From 533c93c38eb68da014d9db27a06b290f9244521a Mon Sep 17 00:00:00 2001
From: Ajit Padhi <v-ajipadhi@microsoft.com>
Date: Fri, 14 Aug 2026 16:48:15 +0530
Subject: [PATCH] Identiti provider authentication issue fix

---
 .../post-provision/post_deployment_setup.ps1  | 22 +++++++++++++++++++
 .../post-provision/post_deployment_setup.sh   | 16 ++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/infra/scripts/post-provision/post_deployment_setup.ps1 b/infra/scripts/post-provision/post_deployment_setup.ps1
index 9ca598209..9dd788dc5 100644
--- a/infra/scripts/post-provision/post_deployment_setup.ps1
+++ b/infra/scripts/post-provision/post_deployment_setup.ps1
@@ -236,6 +236,28 @@ try {
         $env:AZURE_POSTGRES_DEPLOYER_PRINCIPAL_NAME = $DeployerUpn
     }
 
+    # -------------------------------------------------------
+    # Grant the deployer Container Apps Contributor at the resource group so the
+    # Microsoft identity provider (Easy Auth) can be configured manually on any
+    # container app in the RG. A direct (non-group) grant sidesteps the
+    # group-based-RBAC listSecrets validation failure. Idempotent.
+    # -------------------------------------------------------
+    $DeployerObjectId = az ad signed-in-user show --query "id" -o tsv 2>$null
+    if ($LASTEXITCODE -ne 0) { $DeployerObjectId = "" }
+    $ResourceGroupId = az group show --name $ResourceGroupName --query "id" -o tsv 2>$null
+    if ($LASTEXITCODE -ne 0) { $ResourceGroupId = "" }
+    if ($DeployerObjectId -and $ResourceGroupId) {
+        Write-Host "[OK] Granting Container Apps Contributor to deployer on '$ResourceGroupName'..."
+        az role assignment create `
+            --assignee-object-id $DeployerObjectId `
+            --assignee-principal-type User `
+            --role "358470bc-b998-42bd-ab17-a7e34c199c0f" `
+            --scope $ResourceGroupId 2>&1 | Out-Null
+            if ($LASTEXITCODE -ne 0) {
+                Write-Warning "Could not grant Container Apps Contributor (needs Owner or User Access Administrator). Configuring Easy Auth manually may fail until this role is assigned."
+            }
+    }
+
     Write-Host ""
     Write-Host "--- Running post_provision.py ---"
     Write-Host ""
diff --git a/infra/scripts/post-provision/post_deployment_setup.sh b/infra/scripts/post-provision/post_deployment_setup.sh
index e55551ef5..395573c16 100644
--- a/infra/scripts/post-provision/post_deployment_setup.sh
+++ b/infra/scripts/post-provision/post_deployment_setup.sh
@@ -202,6 +202,22 @@ if [ -n "$DEPLOYER_UPN" ]; then
     export AZURE_POSTGRES_DEPLOYER_PRINCIPAL_NAME="$DEPLOYER_UPN"
 fi
 
+# Grant the deployer Container Apps Contributor at the resource group so the
+# Microsoft identity provider (Easy Auth) can be configured manually on any
+# container app in the RG. A direct (non-group) grant sidesteps the
+# group-based-RBAC listSecrets validation failure. Idempotent.
+DEPLOYER_OBJECT_ID=$(az ad signed-in-user show --query "id" -o tsv 2>/dev/null || true)
+RESOURCE_GROUP_ID=$(az group show --name "$RESOURCE_GROUP" --query "id" -o tsv 2>/dev/null || true)
+if [ -n "$DEPLOYER_OBJECT_ID" ] && [ -n "$RESOURCE_GROUP_ID" ]; then
+    echo "✓ Granting Container Apps Contributor to deployer on '${RESOURCE_GROUP}'..."
+    az role assignment create \
+        --assignee-object-id "$DEPLOYER_OBJECT_ID" \
+        --assignee-principal-type User \
+        --role "358470bc-b998-42bd-ab17-a7e34c199c0f" \
+        --scope "$RESOURCE_GROUP_ID" >/dev/null 2>&1 || \
+        echo "⚠ Could not grant Container Apps Contributor (needs Owner or User Access Administrator). Configuring Easy Auth manually may fail until this role is assigned."
+fi
+
 echo ""
 echo "--- Running post_provision.py ---"
 echo ""