az apim api import spawns Error "Cannot use OAuth2AuthenticationSettings in combination with OAuth2 nor openid"

Question

Since yesterday morning, we are stuck importing APIs to APIManagement with this error, returned by every "az apim api import" or "az apim api update". Really nothing changed from our side.

ERROR: (ValidationError) Cannot use OAuth2AuthenticationSettings in combination with OAuth2 nor openid.

Code: ValidationError

This is already configured since our first bicep deploy...

When lookup at the exported ARM template of the APIM resource, we see however that both are set for our APIs.

                "authenticationSettings": {
                    "oAuth2": {
                        "authorizationServerId": "buildappsad"
                    },
                    "oAuth2AuthenticationSettings": [
                        {
                            "authorizationServerId": "buildappsad"
                        }
                    ],
                    "openidAuthenticationSettings": []
                },

Also the Azure portal will clear both, when you clear the authentication settings, and will fill both together when you select OAuth2 again. I also tried clearing them using the Portal, next deploying our bicep again (only setting only OAuth2 or either OAuth2AuthenticationSettings for the APIs), but again both properties exist after the deploy! So this proves we set the authentication settings again, and I could determine looking at outputs from my bicep module in the Azure Portal, that the properties where set correctly, having only 1 OAuth2 authentication setting.

We never set OAuth2AuthenticationSettings and OAuth2 at the same time. The DevOps pipeline running the az apim api import's runs on a MS hosted Ubuntu agent (ubuntu-latest).So it seems that whatever we, or the Azure Portal itself, try, sets both OAuth2 setting, as shown in the ARM snippet, however Azure CLI cannot cope with this when updating, or importing to an API...

Did something change to Azure?

Can this be fixed urgently?

Regards,

Tim

Answer 1

Hello @Tim Serneels ,

Thanks for reaching out on Microsoft Q&A and really appreciate your patience while we looked into this.

You already discovered this workaround: “We will do the description update in the JSON itself before importing it instead.”

instead of updating an existing API (via az apim api update), just:

Edit the OpenAPI JSON or ARM export to remove one of the fields

Then az apim api import the full API spec again

I hope the provided answer is helpful, do let me know if you have any further questions on this

Thanks

Answer 2

We could isolate the problem to only "az apim api update" not being able to update, not clear why because of this totally wrong error message...

We will do the description update in the json itself before importing it instead.

So, we're back in business, I will not follow up this ticket any longer, despite the clear wrong error message bug returned by the CLI (or Azure?).

Regards,

Tim

Answer 3

Hello @Tim Serneels ,

Sorry to see you facing such issue with azure cli tool. From LCM point of view I'd recommend switching to Bicep, ARM, Terraform alternative option that's where you will have more control over what version of Azure REST API is used and when to upgrade/migrate.

From my own experience, for the issue you've shared I'd reach out to MS support team through your Employer/Client channels. That's where you can share the business impact and accelerate a hot fix.