[BUG] fabric_workspace_git: Create operation failed for Service Principal

[liquorichris]

🐛 What happened?

When trying to add Azure DevOps git integration using a service principal. An error message is thrown.

Could not create resource: The request could not be processed due to missing or invalid information / The operation is not supported for the principal type

Error Code: BadRequest / PrincipalTypeNotSupported

However, the repository is synced with the given workspace in the Fabric UI.

🔬 How to reproduce?

1. Add the resource.
2. Run terraform apply -auto-approve.
3. Error occurs.
4. Open the Fabric UI or call the rest api.
5. View the git integration settings under workspace settings.

🏗️ Code Sample / Log

resource "fabric_workspace_git" "developer_workspace_git" {
  workspace_id            = "<workspace_id>"
  initialization_strategy = "PreferWorkspace"
  git_provider_details = {
    git_provider_type = "AzureDevOps"
    organization_name = "<organization_name>"
    project_name      = "<project_name>"
    repository_name   = "<repository_name>"
    branch_name       = "main"
    directory_name    = "/src"
  }
  git_credentials = {
    source        = "ConfiguredConnection"
    connection_id = "<connection_id>"
  }
}

📷 Screenshots

Terraform apply:

After running terraform using the git connection api endpoint:

https://learn.microsoft.com/en-us/rest/api/fabric/core/git/get-connection?tabs=HTTP

gitConnectionState
------------------
ConnectedAndInitialized

📈 Expected behavior

The terraform should succeed because the Fabric UI shows the connected and initialized repository.

🌌 Environment (Provider Version)

1.6

🌌 Environment (Terraform Version)

1.13.3

🌌 Environment (OS)

macOS

📎 Additional context

Service Principal permissions:

• Fabric connection (Azure DevOps - Source control (Preview))
• Basic license in Azure DevOps
• Contributor on the repository

🔰 Code of Conduct

• I agree to follow this project's Code of Conduct.

[CatalinDabuleanu]

Hello Chris Liquori (@liquorichris)

Thank you for bringing this to our attention. A similar issue has already been raised here: #655

Could you please review the discussion and comments in that thread to see if it addresses your concern? If your scenario differs or you have additional details to contribute, feel free to comment there so we can consolidate our investigation.

Thank you for helping us improve the provider!

[liquorichris]

Hello,

Thanks for the reply, this is a different error in the linked issue. My error is stating "Could not create resource: The request could not be processed due to missing or invalid information / The operation is not supported for the principal type" However, the repository is connecting and initializing successfully to the workspace.

Thank you.

[lorneeaston]

Hi Dabuleanu Catalin (@CatalinDabuleanu) Chris Liquori (@liquorichris) I can provide a repro for this.

main.broken.tf.txt
main.working.tf.txt

Please note the change in dependencies. If there exists already a fabric_warehouse in the workspace, the following error occurs:

│ Error: Create operation
│ 
│   with fabric_workspace_git.azdo,
│   on main.tf line 141, in resource "fabric_workspace_git" "azdo":
│  141: resource "fabric_workspace_git" "azdo" {
│ 
│ Could not create resource: The request could not be processed due to missing or invalid information / The operation is not supported for the
│ principal type
│ 
│ Error Code: BadRequest / PrincipalTypeNotSupported
│ Request ID: 34593705-8266-4d55-b08a-eb8c3620069d

Delaying the creation of the warehouse until after fabric_workspace_git is created allows the association to be made, and commits of the warehouse seem to work.

Similar limitations exist with deployment pipelines using SPNs for warehouse items, per Item management documentation. Not sure if this is related.

[liquorichris]

Hi lorneeaston, Dabuleanu Catalin (@CatalinDabuleanu)

I can confirm that the warehouse item was the issue. I did not have the warehouse item in the terraform, but did have the item in the repository and source controlled. I removed the warehouse item from the repository and the terraform completed without an error.

Thank you for pointing me in the right direction to resolve this issue. I guess the next question is, is this a bug in the warehouse item or should it be excluded as an item in the repository?

Thanks again

[lorneeaston]

I would like to understand what context the commit is occurring under in my example. Is it user OAuth (since the committing user does not have access to the connection), or is it via the connection?

