contributer | types like views or a conductor controllers | Dependency Injection library

Once you have a proper HTTPS connection, only the sender and the receiver can see the POST payload. So, you can send it as regular JSON text.

I believe all the OAuth providers like Google, Facebook, etc. follow the same, and send the credentials in plain text inside the HTTPS connection.

You may need to force HTTPS on that Rest API end-point with your server configuration - to ensure that some of your clients are not sending plain-text credentials over HTTP without realizing.

And, also ensure that you use a certificate signed by a trusted authority. This ensures that the clients do not establish the HTTPS connection with a fake server posing to be your server.

If you're using a version of the PS script that comes with the VS Azure Resource Group project... and that's still using the AzureRM cmdlets, then that's likely the problem.

The apiVersion referenced in the error message is not related to an apiVersion in your template but the apiVersion used to deploy the template. That version is baked into the PS cmdlets so the only way to change it is to update the cmdlets. AFAIKI there is no AzureRM version of the cmdlets that support that apiVersion. A few things you can try:

1. this is a similar script to the one used by VS but uses the new cmdlets. IDK if you can invoke it from VS but you can run it on the cmd line to see if it solves the problem: https://github.com/Azure/azure-quickstart-templates/blob/master/Deploy-AzTemplate.ps1

2. Instead of using the scope property, use the [more complex] extension resource format on the roleAssignment

profile.dart

The contributer role is not enough. You need administrator privilages.

The minumum role that you need is application administrator.

See: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator

The issue is the account {project name} Build Service ({Org name}) does not have enough permission to access the query.

Steps:

Open Queries->select ... on your query and add that account {project name} Build Service ({Org name}) with READ access.

Note: We should provide the permission for the account {project name} Build Service ({Org name}) to read under Shared Queries page and select query permission page.

Result:

Remove the s from https for the URI of draft-07.

The URI for draft-07 is http://....

The URI used to identify a schema dialect is not necessarily network addressable... in other words, "It's just a string", which should match completely.

Don't use Write-Host in that spot. It will not send information down the pipeline to Out-File.

Example:

One idea that came to my mind is that you require the user_impersonation permission on Azure Service Management API. After the user logs in, you could list out the subscriptions available, allowing the user to select one. Then list out the resource groups if needed.

Once the user confirms a selection, your app could add itself as a Contributor on the targeted resource through the Management API, on behalf of the currently signed-in user.

To do this, you will need the object id of the service principal for your app created in the target tenant. You can get it by acquiring an app-only token for e.g. the Azure Management API from that tenant's token endpoint after the user has logged in. The token will contain an oid claim, which is the object id for the service principal.

Of course the user who signs in would have to have the ability to modify access to the target resource.

I would say the downside of this approach is that the organization must trust your app to only do the thing it claims to do. The approach where they grant the access manually allows them to be in control fully.