Not able to retrieve azure service principal password using azure sdk for python

[MonikaReddy-MSFT]

From Customer Question - MicrosoftDocs/azure-docs-cli#2052

Is there a way to retrieve azure service principal password using azure sdk for python? I am creating service principal using following but service principal create response has empty password.

def create_azure_service_principal(self, app_name=None):

app = self.graphrbac_client.applications.create({
    'available_to_other_tenants': False,
    'display_name': app_name,
    'identifier_uris': [f'http://{app_name}'],
    'app_roles': []
})

sp = self.graphrbac_client.service_principals.create({
    'app_id': app.app_id,
    'account_enabled': True
})
return sp

Here is the response :

{
'additional_properties': {
'odata.type': 'Microsoft.DirectoryServices.ServicePrincipal',
'signInAudience': 'AzureADMyOrg',
'preferredSingleSignOnMode': None,
'preferredTokenSigningKeyEndDateTime': None,
'samlSingleSignOnSettings': None,
'applicationTemplateId': None,
'notificationEmailAddresses': [],
'addIns': [],
'tokenEncryptionKeyId': None,
'informationalUrls': {
'termsOfService': None,
'support': None,
'privacy': None,
'marketing': None
},
'odata.metadata': 'https://graph.windows.net/<tenant_id>/$metadata#directoryObjects/@element'
},
'object_id': '<object_id>',
'deletion_timestamp': None,
'object_type': 'ServicePrincipal',
'account_enabled': True,
'alternative_names': [],
'app_display_name': 'my-test',
'app_id': '<app_id>',
'app_owner_tenant_id': '<tenant_id>',
'app_role_assignment_required': False,
'app_roles': [],
'display_name': 'my-test',
'error_url': None,
'homepage': None,
'key_credentials': [],
'logout_url': None,
'oauth2_permissions': [ < azure.graphrbac.models.oauth2_permission_py3.OAuth2Permission object at 0x7f64567b67810 > ],
'password_credentials': [],
'preferred_token_signing_key_thumbprint': None,
'publisher_name': 'Default Directory',
'reply_urls': [],
'saml_metadata_url': None,
'service_principal_names': ['<app_id>'],
'service_principal_type': 'Application',
'tags': []
}

Is there a way to reset the service principal using python sdk?

Not : I know we can this using azure cli but not sure if i want to mix azure sdk and cli in my code.

Please advice...

[lmazuel]

@yugangw-msft may I pull your memory here, even if I know you didn't use that SDK for a long time now :)

[shawncx]

@MonikaReddy-MSFT In my understanding, password cred should belongs to app, but not sp. You can get the password when you first create the app

[tapatel]

@shawncx Following is app creation response. We don't see password field in there.

Looking at Azure CLI doc, We get app id and password when we create ServicePrincipal. So we want to know following :

Using Azure sdk/api :

1. how do we create service principal to get app_id and password?
2. How to retrieve the existing service principal password?
3. How to reset the existing ServicePrincipal password?

It will be great if you can share some code snippet. Please advice...

Response after creating App :

{
'additional_properties': {
'parentalControlSettings': {
'countriesBlockedForMinors': [],
'legalAgeGroupRule': 'Allow'
},
'logo@odata.mediaEditLink': 'directoryObjects/{}/Microsoft.DirectoryServices.Application/logo',
'acceptMappedClaims': None,
'logoUrl': None,
'applicationTemplateId': None,
'addIns': [],
'mainLogo@odata.mediaEditLink': 'directoryObjects/{}/Microsoft.DirectoryServices.Application/mainLogo',
'tokenEncryptionKeyId': None,
'logo@odata.mediaContentType': 'application/json;odata=minimalmetadata; charset=utf-8',
'recordConsentConditions': None,
'oauth2AllowIdTokenImplicitFlow': True,
'odata.type': 'Microsoft.DirectoryServices.Application',
'odata.metadata': 'https://graph.windows.net/{}/$metadata#directoryObjects/@Element'
},
'object_id': '<obj_id>',
'deletion_timestamp': None,
'object_type': 'Application',
'app_id': '<app_id>',
'allow_guests_sign_in': None,
'allow_passthrough_users': None,
'app_logo_url': None,
'app_roles': [],
'app_permissions': None,
'available_to_other_tenants': False,
'display_name': 'test-app',
'error_url': None,
'group_membership_claims': None,
'homepage': None,
'identifier_uris': ['http://test-app'],
'informational_urls': < > ,
'is_device_only_auth_supported': None,
'key_credentials': [],
'known_client_applications': [],
'logout_url': None,
'oauth2_allow_implicit_flow': False,
'oauth2_allow_url_path_matching': False,
'oauth2_permissions': [ < > ],
'oauth2_require_post_response': False,
'org_restrictions': [],
'optional_claims': None,
'password_credentials': [],
'pre_authorized_applications': None,
'public_client': None,
'publisher_domain': '<email_addr>',
'reply_urls': [],
'required_resource_access': [],
'saml_metadata_url': None,
'sign_in_audience': '<>',
'www_homepage': None
}

[tapatel]

@shawncx @MonikaReddy-MSFT Any update on this issue? Please let me know if you need any more info.

[debugaftercoffee]

I am trying to do the same thing, did you find a way to get the service principal password using the Python SDK?