I'm assuming per above it falls back to OAuth when the connection is not available?

[liquorichris]

Hello lorneeaston,

No, I am using the ConfiguredConnection in the terraform to connect and initialize the repository. When a warehouse item is in the repository, the terraform fails with Error Code: BadRequest / PrincipalTypeNotSupported. But the fabric is connected with the configured connection. See screenshots below.

When I removed the warehouse item from the repository and ran the terraform, it completed without error.

Fabric Git Integration:

Fabric connection:

[lorneeaston]

Chris Liquori (@liquorichris) I'm able to commit my warehouse (through the UI) via git integration so long as I create it after the association is made. I suspect that this is occurring using UPN OAuth and not via the configured connection. Are you able to create and commit a warehouse via the configured connection? The committing user in my example does not have access to the configured connection since it's created by the SPN and connection role assignments are not available as of 1.6.0. Dabuleanu Catalin (@CatalinDabuleanu)

[liquorichris]

lorneeaston yes, I am able to commit the warehouse to the repository via git integration with the configured connection, however, this is not the issue. After the commit was made to the repository, I am not able to re-connect the repository via terraform.

Steps to reproduce:

1. Create a warehouse item and commit to the repository.
2. Disconnect repository via workspace settings in the Fabric UI.
3. Run terraform apply.
4. View error.

This is the terraform I am attempting to run when the warehouse item is in the repository:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">=3.0.0"
    }

    fabric = {
      source  = "microsoft/fabric"
      version = ">=1.0.0"
    }
  }
}

provider "azurerm" {
  features {}
}

provider "fabric" {
  preview = true
}

resource "fabric_workspace_git" "developer_workspace_git" {
  workspace_id            = "[Redacted]"
  initialization_strategy = "PreferWorkspace"
  git_provider_details = {
    git_provider_type = "[Redacted]"
    organization_name = "[Redacted]"
    project_name      = "[Redacted]"
    repository_name   = "fabric-training"
    branch_name       = "add-warehouse"
    directory_name    = "/src"
  }
  git_credentials = {
    source        = "ConfiguredConnection"
    connection_id = "[Redacted]"
  }
}

Error after apply:

 Error: Create operation
│ 
│   with fabric_workspace_git.developer_workspace_git,
│   on main.tf line 23, in resource "fabric_workspace_git" "developer_workspace_git":
│   23: resource "fabric_workspace_git" "developer_workspace_git" {
│ 
│ Could not create resource: The request could not be processed due to missing or invalid information / The operation is not supported for the principal type
│ 
│ Error Code: BadRequest / PrincipalTypeNotSupported
│ Request ID: 0c090746-4e79-4c56-bc7d-6b2893f6009a

After removing the warehouse item from the repository and workspace:

Plan: 1 to add, 0 to change, 0 to destroy.
fabric_workspace_git.developer_workspace_git: Creating...
fabric_workspace_git.developer_workspace_git: Creation complete after 6s [Redacted]
╷
│ Warning: 'Workspace Git' preview mode
│ 
│   with fabric_workspace_git.developer_workspace_git,
│   on main.tf line 23, in resource "fabric_workspace_git" "developer_workspace_git":
│   23: resource "fabric_workspace_git" "developer_workspace_git" {
│ 
│ The 'Workspace Git' behavior may change in future releases without notice or compatibility guarantees.
│ 
│ (and 3 more similar warnings elsewhere)
╵

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

[CatalinDabuleanu]

Hello Chris Liquori (@liquorichris) lorneeaston

Thank you both for contributing to this discussion.

I’ve been trying to reproduce this issue but haven’t been able to so far. I used a configuration similar to the one shared by lorneeaston in the main.broken.tf.txt file:

resource "azurerm_resource_group" "fabric" {
  name     = "rg-fabric-platform"
  location = "australiaeast"
}

resource "azurerm_user_assigned_identity" "example" {
  name                = "example"
  resource_group_name = azurerm_resource_group.fabric.name
  location            = azurerm_resource_group.fabric.location
}


data "fabric_capacity" "capacity" {
  display_name = "fabrictftests"
}

data "azuredevops_project" "project" {
  name = "testacc_cyZHuAWIrM_proj"
}

resource "fabric_workspace" "example_workspace" {
  display_name = "Test workspace"
  description  = "Getting started workspace"
  capacity_id  = data.fabric_capacity.capacity.id

