0

I've created a Service Fabric cluster via the portal, using the Basic configuration type for Security, so it automatically generated certificates in a key vault of my choice.

I've then created Azure AD applications per instructions at https://docs.microsoft.com/en-gb/azure/service-fabric/service-fabric-cluster-creation-via-arm#set-up-azure-active-directory-for-client-authentication and assigned myself the Admin role in the enterprise _Cluster application.

Next I've configured AAD security for the cluster, using the values from the PowerShell script used in the previous step.

I can now deploy from within Visual Studio, so at least part of it is working. However when navigating to the Service Fabric Explorer, I get the following error when signing in:

AADSTS65005: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Client app ID: [redacted]. Resource value from request: . Resource app ID: 00000002-0000-0000-c000-000000000000. List of valid resources from app registration: .

What step have I missed that causes this error?

  • Can someone create the azure-service-fabric tag for me? – Stijn May 2 '18 at 10:39
0

After looking at the SetupApplications.ps1 source, I noticed the following:

.PREREQUISITE
1. An Azure Active Directory tenant.
2. A Global Admin user within tenant.

...

.PARAMETER AddResourceAccess
Used to add the cluster application's resource access to "Windows Azure Active Directory" application explicitly when AAD is not able to add automatically. This may happen when the user account does not have adequate permission under this subscription.

Adding the AddResourceAccess switch fixed the issue, it now adds a Windows Azure Active Directory entry for the _Cluster app registration.

Note that even a subscription owner needs to add the switch, apparently even those accounts lack the required permissions. It's evident by the new error message shown when logging in, indicating that you need the assistance of a global admin to complete the configuration:

foo_Cluster needs permission to access resources in your organisation that only an admin can grant. Please ask an admin to grant permission to this app before you can use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.