4 ms·

Azure identity is so bad. It's like they tried to build it on the original 1998 implementation of LDAP or whatever. Roles fucking inherit??? Like are you kiddin

Azure identity is so bad. It's like they tried to build it on the original 1998 implementation of LDAP or whatever. Roles fucking inherit??? Like are you kidding me?

high_na_euv 1y ago
>Roles fucking inherit?? Wdym?
- greenie_beans 1y ago
  i designed an extremely tightly scoped managed identity to do a job. my azure admin created the resources, and now that identity shows an inheritance chain that tracks all the way to that admin (aka a very privileged identity). which seems insane. i tested the identity to make sure it couldn't do privilege escalation...still, wtf? it might be my own fault where i'm doing something wrong, but that shouldn't even be possible for somebody to create a managed identity that would inherit from other identities. i don't trust that it's ok and i shouldn't be spending time figuring out if it is, i expect tightly scoped identities to just work...
  - fuzzy2 1y ago
    What inheritance chain? I'd say I'm quite proficient with Azure RBAC and I cannot understand what you're describing.
    - greenie_beans 1y ago
      https://learn.microsoft.com/en-us/answers/questions/969822/how-to-disable-rbac-inheritance-over-resources-on https://learn.microsoft.com/en-us/answers/questions/969822/h... and https://stackoverflow.com/questions/76618129/prevent-roles-from-being-inherited-by-a-managed-identity https://stackoverflow.com/questions/76618129/prevent-roles-f...
      - fuzzy2 1y ago
        These don't clarify your situation, sorry. They're also referring to two distinct scenarios. Especially regarding the SO question, I get the feeling that author is misunderstanding something. Where exactly are you seeing what exactly that might imply some kind of inheritance chain?
        greenie_beans 1y ago
        i get the sense that you're not trying to help but instead argue about it. i already described as much as i want to detail: https://news.ycombinator.com/item?id=44445382 https://news.ycombinator.com/item?id=44445382
        fuzzy2 1y ago
        Okay. Then I'll lay it out: there is no inheritance at all. An identity does not inherit roles and it certainly does not inherit other identities. You are misinterpreting something you saw. However, without further details, a more targeted answer is not possible. I did not want to write a blanket statement like that because it is very condescending and hostile. Sorry about that. You may have seen the identity's IAM page. It does not show roles assigned to the identity.
        greenie_beans 1y ago
        from the docs: > Lower levels inherit role permissions from higher levels...When you assign a role at a parent scope, those permissions are inherited to the child scopes https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps#step-3-identify-the-needed-scope https://learn.microsoft.com/en-us/azure/role-based-access-co... so i guess this what you said is confidently wrong lmao like you couldn't even be more wrong: > Then I'll lay it out: there is no inheritance at all. An identity does not inherit roles and it certainly does not inherit other identities. i misspoke calling it "identity inheritance" and not "scope inheritance" tho my first comment said "role inheritance" but the fact that there is any sort of inheritance involved at all with my rbac roles is very poor design decision. and the fact that i can misunderstand this and spend hours of company time trying to understand it, and still failing....when this should be an intuitive, 101-level thing for cloud design. but nah i gotta spend time going through like ten different docs piecing together knowledge and pentest my own work and also argue with some guy on the internet who called himself adept at azure and doesn't know this either (which further proves my point!)
motorest 1y ago
> Azure identity is so bad. It's like they tried to build it on the original 1998 implementation of LDAP or whatever. I think that Azure AD is literally built on top of Active Directory. That's what you need to do if your goal is to help your customers, who already usd Active Directory, to seamlessly onboard onto their authentication system. If you stop and think for a moment, you'd understand that it would be absurd not to do that. You have an army of institutional clients already using AD for everything. Are you going to force them to onboard onto another auth system after convincing them that AD suited all their needs? Anyhow, they seem to try to distance themselves with their rebranding to Entra. > Roles fucking inherit??? Like are you kidding me? What do you think is wrong with that?
- greenie_beans 1y ago
  yes i know the history and excuse me for misnaming, but AD came out in 1998 IIRC whenever i hate-researched it. and it makes perfect sense for a business to do that but it is a terrible engineering platform because of that. what you said was my exact thought process the first time i encountered that tragedy, and that doesn't make it right or good. and now the enterprise businesses waste a lot of money in time spent paying engineers to work with the frakenstein.
- patmorgan23 1y ago
  It definitely is built on AD in some form on the backend, just like Exchange Online is built on Exchange, and I believe EXO has its own AD infrastructure for each tenant that you sometimes have to wait for things to replicate to.
- deleted 1y ago
  [deleted]
raffraffraff 1y ago
This. Also try managing Gitlab permissions across a large org with lots of teams and lots of projects. Inheritance might seem like a good idea but it pollutes the hell out of everything once you're 3 levels deep in a org. I wrote some python scripts to generate a JSON dump of the whole org and from digging into it, some people have 30 different Access paths for some projects. Try locking that down without special tools.
bongodongobob 1y ago
"Roles inherit"? No idea what you're talking about.
- greenie_beans 1y ago
  > Lower levels inherit role permissions from higher levels...When you assign a role at a parent scope, those permissions are inherited to the child scopes from the docs: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps#step-3-identify-the-needed-scope https://learn.microsoft.com/en-us/azure/role-based-access-co...
  - bongodongobob 1y ago
    I don't understand what's surprising about this.
    - greenie_beans 1y ago
      weird! i guess our brains work differently. keep inheritance away from my RBAC. that's a simple concept. i guess my brain is dumber than your brain.

