`az ad app create` error: Invalid key type.

[Niviral]

This is autogenerated. Please review and update as needed.

Describe the bug

MS documentation and --help command describe that --key-type can be set as one of three values {AsymmetricX509Cert, Password, Symmetric}. However, trying to set value as Password led to error. It's funny because if you make a typo and set value of --key-type as for example Passwor it will ask if I had in mind Password. But providing Password will throw Invalid key Type
Command Name
az ad app create

Errors:

Invalid key type.

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az ad app create --display-name {} --key-type --key-value {} --key-display-name {}

Expected Behavior

Create app registration containing password secret.

Environment Summary

Linux-5.10.102.1-microsoft-standard-WSL2-x86_64-with-glibc2.31, Ubuntu 20.04.5 LTS
Python 3.10.5
Installer: DEB

azure-cli 2.40.0

Extensions:
interactive 0.4.5

Dependencies:
msal 1.18.0b1
azure-mgmt-resource 21.1.0b1

Additional Context

[yonzhan]

@jiasli for awareness

[Niviral]

Hi, is there any update?

[alexmg]

The same issue is present with the az ad app update command so that cannot be used as a workaround.

[jiasli]

Indeed, the help message shows acceptable values are AsymmetricX509Cert, Password, Symmetric.

> az ad app create --help
...
    --key-type                     : The type of the key credentials associated with the
                                     application.  Allowed values: AsymmetricX509Cert, Password,
                                     Symmetric.  Default: AsymmetricX509Cert.

I did a git blame and saw key_type with its value Password was firstly introduced by 6b906d6 6 years ago on 2016-08-10:

azure-cli/src/command_modules/azure-cli-role/azure/cli/command_modules/role/_params.py

Line 20 in 6b906d6

register_cli_argument('ad app', 'key_type', choices=['AsymmetricX509Cert', 'Password', 'Symmetric'], default='AsymmetricX509Cert',

However, the swagger for AD Graph declares it only supports AsymmetricX509Cert and Symmetric:

https://github.com/Azure/azure-rest-api-specs/blob/8a6dd3376d8a5481be5d5de469cba3f9825a8a63/specification/graphrbac/data-plane/Microsoft.GraphRbac/stable/1.6/graphrbac.json#L2931-L2934

        "type": {
          "type": "string",
          "description": "Type. Acceptable values are 'AsymmetricX509Cert' and 'Symmetric'."
        },

The MS Graph API doc shows the same:

https://learn.microsoft.com/en-us/graph/api/resources/keycredential?view=graph-rest-1.0#properties

So I guess Password is never a valid option for --key-type.

Solution

The correct way to create a password credential is to use az ad app credential reset. Due to MS Graph API design, it is not allowed to specify your own password when creating/updating an app. This behavior is described in detail in https://learn.microsoft.com/en-us/cli/azure/microsoft-graph-migration.