"az ad sp show --id" doesn't return all service principals matching the service principal name.

[amit-kumar-4]

Description

In case multiple service principals exist with same name on AD, az ad sp show --id doesn't return all service principals matching the service principal name.
To reproduce the issue, create 2 service principals with exact same name and run az ad sp show --id http://$sp_name. Details of only one service principal is returned.

Expected result: Details of all service principals with the passed name should be returned.

---

Environment summary

Install Method: How did you install the CLI? (e.g. pip, interactive script, apt-get, Docker, MSI, nightly)
Answer here: curl -L https://aka.ms/InstallAzureCli | bash

CLI Version: What version of the CLI and modules are installed? (Use az --version)
Answer here:

azure-cli (2.0.14)

acr (2.0.10)
acs (2.0.13)
appservice (0.1.13)
batch (3.1.1)
billing (0.1.3)
cdn (0.0.6)
cloud (2.0.7)
cognitiveservices (0.1.6)
command-modules-nspkg (2.0.1)
component (2.0.7)
configure (2.0.10)
consumption (0.1.3)
container (0.1.8)
core (2.0.13)
cosmosdb (0.1.11)
dla (0.0.10)
dls (0.0.12)
eventgrid (0.1.2)
feedback (2.0.6)
find (0.2.6)
interactive (0.3.7)
iot (0.1.10)
keyvault (2.0.8)
lab (0.0.9)
monitor (0.0.8)
network (2.0.12)
nspkg (3.0.1)
profile (2.0.10)
rdbms (0.0.5)
redis (0.2.7)
resource (2.0.12)
role (2.0.10)
sf (1.0.6)
sql (2.0.9)
storage (2.0.12)
vm (2.0.12)

Python (Darwin) 2.7.13 (default, Apr  4 2017, 08:47:57)
[GCC 4.2.1 Compatible Apple LLVM 8.1.0 (clang-802.0.38)]

OS Version: What OS and version are you using?
Answer here: MacOS Sierra (10.12.6)

Shell Type: What shell are you using? (e.g. bash, cmd.exe, Bash on Windows)
Answer here: zsh

[yugangw-msft]

@aku105, I don't think you can create 2 service principals with the same name, aka app-id-uri. Could you please go to portal and verify there are 2 of them there?

[amit-kumar-4]

Sorry, you are correct.
I hadn't realised that APP URI ID is a field for service principals and that is the input of --id, not just the Service principal name (proceeded by http://) ☹️

[yfernando]

@yugangw-msft yes you are correct, you can't create 2 service principles (SP) with the same name. But that is only true if you use create-for-rbac command. We found that we can still create a second SP with same name via the Portal.

Say for example, az ad sp create-for-rbac --role contributor --name my-app1
As per command usage, the argument --name can be either the display name or an app-id uri and it will generate one if missing. This means they both get set as,
display-name=my-app1
app-id-uri=http://my-app1

A re-run of the same command will fail because a similar app-id uri already exists.

But, the portal always auto generates a unique app-id-uri thus, I can create a new SP with name my-app1.

This difference of behaviour between create-for-rbac az command and portal may be the root cause of the symptom described by @aku105 above.

Either way having some consistency on above behaviour will enable us to put some validation in our scripts. Please advise if this can be fixed.

[yugangw-msft]

Through #7651 CLI will communicate that a valid SPN is expected which should get things clear and consistent.
Client script can always ignore the --name argument for CLI to produce a unique name.

[tejass16]

ACR_NAME=testtejasivargaks
SERVICE_PRINCIPAL_NAME=acr-sp-demo

ACR_REGISTRY_ID=$(az acr show --name $ACR_NAME --query id --output tsv)

SP_PASSWD=$(az ad sp create-for-rbac --name http://$SERVICE_PRINCIPAL_NAME --scopes $ACR_REGISTRY_ID --role acrpull --query password --output tsv)
SP_APP_ID=$(az ad sp show --id http://$SERVICE_PRINCIPAL_NAME --query appId --output tsv)

echo "Service principal ID: $SP_APP_ID"
echo "Service principal password: $SP_PASSWD"

teja@Azure:~/teja/aks-acr-sp-practice$ az ad sp show --id http://acr-sp-demo --query appId --output tsv --verbose
Service principal 'http://acr-ap-demo' doesn't exist
Command ran in 0.624 seconds (init: 0.123, invoke: 0.501)
Suppress exception:
Traceback (most recent call last):
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/command_operation.py", line 361, in handler
return op(**command_args)
File "/opt/az/lib/python3.6/site-packages/azure/cli/command_modules/role/custom.py", line 1242, in show_service_principal
object_id = _resolve_service_principal(client, identifier)
File "/opt/az/lib/python3.6/site-packages/azure/cli/command_modules/role/custom.py", line 1334, in _resolve_service_principal
raise error
knack.util.CLIError: Service principal 'http://acr-ap-demo' doesn't exist

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/az/lib/python3.6/site-packages/azure/cli/main.py", line 60, in
raise ex
File "/opt/az/lib/python3.6/site-packages/azure/cli/main.py", line 48, in
exit_code = cli_main(az_cli, sys.argv[1:])
File "/opt/az/lib/python3.6/site-packages/azure/cli/main.py", line 35, in cli_main
return cli.invoke(args)
File "/opt/az/lib/python3.6/site-packages/knack/cli.py", line 248, in invoke
raise ex
File "/opt/az/lib/python3.6/site-packages/knack/cli.py", line 231, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 658, in execute
raise ex
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 721, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 692, in _run_job
result = cmd_copy(params)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/init.py", line 328, in call
return self.handler(*args, **kwargs)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/command_operation.py", line 363, in handler
show_exception_handler(ex)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/arm.py", line 428, in show_exception_handler
sys.exit(3)
SystemExit: 3

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/decorators.py", line 79, in _wrapped_func
return func(*args, **kwargs)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/telemetry.py", line 115, in generate_payload
payload = json.dumps(self.events, separators=(',', ':'))
File "/opt/az/lib/python3.6/json/init.py", line 238, in dumps
**kw).encode(obj)
File "/opt/az/lib/python3.6/json/encoder.py", line 199, in encode
chunks = self.iterencode(o, _one_shot=True)
File "/opt/az/lib/python3.6/json/encoder.py", line 257, in iterencode
return _iterencode(o, 0)
File "/opt/az/lib/python3.6/json/encoder.py", line 180, in default
o.class.name)
TypeError: Object of type 'CLIError' is not JSON serializable