Bugfix: retrieve authenticated principal from MS Graph when oid claim is missing from access token

internal/clients/client.go

@@ -5,11 +5,13 @@ import (
 	"encoding/json"
 	"fmt"
 	"log"
+	"strings"
 
+	"github.com/hashicorp/terraform-provider-azuread/internal/common"
 	"github.com/manicminer/hamilton/auth"
 	"github.com/manicminer/hamilton/environments"
+	"github.com/manicminer/hamilton/odata"
 
-	"github.com/hashicorp/terraform-provider-azuread/internal/common"
 	administrativeunits "github.com/hashicorp/terraform-provider-azuread/internal/services/administrativeunits/client"
 	applications "github.com/hashicorp/terraform-provider-azuread/internal/services/applications/client"
 	approleassignments "github.com/hashicorp/terraform-provider-azuread/internal/services/approleassignments/client"
@@ -28,6 +30,7 @@ type Client struct {
 	Environment environments.Environment
 	TenantID    string
 	ClientID    string
+	ObjectID    string
 	Claims      auth.Claims
 
 	TerraformVersion string
@@ -83,7 +86,45 @@ func (client *Client) build(ctx context.Context, o *common.ClientOptions) error
 	}
 
 	// Missing object ID of token holder will break many things
-	if client.Claims.ObjectId == "" {
+	client.ObjectID = client.Claims.ObjectId
+	if client.ObjectID == "" {
+		if strings.Contains(strings.ToLower(client.Claims.Scopes), "openid") {
+			log.Printf("[DEBUG] Querying Microsoft Graph to discover authenticated user principal object ID because the `oid` claim was missing from the access token")
+			result, _, err := client.Users.MeClient.Get(ctx, odata.Query{})
+			if err != nil {
+				return fmt.Errorf("attempting to discover object ID for authenticated user principal: %+v", err)
+			}
+
+			id := result.ID
+			if id == nil {
+				return fmt.Errorf("attempting to discover object ID for authenticated user principal: returned object ID was nil")
+			}
+
+			client.ObjectID = *id
+		} else {
+			log.Printf("[DEBUG] Querying Microsoft Graph to discover authenticated service principal object ID because the `oid` claim was missing from the access token")
+			query := odata.Query{
+				Filter: fmt.Sprintf("appId eq '%s'", client.ClientID),
+			}
+			result, _, err := client.ServicePrincipals.ServicePrincipalsClient.List(ctx, query)
+			if err != nil {
+				return fmt.Errorf("attempting to discover object ID for authenticated service principal: %+v", err)
+			}
+
+			if len(*result) != 1 {
+				return fmt.Errorf("attempting to discover object ID for authenticated service principal: unexpected number of results, expected 1, received %d", len(*result))
+			}
+
+			id := (*result)[0].ID()
+			if id == nil {
+				return fmt.Errorf("attempting to discover object ID for authenticated service principal: returned object ID was nil")
+			}
+
+			client.ObjectID = *id
+		}
+	}
+
+	if client.ObjectID == "" {
 		return fmt.Errorf("parsing claims in access token: oid claim is empty")
 	}
 

internal/provider/provider_test.go

@@ -299,6 +299,10 @@ func testCheckProvider(provider *schema.Provider) (errs []error) {
 		errs = append(errs, fmt.Errorf("client.TenantID was empty"))
 	}
 
+	if client.ObjectID == "" {
+		errs = append(errs, fmt.Errorf("client.ObjectID was empty"))
+	}
+
 	if client.Claims.TenantId == "" {
 		errs = append(errs, fmt.Errorf("TenantId was not populated in client.Claims"))
 	}
@@ -307,5 +311,5 @@ func testCheckProvider(provider *schema.Provider) (errs []error) {
 		errs = append(errs, fmt.Errorf("ObjectId was not populated in client.Claims"))
 	}
 
