Seeing "Insufficient privileges to complete the operation" error when trying to run basic sample active-directory-dotnet-graphapi-console.
Followed the steps in the Sample page in Github including giving "Read directory" permission as well for the Microsoft Graph Application in Azure portal
Tried the suggestion to give application "Company administrator" role but that throws another error "Access Denied : You do not have permissions to call this cmdlet"
Related
Suddenly pipeline stopped working with error you are not authorized to run the scanner scanning file is zipped but unable to upload with authorization error.
Access token is created with admin user, so what can be the issue any idea?
I have following permissions in google cloud.
BigQuery Admin
Cloud Functions Admin
Cloud Scheduler Admin
Compute Admin
Editor
Source Repository Administrator
Storage Admin
I am creating a cloud run container using cloud repository. But getting following error.
ERROR: build step 2 "gcr.io/google.com/cloudsdktool/cloud-sdk:slim"
failed: step exited with non-zero status: 1 ERROR Finished Step #2 -
"Deploy" Step #2 - "Deploy": ERROR: (gcloud.run.services.update)
PERMISSION_DENIED: Permission 'run.services.get' denied on resource
'namespaces/buypower-mobile-app/services/test-repo' (or resource may
not exist).
If you're using Cloud Build to deploy the Cloud Run service, then the error you’re getting is because the Service Account used by Cloud Build does not have sufficient permissions to update the Cloud Run service, according to the official documentation.
The specific error is that permission is denied on run.services.get. This method is part of either roles/run.admin or roles/run.developer. Both roles include the permission run.services.update, which it'll need.
To get it working, you will need to add that one of those roles to the Service Account that is being used by Cloud Build.
Along with #DazWilkin's answer I was having difficulty determining whether the service account actually had the run.services.update permission. Especially since I was using Github Actions with Workload Identity Pools for auth and impersonating a service account.
I'd recommend doing the following:
Check if your auth is working correctly
- id: 'auth'
name: 'Authenticate to Google Cloud'
uses: 'google-github-actions/auth#v0'
with:
workload_identity_provider: 'projects/xxxxx/locations/global/workloadIdentityPools/my_pool/providers/my_provider'
service_account: 'my-service-account#{PROJECT_ID}.iam.gserviceaccount.com'
# this will make this step fail if auth fails
token_format: 'access_token'
Check if the service account used above and in the google-github-actions/deploy-cloudrun#v0 has the run.services.update permission. There are 2 places you can check.
a) Policy Troubleshooter - Use the service account, select your project, and enter the permission. This will immediately tell you whether you have the permission or not
b) Policy Analyzer - Create Custom query, use Permission as parameter, click continue and Run Query. This will show you all the principals that have the permission you're looking for
If your service account doesn't have the correct permission you need to add it from the IAM & Admin -> IAM page
When trying to deploy my container (or the hello world container) to google cloud run I receive this error:
ERROR: (gcloud.run.deploy) Cloud Run error: Internal system error. Missing necessary permission for service-<ID>#serverless-robot-prod.iam.gserviceaccount.com on resource <PROJECT ID>
I can see that the service account mentioned in the error is in my IAM dashboard and has the Google Cloud Run Service Agent role. I even tried giving it the Owner role, but it didn't work.
I tried including the --service-account flag with the same service account and receive this error:
PERMISSION_DENIED: Permission 'iam.serviceaccounts.actAs' denied on service account service-<ID>#serverless-robot-prod.iam.gserviceaccount.com (or it may not exist).
Which I know doesn't make sense.
I also tried this deploy through the console ui, but received the same error (the first one).
How do I fix this permission error?
I order to assign the iam.serviceAccounts.actAs permission you have to set the roles/iam.serviceAccountUser role.
You can do this by going to the Console > IAM & Admin and setting the Service Account User role to your service account.
Also, confirm that the Cloud Run runtime service account also has the iam.serviceAccounts.actAs permission. This is a requirement specified in the Cloud Run deployment permissions docs
As Dustin mentioned, there was an outage affecting IAM permissions. Now that the outage has been resolved, my deployment is working!
I built my container image and then deployed to Cloud Run using the Cloud Console. However, when I open the endpoint URL of my service, I get a 403 "Error: Forbidden" page
If you receive a 403 "Error: Forbidden" error message when accessing your Cloud Run service, it means that your client is not authorized to invoke this service. You can address this by taking one of the following actions:
If the service is meant to be invocable by anyone, update its IAM settings to make the service public.
If the service is meant to be invocable only by certain identities, make sure that you invoke it with the proper authorization token.
I have used IAP to resolve this issue. If there is a use case where only authenticated users must be able to access the application then use IAP
Accessing Authenticated Cloud Run applications using IAP
While creating build Agent on my windows10 for the TFS(on premises) server getting an error -
TF400813: The user 'MyAdmin' is not authorized to access this resource.
Note - config.cmd running with Administrator.
TFS server URL - http://tfs.mytfsservername.com/tfs/
Please help to resolve this ..
Based on your error message it should be the permission issue.
Please confirm if the user has the correct permission to register an agent. Please see Confirm the user has permission for details.