  To enable set to True, default if False which
doesn't change the current behaviour.

Updated doc fragment to explain how to use it.

fix ansible-collections#1236

    




    

  




  


  
    
  
  

    
  p3ck 

      added a commit
        to p3ck/ansible-collections_azure
      that referenced
      this issue

    
      Feb 21, 2024
    
    

      


  

    

      


  

      
        @p3ck
  





      

        
          Add support for disable_instance_discovery
        

          
            
          

      


      

          

    
    
    

  

    


      


      

      


      
      

        
          729b239
        
      

    

  

    

      
Added support in ansible common to support setting
disable_instance_discovery when using azure clouds and you don't have
access to login.microsoftonline.com.

This can be specified as a module argument, environment variable or in
credential profile.  To enable set to True, default if False which
doesn't change the current behaviour.

Updated doc fragment to explain how to use it.

fix ansible-collections#1236

    




    

  




  


  
    
  
  

    
  p3ck 

      added a commit
        to p3ck/ansible-collections_azure
      that referenced
      this issue

    
      Feb 21, 2024
    
    

      


  

    

      


  

      
        @p3ck
  





      

        
          Add support for disable_instance_discovery
        

          
            
          

      


      

          

    
    
    

  

    


      


      

      


      
      

        
          85ce6d8
        
      

    

  

    

      
Added support in ansible common to support setting
disable_instance_discovery when using azure clouds and you don't have
access to login.microsoftonline.com.

This can be specified as a module argument, environment variable or in
credential profile.  To enable set to True, default if False which
doesn't change the current behaviour.

Updated doc fragment to explain how to use it.

fix ansible-collections#1236

    




    

  




    

    


  


  
    
  
  

    
  xuzhang3 

      pushed a commit
      that referenced
      this issue

    
      Feb 29, 2024
    
    

      


  

    

      


  

      
        @p3ck
  





      

        
          Add support for disable_instance_discovery (#1442)
        

          
            
          

      


      

          

    
    
    

  

    


      


      

          

    
    
    

  

  

    
  



      


      
      

        
          f2fe73f
        
      

    

  

    

      
Added support in ansible common to support setting
disable_instance_discovery when using azure clouds and you don't have
access to login.microsoftonline.com.

This can be specified as a module argument, environment variable or in
credential profile.  To enable set to True, default if False which
doesn't change the current behaviour.

Updated doc fragment to explain how to use it.

fix #1236

    




    

  









      

  
      



  

  @lm-sig





  


    

      

  

    

        
    
    

  


      
          
  
      
            Copy link

  

      
    

  


  

      



      

  Author


  


  

    

      

      
            lm-sig
  

      

      

      commented


        Feb 29, 2024


      
    


  





      


        


  
    

      
          
Thank you! It may take some time to test it, but I will try to test it.

      		
    

  





        


            

            

              
            

        

      


      

            
  

    
  
    
    

  

  



    












      

  
          


  
    
  
  

    
  Justwmz 

      pushed a commit
        to Justwmz/azure
      that referenced
      this issue

    
      Nov 4, 2024
    
    

      


  

    

      


  

      
        @p3ck
      
        @Justwmz
  





      

        
          Add support for disable_instance_discovery (ansible-collections#1442)
        

          
            
          

      


      

          

    
    
    

  

      


      

      


      
      

        
          e7724b4
        
      

    

  

    

      
Added support in ansible common to support setting
disable_instance_discovery when using azure clouds and you don't have
access to login.microsoftonline.com.

This can be specified as a module argument, environment variable or in
credential profile.  To enable set to True, default if False which
doesn't change the current behaviour.

Updated doc fragment to explain how to use it.

fix ansible-collections#1236

    




    

  













  
  

    

      

  





  




  
  

              

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  



  






  
                  




    

  


      
  

    Assignees
  



        

    No one assigned







      


  


  

    Labels
  



    

      

    has_pr

  PR fixes have been made
  

    medium_priority

  Medium priority
  

    question

  Further information is requested








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
    

    Development
  




            
  
Successfully merging a pull request may close this issue.





    


  
          
      Add support for disable_instance_discovery

    
      p3ck/ansible-collections_azure
    





      
    

  




      

    

  
      

  

    

      2 participants
    

    

        
          @Fred-sun 
        
          @lm-sig