From 34292a3681a8cdd923f44eaeda41efa0c46a80f1 Mon Sep 17 00:00:00 2001
From: wen wang <wewang@redhat.com>
Date: Tue, 30 Dec 2025 14:02:47 +0800
Subject: [PATCH 1/2] Fix az issue

---
 ...ternal-oidc-entraid-console-app-redirect-uri-add-commands.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh b/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh
index b42fc49c1f3fd..7690bd74c5967 100644
--- a/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh
+++ b/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh
@@ -34,7 +34,7 @@ CONSOLE_REDIRECT_URIS="$(az ad app show --id "$CONSOLE_CLIENT_ID" --query 'web.r
 LOCK_ACCOUNT_NAME="$(</var/run/hypershift-azure-lock-blob/account-name)"
 LOCK_BLOB_NAME="$(</var/run/hypershift-azure-lock-blob/blob-name)"
 LOCK_CONTAINER_NAME="$(</var/run/hypershift-azure-lock-blob/container-name)"
-while ! az storage blob lease acquire --container-name "$LOCK_CONTAINER_NAME" --blob-name "$LOCK_BLOB_NAME" --account-name "$LOCK_ACCOUNT_NAME" --lease-duration 15 --auth-mode login; do
+while ! az storage blob lease acquire --container-name "$LOCK_CONTAINER_NAME" --blob-name "$LOCK_BLOB_NAME" --account-name "$LOCK_ACCOUNT_NAME" --lease-duration 15 --auth-mode key; do
     echo "Waiting for lease"
     sleep 60
 done

From 16788e28c69e6ae4de2c1adb1f6ca3101097c270 Mon Sep 17 00:00:00 2001
From: wen wang <wewang@redhat.com>
Date: Tue, 30 Dec 2025 14:40:33 +0800
Subject: [PATCH 2/2] fix(azure-oidc): use account key for lease acquisition to
 avoid RBAC issues

---
 ...l-oidc-entraid-console-app-redirect-uri-add-commands.sh | 7 ++++++-
 ...idc-entraid-console-app-redirect-uri-remove-commands.sh | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh b/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh
index 7690bd74c5967..31e6dd9089c1b 100644
--- a/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh
+++ b/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/add/idp-external-oidc-entraid-console-app-redirect-uri-add-commands.sh
@@ -34,10 +34,15 @@ CONSOLE_REDIRECT_URIS="$(az ad app show --id "$CONSOLE_CLIENT_ID" --query 'web.r
 LOCK_ACCOUNT_NAME="$(</var/run/hypershift-azure-lock-blob/account-name)"
 LOCK_BLOB_NAME="$(</var/run/hypershift-azure-lock-blob/blob-name)"
 LOCK_CONTAINER_NAME="$(</var/run/hypershift-azure-lock-blob/container-name)"
-while ! az storage blob lease acquire --container-name "$LOCK_CONTAINER_NAME" --blob-name "$LOCK_BLOB_NAME" --account-name "$LOCK_ACCOUNT_NAME" --lease-duration 15 --auth-mode key; do
+
+set +x
+LOCK_ACCOUNT_KEY="$(az storage account keys list --account-name "$LOCK_ACCOUNT_NAME" --query "[0].value" -o tsv)"
+
+while ! az storage blob lease acquire --container-name "$LOCK_CONTAINER_NAME" --blob-name "$LOCK_BLOB_NAME" --account-name "$LOCK_ACCOUNT_NAME" --account-key "$LOCK_ACCOUNT_KEY" --lease-duration 15; do
     echo "Waiting for lease"
     sleep 60
 done
+set -x
 
 eval "az ad app update --id $CONSOLE_CLIENT_ID --web-redirect-uris $CONSOLE_REDIRECT_URIS $CONSOLE_CALLBACK_URI"
 az ad app show --id "$CONSOLE_CLIENT_ID" --query 'web.redirectUris' -o tsv
diff --git a/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/remove/idp-external-oidc-entraid-console-app-redirect-uri-remove-commands.sh b/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/remove/idp-external-oidc-entraid-console-app-redirect-uri-remove-commands.sh
index fe140986d475f..d911f6edb5347 100644
--- a/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/remove/idp-external-oidc-entraid-console-app-redirect-uri-remove-commands.sh
+++ b/ci-operator/step-registry/idp/external-oidc/entraid/console-app/redirect-uri/remove/idp-external-oidc-entraid-console-app-redirect-uri-remove-commands.sh
@@ -38,10 +38,15 @@ CONSOLE_REDIRECT_URIS_NEW="$(echo "$CONSOLE_REDIRECT_URIS" | grep -v "$CONSOLE_C
 LOCK_ACCOUNT_NAME="$(</var/run/hypershift-azure-lock-blob/account-name)"
 LOCK_BLOB_NAME="$(</var/run/hypershift-azure-lock-blob/blob-name)"
 LOCK_CONTAINER_NAME="$(</var/run/hypershift-azure-lock-blob/container-name)"
-while ! az storage blob lease acquire --container-name "$LOCK_CONTAINER_NAME" --blob-name "$LOCK_BLOB_NAME" --account-name "$LOCK_ACCOUNT_NAME" --lease-duration 15 --auth-mode login; do
+
+set +x
+LOCK_ACCOUNT_KEY="$(az storage account keys list --account-name "$LOCK_ACCOUNT_NAME" --query "[0].value" -o tsv)"
+
+while ! az storage blob lease acquire --container-name "$LOCK_CONTAINER_NAME" --blob-name "$LOCK_BLOB_NAME" --account-name "$LOCK_ACCOUNT_NAME" --account-key "$LOCK_ACCOUNT_KEY" --lease-duration 15; do
     echo "Waiting for lease"
     sleep 60
 done
+set -x
 
 eval "az ad app update --id $CONSOLE_CLIENT_ID --web-redirect-uris $CONSOLE_REDIRECT_URIS_NEW"
 az ad app show --id "$CONSOLE_CLIENT_ID" --query 'web.redirectUris' -o tsv