az ad app credential reset fails when provided a description for the credential: When present, application key identifier cannot be empty and can be at most 32 bytes.

[roy-work]

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Describe the bug
The following command fails, and should succeed:

» az ad app credential reset --id "$APP_ID" --append --credential-description 'a description here' --end-date '2299-12-31'
When present, application key identifier cannot be empty and can be at most 32 bytes.
Parameter name: applicationKeyIdentifierValue

To Reproduce
Run the above command against an application registration.

Expected behavior
It succeeds, creating a new credential.

Environment summary
brew

Additional context

It seems like this is also https://github.com/Azure/azure-docs-powershell-azuread/issues/296 ; that bug was closed without any meaningful resolution. It seems like az is mixing up the description with something else. The error emitted here is grade A bonkers: "can be at most 32 bytes" when the input text is less than 32 bytes? It seems like it is getting mixed up with an encryption key, or something, and isn't actually transmitting the provided value as a description.

The value itself is also fine: it is possible to go to the Portal & create a new credential with the description a description here without problems. Hence, this seems to be an azure-cli problem.

[yonzhan]

@jiasli for awareness

[jiasli]

I can reproduce. Here is the --debug output:

> az ad app credential reset --id 3524c502-0c73-45be-be20-eb8aec4e11bf --credential-description 'a description here' --debug

msrest.http_logger: Request URL: 'https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/applications/63946374-6c70-4383-82f1-e30bafcb0dae?api-version=1.6'
msrest.http_logger: Request method: 'PATCH'
...
msrest.http_logger: Request body:
msrest.http_logger: {"passwordCredentials": [{"startDate": "2021-12-02T02:49:08.214061Z", "endDate": "2022-12-02T02:49:08.214061Z", "keyId": "60c8401c-d45c-4d8f-96fa-e925023fdafb", "value": "V0-GAQ6abG~DtAEu.B-D4Qp4JKN7noOFzj", "customKeyIdentifier": "//5hACAAZABlAHMAYwByAGkAcAB0AGkAbwBuACAAaABlAHIAZQA="}]}
...
msrest.http_logger: Response status: 400
...
msrest.http_logger: Response content:
msrest.http_logger: {"odata.error":{"code":"Request_BadRequest","message":{"lang":"en","value":"When present, application key identifier cannot be empty and can be at most 32 bytes.\r\nParameter name: applicationKeyIdentifierValue"},"requestId":"d11e09ac-042c-4a23-a36c-4b18f027671a","date":"2021-12-02T02:49:11"}}

--credential-description is UTF-16 encoded sent to AD Graph as customKeyIdentifier:

azure-cli/src/azure-cli/azure/cli/command_modules/role/custom.py

Lines 1773 to 1776 in 3c34079

	def _encode_custom_key_description(key_description):
	# utf16 is used by AAD portal. Do not change it to other random encoding
	# unless you know what you are doing.
	return key_description.encode('utf-16')

However, if we make a description here shorter, like key1, it will work:

> az ad app credential reset --id 3524c502-0c73-45be-be20-eb8aec4e11bf --credential-description 'key1' --debug

msrest.http_logger: Request URL: 'https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/applications/63946374-6c70-4383-82f1-e30bafcb0dae?api-version=1.6'
msrest.http_logger: Request method: 'PATCH'
...
msrest.http_logger: Request body:
msrest.http_logger: {"passwordCredentials": [{"startDate": "2021-12-02T02:50:40.754299Z", "endDate": "2022-12-02T02:50:40.754299Z", "keyId": "f2a90fea-cf5b-46d7-9ec4-a0c50b4d26fc", "value": "JsE8F3f2HTwAaj6U.yDSo-.CJFkaFb.Yiv", "customKeyIdentifier": "//5rAGUAeQAxAA=="}]}
...
msrest.http_logger: Response status: 204

During Microsoft Graph migration (#12946), as discussed with AAD team, we are considering deprecating --credential-description. customKeyIdentifier will

• not be used for passwordCredential, and
• used as thumbprint of the certificate for keyCredential.

Instead, custom description string will be set as --display-name (displayName on the wire).

[jiasli]

A more detailed comparison:

AD Graph

	customKeyIdentifier	displayName
passwordCredential	user-defined	N/A
keyCredential	thumbprint	N/A

MS Graph

	customKeyIdentifier	displayName
passwordCredential	no use	user-defined
keyCredential	thumbprint	user-defined

[jiasli]

This issue has been resolved by #22432.

Documentation is updated accordingly: https://docs.microsoft.com/en-us/cli/azure/microsoft-graph-migration