Azure-docs: Azure CR: Authentication using a service prinpcal

[baywet]

When configuring a service principal to login with docker login, from the current documentation, it's not clear which password should be used: the MSA password? The Azure CR admin account password? The Application registration secret? something else? I think this line of shell script should be updated and explained further

docker login myregistry.azurecr.io -u xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx -p myPassword

I tried with the secret of my application registration and I get a unauthorized response.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: df40e112-6cf4-f6ce-4d82-d36bbd561405
• Version Independent ID: a68e6e7b-dfa2-8640-0a43-cd15f24facdb
• Content: Authenticate with an Azure container registry
• Content Source: articles/container-registry/container-registry-authentication.md
• Service: container-registry
• GitHub Login: @SteveLas
• Microsoft Alias: stevelas

[mimckitt]

Thanks for the feedback! We are currently investigating and will update you shortly.

[mimckitt]

@baywet fair feedback. The password should be located in your ACR. If you go to your ACR -> Access Keys -> Username & Password

I will assign this to the content author to review and see if we can make the doc more clear

[SteveLasker]

Actually, we really recommend not using the Admin account for anything but demos and really simple, and not very secure scenarios.
For Service Principals, use the service principal appid for the user, and the service principal password, ...for the password
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal#create-a-service-principal

SP_PASSWD=$(az ad sp create-for-rbac --name $SERVICE_PRINCIPAL_NAME --scopes $ACR_REGISTRY_ID --role reader --query password --output tsv)
SP_APP_ID=$(az ad sp show --id http://$SERVICE_PRINCIPAL_NAME --query appId --output tsv)

Here's a better, real world example:
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-quick-task#configure-registry-authentication

To your original point, I'm adding @iainfoulds @dlepow to add docker login with the values from the service principal to the docs.

[baywet]

Thanks for the precision. I came accross this piece of documentation.
My feedback is this section of the page: https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/container-registry/container-registry-authentication.md#service-principal is titled "service principal", however the command line provided within it has "myPassword"
Additional feedback for the documentation you mentioned @SteveLasker it'd be nice to have the equivalent actions in the azure portal just for reference.

[dlepow]

@MicahMcKittrick-MSFT - Micah, please assign this issue to me. I'm planning a small doc update to clarify these points. Thanks!

[dlepow]

ACR authentication guidance updated, pending publish later today: https://github.com/MicrosoftDocs/azure-docs-pr/pull/60569. This includes guidance on recommended RBAC roles such as acrpush and acrpull.
@baywet - Thanks again for raising the issue. For now we don't provide portal steps for generating a service principal for ACR, but there are generic examples in the RBAC documentation that might help.

please-close

[wtam]

I just find out lately I've a container on AKS keep failing with below error:
"Failed to pull image "azcontainerregistrydemo.azurecr.io/qanetdemo-container": rpc error: code = Unknown desc = Error response from daemon: Get https://azcontainerregistrydemo.azurecr.io/v2/qanetdemo-container/manifests/latest: unauthorized: authentication required"

Then I try to perform docker login cmd and see this strange error which never happen before "Error response from daemon: An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full." I wonder if anyone else has the same issue and associate of why I got fail pulling the img from my AKS?