[Role] az role assignment list: Add --fill-principal-name#30693
Merged
[Role] az role assignment list: Add --fill-principal-name#30693
az role assignment list: Add --fill-principal-name#30693Conversation
️✔️AzureCLI-FullTest
|
|
Hi @jiasli, |
|
| rule | cmd_name | rule_message | suggest_message |
|---|---|---|---|
| role assignment list | cmd role assignment list added parameter fill_principal_name |
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
jiasli
commented
Mar 26, 2025
Member
Author
There was a problem hiding this comment.
This recording YAML should contain no requests to https://graph.microsoft.com/.
jiasli
force-pushed
the
fill-principal-name
branch
from
58f0877 to
1181051
Compare
jiasli
changed the title
az role assignment list: Add --fill-principal-name to allow skipping filling principalName propertyaz role assignment list: Add --fill-principal-name to allow omitting principalName property
evelyn-ys
approved these changes
Mar 28, 2025
bebound
approved these changes
Mar 28, 2025
jiasli
changed the title
az role assignment list: Add --fill-principal-name to allow omitting principalName propertyaz role assignment list: Add --fill-principal-name
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
az role assignment listDescription
Fix #30469 (comment)
Part of the fix to #30428
After getting role assignments from REST API,
az role assignment listqueries Microsoft Graph to fill theprincipalNameproperty:userPrincipalNameServicePrincipalNames[0]displayNameThe motivation is to provide a display name of the assignee, but when the logged-in account has no permission,
az role assignment listwill show a warning:azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py
Line 300 in 4d6d480
To make things worse, if the machine has no network access to Microsoft Graph, the whole command will fail.
This PR adds
--fill-principal-nameargument to allow skipping fillingprincipalNameproperty.Additional information
I deliberately choose
--fill-principal-nameinstead of--no-fill-principal-name, because this gives us the possibility to turn off fillingprincipalNameby default. If we choose--no-fill-principal-name, turning on fillingprincipalNamewill become--no-fill-principal-name falsewhich is awkward.Testing Guide
Without
--fill-principal-name false:With
--fill-principal-name false:History Notes
[Role]
az role assignment list: Add--fill-principal-nameargument. Use--fill-principal-name falseto omitprincipalNameproperty and bypass Microsoft Graph query