-	return
+	return //nolint:nakedret
 }

internal/services/applications/application_resource.go

@@ -886,7 +886,7 @@ func applicationResourceCreate(ctx context.Context, d *schema.ResourceData, meta
 	client := meta.(*clients.Client).Applications.ApplicationsClient
 	appTemplatesClient := meta.(*clients.Client).Applications.ApplicationTemplatesClient
 	directoryObjectsClient := meta.(*clients.Client).Applications.DirectoryObjectsClient
-	callerId := meta.(*clients.Client).Claims.ObjectId
+	callerId := meta.(*clients.Client).ObjectID
 	displayName := d.Get("display_name").(string)
 	templateId := d.Get("template_id").(string)
 

internal/services/groups/group_resource.go

@@ -406,7 +406,7 @@ func groupResourceCustomizeDiff(ctx context.Context, diff *schema.ResourceDiff,
 func groupResourceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client := meta.(*clients.Client).Groups.GroupsClient
 	directoryObjectsClient := meta.(*clients.Client).Groups.DirectoryObjectsClient
-	callerId := meta.(*clients.Client).Claims.ObjectId
+	callerId := meta.(*clients.Client).ObjectID
 
 	displayName := d.Get("display_name").(string)
 
@@ -801,7 +801,7 @@ func groupResourceCreate(ctx context.Context, d *schema.ResourceData, meta inter
 func groupResourceUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client := meta.(*clients.Client).Groups.GroupsClient
 	directoryObjectsClient := meta.(*clients.Client).Groups.DirectoryObjectsClient
-	callerId := meta.(*clients.Client).Claims.ObjectId
+	callerId := meta.(*clients.Client).ObjectID
 
 	groupId := d.Id()
 	displayName := d.Get("display_name").(string)

internal/services/serviceprincipals/client_config_data_source.go

@@ -44,9 +44,9 @@ func clientConfigDataSource() *schema.Resource {
 
 func clientConfigDataSourceRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client := meta.(*clients.Client)
-	d.SetId(fmt.Sprintf("%s-%s-%s", client.TenantID, client.ClientID, client.Claims.ObjectId))
+	d.SetId(fmt.Sprintf("%s-%s-%s", client.TenantID, client.ClientID, client.ObjectID))
 	tf.Set(d, "tenant_id", client.TenantID)
 	tf.Set(d, "client_id", client.ClientID)
-	tf.Set(d, "object_id", client.Claims.ObjectId)
+	tf.Set(d, "object_id", client.ObjectID)
 	return nil
 }

internal/services/serviceprincipals/service_principal_resource.go

@@ -353,7 +353,7 @@ func servicePrincipalDiffSuppress(k, old, new string, d *schema.ResourceData) bo
 func servicePrincipalResourceCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client := meta.(*clients.Client).ServicePrincipals.ServicePrincipalsClient
 	directoryObjectsClient := meta.(*clients.Client).ServicePrincipals.DirectoryObjectsClient
-	callerId := meta.(*clients.Client).Claims.ObjectId
+	callerId := meta.(*clients.Client).ObjectID
 
 	appId := d.Get("application_id").(string)
 	result, _, err := client.List(ctx, odata.Query{Filter: fmt.Sprintf("appId eq '%s'", appId)})

internal/services/users/client/client.go

@@ -1,25 +1,29 @@
 package client
 
 import (
-	"github.com/manicminer/hamilton/msgraph"
-
 	"github.com/hashicorp/terraform-provider-azuread/internal/common"
+	"github.com/manicminer/hamilton/msgraph"
 )
 
 type Client struct {
 	DirectoryObjectsClient *msgraph.DirectoryObjectsClient
+	MeClient               *msgraph.MeClient
 	UsersClient            *msgraph.UsersClient
 }
 
 func NewClient(o *common.ClientOptions) *Client {
 	directoryObjectsClient := msgraph.NewDirectoryObjectsClient(o.TenantID)
 	o.ConfigureClient(&directoryObjectsClient.BaseClient)
 
+	meClient := msgraph.NewMeClient(o.TenantID)
+	o.ConfigureClient(&meClient.BaseClient)
+
 	usersClient := msgraph.NewUsersClient(o.TenantID)
 	o.ConfigureClient(&usersClient.BaseClient)
 
 	return &Client{
 		DirectoryObjectsClient: directoryObjectsClient,
+		MeClient:               meClient,
 		UsersClient:            usersClient,
 	}
 }