-
Notifications
You must be signed in to change notification settings - Fork 3.4k
Support claimsMatchingExpression for az ad app federated-credential create #32816
Copy link
Copy link
Open
Labels
Auto-AssignAuto assign by botAuto assign by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamThe command of the issue is owned by Azure CLI teamGraph(doesn't work with label-triggered comments; use Graph.Microsoft instead) az ad(doesn't work with label-triggered comments; use Graph.Microsoft instead) az adact-identity-squadcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.feature-request
Milestone
Description
Related command
az ad app federated-credential create
Is your feature request related to a problem? Please describe.
I want to create a federated credential to work with a GitHub merge queue. The subject is not static so I need to use the 'claims matching expression' feature instead.
This appears to not be supported by the Azure CLI. I get this error:
Property 'subject' cannot be empty.The docs say:
If
claimsMatchingExpressionis defined,subjectmust be set to null.
Describe the solution you'd like
I want to be able to create a federated credential that uses claimsMatchingExpression instead of subject.
{
"name": "MergeQueue",
"issuer": "https://token.actions.githubusercontent.com",
"subject": null,
"claimsMatchingExpression": "claims['sub'] matches 'repo:my-org/my-repo:ref:refs/heads/gh-readonly-queue/main/pr*'",
"description": "Merge queue",
"audiences": [
"api://AzureADTokenExchange"
]
}Describe alternatives you've considered
I can't access Entra in the portal in my organisation, but it would work if I could...
Additional context
Reactions are currently unavailable
Metadata
Metadata
Labels
Auto-AssignAuto assign by botAuto assign by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamThe command of the issue is owned by Azure CLI teamGraph(doesn't work with label-triggered comments; use Graph.Microsoft instead) az ad(doesn't work with label-triggered comments; use Graph.Microsoft instead) az adact-identity-squadcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.feature-request