Azure-cli: webapp identity assign does not work for a slot

[ffloimair]

Describe the bug
Azure CLI fails when trying to create a Managed Service Identity for an AppService slot. Even though the parameter "--slot" is documented it does not work and throws a Python exception.

To Reproduce
az webapp identity assign --name [AppService-Name] --resource-group [RGname] --slot [SlotName]

Expected behavior
The command should succeed and create a Managed service identity assigned to an AppService slot.

Environment summary
Tried on 3 different platforms: AzureCLI (2.0.49) on Azure Portal Cloud Shell, AzureCLI (2.0.49) on Debian Stretch Linux and AzureCLI (2.0.49) on MacOS Mojave. The result is the same on all platforms.

Additional context
The command throws the following Python error on all 3 tested platforms:

'NoneType' object has no attribute 'identity'
Traceback (most recent call last):
File "/opt/az/lib/python3.6/site-packages/knack/cli.py", line 197, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/__init__.py", line 372, in execute
six.reraise(sys.exc_info())
File "/opt/az/lib/python3.6/site-packages/six.py", line 693, in reraise
raise value
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/__init__.py", line 346, in execute
result = cmd(params)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/__init__.py", line 182, in __call__
return self.handler(args, kwargs)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/__init__.py", line 436, in default_command_handler
result = op(command_args)
File "/opt/az/lib/python3.6/site-packages/azure/cli/command_modules/appservice/custom.py", line 403, in assign_identity
webapp = _assign_identity(cmd.cli_ctx, getter, setter, role, scope)
File "/opt/az/lib/python3.6/site-packages/azure/cli/core/commands/arm.py", line 987, in assign_identity
resource = setter(resource)
File "/opt/az/lib/python3.6/site-packages/azure/cli/command_modules/appservice/custom.py", line 398, in setter
webapp.identity = ManagedServiceIdentity(type='SystemAssigned')
AttributeError: 'NoneType' object has no attribute 'identity'

[yugangw-msft]

Works for me. Please cross check the webapp name, resource group name.

az webapp identity assign -s yg-slot --scope /subscriptions/abcd-1234/resourceGroups/yg -g yg -n yg-web
{
  "identityIds": null,
  "principalId": "abcd",
  "tenantId": "1234",
  "type": "SystemAssigned"
}

@panchagnula, let us emit out a better error when the webapp was not found

[ffloimair]

As already mentioned: It does work for the production slot (called with no slot-parameter). It does not work for the explicit slot itself, so naming of App and/or resource group is definitely not the issue. I use the same parameters and just add --slot . I did not use a scope though (as I don't want it and according to documentation it is not a required parameter).

[yugangw-msft]

Like the example I posted, I did try with explicit slot and verified it worked

[ffloimair]

Like the example I posted, I did try with explicit slot and verified it worked

And like I have written in my previous post you did NOT use the same parameter set as I did, since your command contains a "--scope" parameter, which according to the docs is optional. So whether it's a bug in the documentation (if the scope parameter is required when using the command with a slot) or in the code, it's still a bug and does not work as documented.

[ffloimair]

Can someone please acknowledge this issue.
And please don't tell me "works for me" if it's not done exactly as described.
This is a rather painful experience to be honest.
I don't expect this to be fixed in no time but I do expect an acknowledgement.

[yugangw-msft]

@panchagnula, the stack clearly shows the webapp is not found. The error has nothing to do with the --scope parameter

[robinrogne]

I could confirm that i have the same issue as @ffloimair.

[panchagnula]

@ffloimair & @robinrogne , are you still seeing this issue? We are unable to repro this on our end? If you are still seeing this can you share some more info with us?

1. is this specific to CLI only? what happens if you try to set this using the portal?
2. if this is specific to the CLI, can you check that you are using the right subscription using CLI, please run az account show & verify that the id is points to the correct subscription.

[ffloimair]

Yes, it is specific to CLI only. It works in the portal.
I did verify the correct subscription. It works for all Webapps in it, it does not work for the slots.

[ffloimair]

I haven't checked with a recent version though, as there was no progress in this issue. I will check again tomorrow and let you know.

[panchagnula]

@ffloimair if you are still able to repro this with the latest CLI on the specific slot can you please run the command with --debug parameter at the end & copy paste the results here?

[ffloimair]

I just retested with the most recent Azure CLI version and this works now.
Issue may be closed.
Thanks for fixing.

[panchagnula]

@ffloimair thanks for the update