Azure-cli: Azure password not working if password starts or contains "-"

[dcaro]

Describe the bug
When authenticating using az login -u -p , the authentication fails if the password is using a "-".

If the "-" is at the beginning, the following error is returned:
az login: error: argument --password/-p: expected one argument

If the "-" is in the middle, the following error is returned:
Get Token request returned http error: 400 and server response: {"error":"invalid_grant","error_description":"AADSTS70002: Error validating credentials. AADSTS50126: Invalid username or password\r\nTrace ID:

To Reproduce
Create a user with a password that contains a "-" and try to login using the following command:
az login -u -p

Expected behavior
Authentication to work with any passwords

Environment summary
azure-cli (2.0.44)

acr (2.1.3)
acs (2.3.0)
advisor (0.6.0)
ams (0.2.2)
appservice (0.2.2)
backup (1.2.0)
batch (3.3.2)
batchai (0.4.1)
billing (0.2.0)
cdn (0.1.0)
cloud (2.1.0)
cognitiveservices (0.2.0)
command-modules-nspkg (2.0.2)
configure (2.0.18)
consumption (0.4.0)
container (0.3.3)
core (2.0.44)
cosmosdb (0.2.0)
dla (0.2.1)
dls (0.1.0)
dms (0.1.0)
eventgrid (0.2.0)
eventhubs (0.2.2)
extension (0.2.1)
feedback (2.1.4)
find (0.2.12)
interactive (0.3.28)
iot (0.3.0)
iotcentral (0.1.0)
keyvault (2.2.2)
lab (0.1.0)
maps (0.3.1)
monitor (0.2.2)
network (2.2.3)
nspkg (3.0.3)
policyinsights (0.1.0)
profile (2.1.1)
rdbms (0.3.0)
redis (0.3.0)
relay (0.1.0)
reservations (0.3.1)
resource (2.1.2)
role (2.1.3)
search (0.1.1)
servicebus (0.2.1)
servicefabric (0.1.1)
sql (2.1.2)
storage (2.2.0)
telemetry (1.0.0)
vm (2.2.1)

Additional context
Add any other context about the problem here.

[OguzPastirmaci]

Same experience with $ and (.

Putting the password in single or double quotes doesn't fix the issue.

[tjprescott]

@yugangw-msft

I would start with:
https://www.gnu.org/software/bash/manual/html_node/Double-Quotes.html

[tjprescott]

Also, what shell are you using?

[dcaro]

This is on bash on ubuntu 16.04 LTS.

[yugangw-msft]

works for me in bash on ubuntu 16.04

az login --service-principal -t xxxxaxxxxxx -u xxxxxxxxxxx --allow-no-subscriptions -p haha-haha 

Is the dash a unicode in your password?

[yugangw-msft]

You can also capture the trace on the wire and cross check whether the password got sent to the service end w/o modifications

[dcaro]

I'm not using service principal, just username and password.
The password is a string that would look like: "-a1b2c3d4"

[yugangw-msft]

Using service principal or not doesn't matter from command parser's aspect as both flows share the same argument.
You do need to wrap -a1b2c3d4 with single quote as the leading - will confuse the parser to think -a is a flag.
To get me on the same page, if you wrap the password with quote, does it work now? if not, can you please check out the trace on the wire and see whether the right password get sent?

[apjanke]

You do need to wrap -a1b2c3d4 with single quote as the leading - will confuse the parser to think -a is a flag.

I don't think this is correct: on Unix, as opposed to Windows, quotes are interpreted by the shell, and are only needed if there are shell special characters that need escaping. - is not a shell special character. The az Python program will never see the quotes or know if they are there.

I can reproduce the leading-dash "expected one argument" behavior on macOS 10.13.6 with azure-cli (2.0.43). Quotes do not affect it.

$ az login -u foo -p -helloworld
az login: error: argument --password/-p: expected one argument
usage: az login [-h] [--verbose] [--debug] [--output {json,jsonc,table,tsv}]
                [--query JMESPATH] [--username USERNAME] [--password PASSWORD]
                [--service-principal] [--tenant TENANT]
                [--allow-no-subscriptions] [-i] [--use-device-code]
                [--subscription _SUBSCRIPTION]
$ az login -u foo -p '-helloworld'
az login: error: argument --password/-p: expected one argument
$ az --version | head
azure-cli (2.0.43)

I suspect that for this particular case, you may actually be running in to a bug in Python's argparse library, which is currently under discussion: https://bugs.python.org/issue9334. It exhibits the same "expected one argument" error.

(This doesn't apply to dashes in the middle of the password, which I haven't tested, or "$" or "(", which do need to be quoted, because they are shell special characters (and I also haven't tested).)

[yugangw-msft]

@apjanke, I think your analysis is right. I didn't tried out the password with leading dash, nor did I question argparse's behavior. Thanks.

[dcaro]

@apjanke this is indeed the bug that we are hitting in the az cli. Apparently AWS had the same issue since 2015 https://github.com/aws/aws-cli/issues/1135
@yugangw-msft the workaround is to use the long parameter set following this syntax:
az login --username=$azureUserName --password=$azurePassword

[jakobfischer17]

@dcaro the workaround does not work for non-interactive mode. When running:
$ az login --service-principal --username=$client --tenant=$tenant --password=$password
i get :
ERROR: Please specify both username and password in non-interactive mode.
Is there any solution available as of now?

[jiasli]

@jakobfischer17, the code hit here:

https://github.com/Azure/azure-cli/blob/944c0c3b1f30530a280bfaa6b7c7d799e3248f28/src/azure-cli/azure/cli/command_modules/profile/custom.py#L132-L137

It seems --password isn't received by Azure CLI correctly.

1. Could you share your user name and password? (Please remove some letters.)
2. What is the system and shell?