Azure identity is so bad. It's like they tried to build it on the original 1998 implementation of LDAP or whatever. Roles fucking inherit??? Like are you kidding me?

high_na_euv 1y ago

>Roles fucking inherit?? Wdym?

greenie_beans 1y ago
i designed an extremely tightly scoped managed identity to do a job. my azure admin created the resources, and now that identity shows an inheritance chain that tracks all the way to that admin (aka a very privileged identity). which seems insane. i tested the identity to make sure it couldn't do privilege escalation...still, wtf? it might be my own fault where i'm doing something wrong, but that shouldn't even be possible for somebody to create a managed identity that would inherit from other identities. i don't trust that it's ok and i shouldn't be spending time figuring out if it is, i expect tightly scoped identities to just work...
- fuzzy2 1y ago
  What inheritance chain? I'd say I'm quite proficient with Azure RBAC and I cannot understand what you're describing.
  - greenie_beans 1y ago
    https://learn.microsoft.com/en-us/answers/questions/969822/how-to-disable-rbac-inheritance-over-resources-on https://learn.microsoft.com/en-us/answers/questions/969822/h... and https://stackoverflow.com/questions/76618129/prevent-roles-from-being-inherited-by-a-managed-identity https://stackoverflow.com/questions/76618129/prevent-roles-f...
    - fuzzy2 1y ago
      These don't clarify your situation, sorry. They're also referring to two distinct scenarios. Especially regarding the SO question, I get the feeling that author is misunderstanding something. Where exactly are you seeing what exactly that might imply some kind of inheritance chain?
      - greenie_beans 1y ago
        i get the sense that you're not trying to help but instead argue about it. i already described as much as i want to detail: https://news.ycombinator.com/item?id=44445382 https://news.ycombinator.com/item?id=44445382
        fuzzy2 1y ago
        Okay. Then I'll lay it out: there is no inheritance at all. An identity does not inherit roles and it certainly does not inherit other identities. You are misinterpreting something you saw. However, without further details, a more targeted answer is not possible. I did not want to write a blanket statement like that because it is very condescending and hostile. Sorry about that. You may have seen the identity's IAM page. It does not show roles assigned to the identity.
        greenie_beans 1y ago
        from the docs: > Lower levels inherit role permissions from higher levels...When you assign a role at a parent scope, those permissions are inherited to the child scopes https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps#step-3-identify-the-needed-scope https://learn.microsoft.com/en-us/azure/role-based-access-co... so i guess this what you said is confidently wrong lmao like you couldn't even be more wrong: > Then I'll lay it out: there is no inheritance at all. An identity does not inherit roles and it certainly does not inherit other identities. i misspoke calling it "identity inheritance" and not "scope inheritance" tho my first comment said "role inheritance" but the fact that there is any sort of inheritance involved at all with my rbac roles is very poor design decision. and the fact that i can misunderstand this and spend hours of company time trying to understand it, and still failing....when this should be an intuitive, 101-level thing for cloud design. but nah i gotta spend time going through like ten different docs piecing together knowledge and pentest my own work and also argue with some guy on the internet who called himself adept at azure and doesn't know this either (which further proves my point!)

motorest 1y ago

> Azure identity is so bad. It's like they tried to build it on the original 1998 implementation of LDAP or whatever. I think that Azure AD is literally built on top of Active Directory. That's what you need to do if your goal is to help your customers, who already usd Active Directory, to seamlessly onboard onto their authentication system. If you stop and think for a moment, you'd understand that it would be absurd not to do that. You have an army of institutional clients already using AD for everything. Are you going to force them to onboard onto another auth system after convincing them that AD suited all their needs? Anyhow, they seem to try to distance themselves with their rebranding to Entra. > Roles fucking inherit??? Like are you kidding me? What do you think is wrong with that?

greenie_beans 1y ago
yes i know the history and excuse me for misnaming, but AD came out in 1998 IIRC whenever i hate-researched it. and it makes perfect sense for a business to do that but it is a terrible engineering platform because of that. what you said was my exact thought process the first time i encountered that tragedy, and that doesn't make it right or good. and now the enterprise businesses waste a lot of money in time spent paying engineers to work with the frakenstein.
patmorgan23 1y ago
It definitely is built on AD in some form on the backend, just like Exchange Online is built on Exchange, and I believe EXO has its own AD infrastructure for each tenant that you sometimes have to wait for things to replicate to.
deleted 1y ago
[deleted]

raffraffraff 1y ago

This. Also try managing Gitlab permissions across a large org with lots of teams and lots of projects. Inheritance might seem like a good idea but it pollutes the hell out of everything once you're 3 levels deep in a org. I wrote some python scripts to generate a JSON dump of the whole org and from digging into it, some people have 30 different Access paths for some projects. Try locking that down without special tools.

bongodongobob 1y ago

"Roles inherit"? No idea what you're talking about.

greenie_beans 1y ago
> Lower levels inherit role permissions from higher levels...When you assign a role at a parent scope, those permissions are inherited to the child scopes from the docs: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps#step-3-identify-the-needed-scope https://learn.microsoft.com/en-us/azure/role-based-access-co...
- bongodongobob 1y ago
  I don't understand what's surprising about this.
  - greenie_beans 1y ago
    weird! i guess our brains work differently. keep inheritance away from my RBAC. that's a simple concept. i guess my brain is dumber than your brain.