Fix #371: Allow optional subscriptionId in creds

[MoChilia]

Description

This pr will remove the mandatory requirement of subscriptionId in creds to solve #371.

subscription-id	allow-no-subscriptions	Log in successfully	Test
✔️	❌	✔️	Creds: login/.github/workflows/azure-login-positive.yml Lines 37 to 41 in 7acbecf - name: Login with creds uses: ./ with: creds: ${{secrets.SP1}} enable-AzPSSession: true OIDC: login/.github/workflows/azure-login-positive.yml Lines 61 to 67 in 7acbecf - name: Login with individual parameters uses: ./ with: client-id: ${{ secrets.SP1_CLIENT_ID }} tenant-id: ${{ secrets.SP1_TENANT_ID }} subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }} enable-AzPSSession: true
❌	✔️	✔️	Creds: login/.github/workflows/azure-login-positive.yml Lines 223 to 228 in 7acbecf - name: Login with creds, no subscription, allow no subscription uses: ./ with: creds: '{"clientId":"${{ secrets.OIDC_SP2_CLIENT_ID }}","clientSecret":"${{ secrets.SP2_CLIENT_SECRET }}","tenantId":"${{ secrets.OIDC_SP2_TENANT_ID }}"}' allow-no-subscriptions: true enable-AzPSSession: true OIDC: login/.github/workflows/azure-login-positive.yml Lines 201 to 207 in 7acbecf - name: Login with individual parameters, no subscription, allow no subscription uses: ./ with: client-id: ${{ secrets.OIDC_SP2_CLIENT_ID }} tenant-id: ${{ secrets.OIDC_SP2_TENANT_ID }} allow-no-subscriptions: true enable-AzPSSession: true
✔️	✔️	✔️	Creds: login/.github/workflows/azure-login-positive.yml Lines 153 to 158 in 7acbecf - name: Login with creds, allow no subscription uses: ./ with: creds: ${{secrets.SP1}} allow-no-subscriptions: true enable-AzPSSession: true OIDC: login/.github/workflows/azure-login-positive.yml Lines 178 to 185 in 7acbecf - name: Login with individual parameters, allow no subscription uses: ./ with: client-id: ${{ secrets.SP1_CLIENT_ID }} tenant-id: ${{ secrets.SP1_TENANT_ID}} subscription-id: ${{ secrets.SP1_SUBSCRIPTION_ID }} allow-no-subscriptions: true enable-AzPSSession: true
❌	❌	❌	Creds: login/.github/workflows/azure-login-negative.yml Lines 407 to 413 in 7acbecf - name: Login with creds, no subscription-id, no allow-no-subscriptions id: login_15 continue-on-error: true uses: ./ with: creds: '{"clientId":"${{ secrets.OIDC_SP2_CLIENT_ID }}","clientSecret":"${{ secrets.SP2_CLIENT_SECRET }}","tenantId":"${{ secrets.OIDC_SP2_TENANT_ID }}"}' enable-AzPSSession: true OIDC: login/.github/workflows/azure-login-negative.yml Lines 391 to 398 in 7acbecf - name: Login with individual parameters, no subscription-id, no allow-no-subscriptions id: login_14 continue-on-error: true uses: ./ with: client-id: ${{ secrets.OIDC_SP2_CLIENT_ID }} tenant-id: ${{ secrets.OIDC_SP2_TENANT_ID }} enable-AzPSSession: true

Validation for both subscription-id and allow-no-subscriptions are missed:

login/src/common/LoginConfig.ts

Lines 102 to 104 in 31435a1

	if (!this.subscriptionId && !this.allowNoSubscriptionsLogin) {
	throw new Error("Ensure subscriptionId is supplied.");
	}

If subscription-id is given, then set the subscription:

login/src/Cli/AzureCliLogin.ts

Lines 129 to 131 in 31435a1

	if (this.loginConfig.subscriptionId) {
	await this.setSubscription();
	}

login/src/PowerShell/AzPSScriptBuilder.ts

Lines 106 to 108 in 31435a1

	if(subscriptionId){
	loginCmdlet += `-Subscription '${subscriptionId}' `;
	}

Negative test for login tenant-level account with subscription-id (no permission to subscriptions):

login/.github/workflows/azure-login-negative.yml

Lines 355 to 373 in 7acbecf

	# SP1 is ignored and SP2 will be used for login, but it will fail since SP2 has no access to the given subscription
	- name: Login with both creds and individual parameters
	id: login_12
	continue-on-error: true
	uses: ./
	with:
	creds: ${{secrets.SP1}}
	client-id: ${{ secrets.OIDC_SP2_CLIENT_ID }}
	tenant-id: ${{ secrets.OIDC_SP2_TENANT_ID }}
	subscription-id: ${{ secrets.OIDC_SP2_SUBSCRIPTION_ID }}
	allow-no-subscriptions: true
	enable-AzPSSession: true
	- name: Check Last step failed
	if: steps.login_12.outcome == 'success'
	uses: actions/github-script@v3
	with:
	script: |
	core.setFailed('Last action should fail but not. Please check it.')

[jiasli]

If both allow-no-subscriptions and subscription-id are provided, will subscription-id take effect? If so, it is worth explaining that in the document.

[MoChilia]

If both allow-no-subscriptions and subscription-id are provided, will subscription-id take effect? If so, it is worth explaining that in the document.

subscription-id will always be set once it is provided.