  # Add system-assigned managed identity
  identity = {
    type = "SystemAssigned"
  }
}

resource "fabric_warehouse" "test" {
  display_name = "warehouse_example2"
  description  = "warehouse_example2 with collation_type"
  workspace_id = fabric_workspace.example_workspace.id
}


resource "azuredevops_git_repository" "repo" {
  project_id     = data.azuredevops_project.project.id
  name           = "Catalin_Test"
  default_branch = "refs/heads/main"
  initialization {
    init_type = "Clean"
  }
  lifecycle {
    ignore_changes = [
      initialization,
    ]
  }
}

resource "fabric_connection" "ado_terraform_conn" {
  display_name      = "adoterraformconn"
  connectivity_type = "ShareableCloud"
  privacy_level     = "Public"
  connection_details = {
    type            = "AzureDevOpsSourceControl"
    creation_method = "AzureDevOpsSourceControl.Contents"
    parameters = [
      {
        name  = "url"
        value = "[REDACTED]/Catalin_Test"
      }
    ]
  }
  credential_details = {
    credential_type      = "ServicePrincipal"
    skip_test_connection = false
    service_principal_credentials = {
      client_id                = "[REDACTED]"
      client_secret_wo         = "[REDACTED]"
      client_secret_wo_version = 1
      tenant_id                = "[REDACTED]"
    }
  }

  depends_on = [
    fabric_warehouse.test,
    azuredevops_git_repository.repo
  ]
}


resource "fabric_workspace_git" "azdo" {
  workspace_id            = fabric_workspace.example_workspace.id
  initialization_strategy = "PreferRemote"
  git_provider_details = {
    git_provider_type = "AzureDevOps"
    organization_name = "[REDACTED]"
    project_name      = "testacc_cyZHuAWIrM_proj"
    repository_name   = azuredevops_git_repository.repo.name
    branch_name       = "main"
    directory_name    = "/"
  }
  git_credentials = {
    source        = "ConfiguredConnection"
    connection_id = fabric_connection.ado_terraform_conn.id
  }
}

Results:

│ Warning: 'Connection' preview mode
│ 
│   with fabric_connection.ado_terraform_conn,
│   on resource.tf line 53, in resource "fabric_connection" "ado_terraform_conn":
│   53: resource "fabric_connection" "ado_terraform_conn" {
│ 
│ The 'Connection' behavior may change in future releases without notice or compatibility guarantees.
│ 
│ (and one more similar warning elsewhere)
╵
╷
│ Warning: 'Workspace Git' preview mode
│ 
│   with fabric_workspace_git.azdo,
│   on resource.tf line 85, in resource "fabric_workspace_git" "azdo":
│   85: resource "fabric_workspace_git" "azdo" {
│ 
│ The 'Workspace Git' behavior may change in future releases without notice or compatibility guarantees.
│ 
│ (and one more similar warning elsewhere)
╵

Apply complete! Resources: 7 added, 0 changed, 0 destroyed.

As you can see, the configuration successfully created a new workspace with a warehouse inside. The project repository was also created as expected, and the association through fabric_workspace_git completed successfully with synchronization working as intended.

To help us better understand and troubleshoot your case, could you please share your Terraform configuration (with any sensitive details redacted)? This will help us reproduce the exact setup and pinpoint any differences.

[liquorichris]

Thanks for the reply.

The issue is occurring because we have a warehouse that exists in the workspace prior to running the terraform. If I remove the existing warehouse and create it using terraform, the terraform completes.

So the process I used:

1. Create a warehouse and workspace_git resource per your example above. Terraform completes successfully. ✅
2. Manually create a warehouse item in the target workspace, comment out the workspace resource in the terraform. Terraform fails ❌

Could not create resource: The request could not be processed due to missing or invalid information / The operation is not supported for the principal type.

It did not matter how or who created the warehouse item. I attempted to use my user account as well as a service principal, the terraform still failed.

It was not until I deleted the warehouse item from the workspace that the terraform completed.

Hopefully that help.

Thank you