Closed v2kiran closed 1 month ago
isra-fel
commented
1 year ago Hey @msJinLei I see "Could not find tenant id for provided tenant domain 'xxx'." in the result of Resolve-AzError (where xxx is a GUID) . Could this be related to the updates we made last sprint about parsing domains?
v2kiran
commented
11 months ago Any update on this?
msJinLei
commented
10 months ago Hey @msJinLei I see "Could not find tenant id for provided tenant domain 'xxx'." in the result of
Resolve-AzError(where xxx is a GUID) . Could this be related to the updates we made last sprint about parsing domains?
The reported error is
---> System.DllNotFoundException: Unable to load shared lib rary 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider using a tool li ke strace. If you're using glibc, consider setting the LD_DE BUG environment variable:
But no new dependency is added for the latest change.
@v2kiran could you provide information about github action (here is an example https://github.com/Azure/azure-powershell/issues/20720) you are using so that we can reproduce your case, thanks
v2kiran
commented
10 months ago @msJinLei - sure . here is the workflow file:
name: oidc-ps
# Required for OIDC
permissions:
id-token: write
contents: read
env:
ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
ARM_ENVIRONMENT: public
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
CLIENT_ID: ${{ secrets.CLIENT_ID }}
on:
workflow_dispatch:
push:
branches:
- 'main'
- 'releases/**'
jobs:
OIDCPSLogin:
name: Login using PS OIDC
runs-on: DEV-ACI
environment:
name: dev
steps:
- uses: actions/checkout@v2
- name: Login using oidc
shell: pwsh
run: |
$Audience = "api://AzureADTokenExchange"
$GitToken = $env:ACTIONS_ID_TOKEN_REQUEST_TOKEN
$GitTokenUrl = $env:ACTIONS_ID_TOKEN_REQUEST_URL
$apiUrl = "{0}&audience={1}" -f $GitTokenUrl, $Audience
$jwt_tokens = Invoke-RestMethod $apiUrl -Headers @{Authorization = ("bearer {0}" -f $GitToken)}
Write-Host "GitHub JWT url: $apiUrl"
Write-Host "GitHub JWT payload:"
$federatedToken = ($jwt_tokens.Value -split "\.")[1]
if(($federatedToken.Length % 4) -ne 0) {
$federatedToken = $federatedToken.PadRight($federatedToken.Length + 4 - ($federatedToken.Length % 4), "=")
}
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($federatedToken)) | convertfrom-json | convertto-json # Pretty print
Disable-AzContextAutosave -Scope Process
try
{
Connect-azaccount -TenantId ${{ env.ARM_TENANT_ID }} -ApplicationId ${{ env.ARM_CLIENT_ID }} -federatedtoken $GitToken -ServicePrincipal -erroraction stop
}
catch{
get-error -newest 1
resolve-azerror
write-verbose "psversiontable"
$psversiontable | out-string
write-verbose "az modules"
get-module az*
}
- name: Get secrets - Job__az_oidc_tst__Step-3
uses: azure/powershell@v1
with:
inlineScript: |
get-azresourcegroup | select -first 1 | out-string
azPSVersion: "latest"
IsaacCalligeros95
commented
9 months ago We're experiencing this same issue, are there any updates?
IsaacCalligeros95
commented
5 months ago Any updates on this? Using Disable-AzContextAutosave is a fairly common practice in CI/CD pipelines. We have a number of customers running into this problem and our only recommendation is to downgrade to earlier versions.
msJinLei
commented
5 months ago In client assertion login flow, when token cache option is set to be in memory, the following condition should be hit. https://github.com/Azure/azure-powershell/blob/a710e74ca88d6733b98affc7cc1f158ea296f9dd/src/Accounts/Authentication/Identity/TokenCache.cs#L90
The object we passed is inherited from Azure.Identity.UnsafeTokenCacheOptions while the type above is Microsoft.Azure.PowerShell.Authenticators.Identity.UnsafeTokenCacheOptions. That's why the condition is not hit.
The reason we create a new UnsafeTokenCacheOptions in the namespace Microsoft.Azure.PowerShell.Authenticators.Identity is because the assignment cannot be executed if the UnsafeTokenCacheOptions is not in the same package with internal class TokenCache
https://github.com/Azure/azure-powershell/blob/a710e74ca88d6733b98affc7cc1f158ea296f9dd/src/Accounts/Authentication/Identity/TokenCache.cs#L92
https://github.com/Azure/azure-powershell/blob/a710e74ca88d6733b98affc7cc1f158ea296f9dd/src/Accounts/Authentication/Identity/TokenCache.cs#L93
Microsoft.Azure.PowerShell.Authenticators.Identity.UnsafeTokenCacheOptions for client assertion flowISupportsTokenCachePersistenceOptions for ClientAssertionCredentialOptions so that we can remove all these codes.
After PR https://github.com/Azure/azure-powershell/pull/24416 is merged
Disable-AzContextAutosave -Scope "Process"
Connect-AzAccount -ServicePrincipal -Tenant $tenantId -ApplicationId $appId -FederatedToken $federatedToken
$token = (Get-AzAccessToken).Token
Disconnect-AzAccount
Connect-AzAccount -AccessToken $token -Tenant $tenantId -AccountId $appId@isra-fel Please take a look
msJinLei
commented
1 month ago The issue will be fixed by https://github.com/Azure/azure-powershell/pull/25733 @YanaXu Could you follow this issue? Thanks
Description
the following fails:
Issue script & Debug output
Environment data
Module versions
Error output