azurerm_postgresql_flexible_server_active_directory_administrator does not work with security groups

[ThorstenHans]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.5

AzureRM Provider Version

3.33.0

Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server_active_directory_administrator

Terraform Configuration Files

resource "azurerm_postgresql_flexible_server_active_directory_administrator" "psql_aad_admin" {
  server_name         = azurerm_postgresql_flexible_server.server.name
  resource_group_name = azurerm_postgresql_flexible_server.server.resource_group_name

  object_id      = module.postgre_admin_group.object_id
  principal_name = module.postgre_admin_group.display_name
  principal_type = "Group"
  tenant_id      = data.azurerm_client_config.current.tenant_id
}

Debug Output/Panic Output

Error: creating Administrator (Subscription: "***"
Resource Group Name: "rg-foo"
Server Name: "psql-foo"
Object: "11a0c311-1111-1111-1111-1111c2f81111"): polling after Create: Code="AadAuthPrincipalCreationFailed" Message="Failed to create Azure AD Principal. Reason - 0LP01: An unexpected error occurred while trying to validate user."

  with module.prod.azurerm_postgresql_flexible_server_active_directory_administrator.psql_aad_admin,
  on ../postgre.tf line 19, in resource "azurerm_postgresql_flexible_server_active_directory_administrator" "psql_aad_admin":
  59: resource "azurerm_postgresql_flexible_server_active_directory_administrator" "psql_aad_admin" {

Releasing state lock. This may take a few moments...

Expected Behaviour

Terraform should set the AAD Administrator for Flexible PostgreSQL Server to the existing AAD Group (Security Group)

Actual Behaviour

Terraform fails upon linking the existing AAD Group to Flexible PostgreSQL Server

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[ziyeqf]

Hi @ThorstenHans, thanks for reporting.

I can not reproduce the issue, it seems to be a service fluctuation. Does this issue still exist for you?

Could you please check wether the authentication.active_directory_auth_enabled property of azurerm_postgresql_flexible_server is true and authentication.tenant_id of it has been specified?

[marco-vervoort-asml]

Hi @ThorstenHans,
We got the same error (can reproduce your issue), but also noticed we get this error when using the Azure portal to add an AAD group as administrator to PostgreSQL flexible server. So it's probably not an issue in this Terraform provider, but in the Azure PostgreSQL flexible server with AAD administrators (which is in preview, see https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-azure-ad-authentication). Perhaps the AAD tenant is to restricted.

[krohm]

I got the same error, just investigating with Microsoft, because in Azure Portal it's reproducable, keep you posted

[skillbuilderzone]

Any update or work around for this one ?
We have some PostgreSQL flexible server and are unable to update the AAD Administrator. I am unable to add even an individual user
Failed to create Azure AD Principal. Reason - 0LP01: An unexpected error occurred while trying to validate user.

[XristophD]

We had the same issue and error message after moving our PostgreSQL Flexible Server behind an Azure Firewall.

Beside the documented Service Tags, the PostgreSQL Flexible Server need sto be able to access "graph.microsoft.com".
If access to this endpoint is blocked by a Firewall (or NSG), validation will fail with error message mentioned above:
"Failed to create Azure AD Principal. Reason - 0LP01: An unexpected error occurred while trying to validate user."

This is not a terraform issue, but an infrastructure configuration issue.

[rcskosir]

Thank you for taking the time to raise this! We use Issues in this repository to track feature enhancements and bugs in the Azure Provider. So that we can maintain focus on that, since this is not an issue with the provider, I'm going to close this issue.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.