Closed v2kiran closed 1 month ago
Hey @msJinLei I see "Could not find tenant id for provided tenant domain 'xxx'." in the result of Resolve-AzError
(where xxx is a GUID) . Could this be related to the updates we made last sprint about parsing domains?
Any update on this?
Hey @msJinLei I see "Could not find tenant id for provided tenant domain 'xxx'." in the result of
Resolve-AzError
(where xxx is a GUID) . Could this be related to the updates we made last sprint about parsing domains?
The reported error is
---> System.DllNotFoundException: Unable to load shared lib rary 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider using a tool li ke strace. If you're using glibc, consider setting the LD_DE BUG environment variable:
But no new dependency is added for the latest change.
@v2kiran could you provide information about github action (here is an example https://github.com/Azure/azure-powershell/issues/20720) you are using so that we can reproduce your case, thanks
@msJinLei - sure . here is the workflow file:
name: oidc-ps
# Required for OIDC
permissions:
id-token: write
contents: read
env:
ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
ARM_ENVIRONMENT: public
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
CLIENT_ID: ${{ secrets.CLIENT_ID }}
on:
workflow_dispatch:
push:
branches:
- 'main'
- 'releases/**'
jobs:
OIDCPSLogin:
name: Login using PS OIDC
runs-on: DEV-ACI
environment:
name: dev
steps:
- uses: actions/checkout@v2
- name: Login using oidc
shell: pwsh
run: |
$Audience = "api://AzureADTokenExchange"
$GitToken = $env:ACTIONS_ID_TOKEN_REQUEST_TOKEN
$GitTokenUrl = $env:ACTIONS_ID_TOKEN_REQUEST_URL
$apiUrl = "{0}&audience={1}" -f $GitTokenUrl, $Audience
$jwt_tokens = Invoke-RestMethod $apiUrl -Headers @{Authorization = ("bearer {0}" -f $GitToken)}
Write-Host "GitHub JWT url: $apiUrl"
Write-Host "GitHub JWT payload:"
$federatedToken = ($jwt_tokens.Value -split "\.")[1]
if(($federatedToken.Length % 4) -ne 0) {
$federatedToken = $federatedToken.PadRight($federatedToken.Length + 4 - ($federatedToken.Length % 4), "=")
}
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($federatedToken)) | convertfrom-json | convertto-json # Pretty print
Disable-AzContextAutosave -Scope Process
try
{
Connect-azaccount -TenantId ${{ env.ARM_TENANT_ID }} -ApplicationId ${{ env.ARM_CLIENT_ID }} -federatedtoken $GitToken -ServicePrincipal -erroraction stop
}
catch{
get-error -newest 1
resolve-azerror
write-verbose "psversiontable"
$psversiontable | out-string
write-verbose "az modules"
get-module az*
}
- name: Get secrets - Job__az_oidc_tst__Step-3
uses: azure/powershell@v1
with:
inlineScript: |
get-azresourcegroup | select -first 1 | out-string
azPSVersion: "latest"
We're experiencing this same issue, are there any updates?
Any updates on this? Using Disable-AzContextAutosave
is a fairly common practice in CI/CD pipelines. We have a number of customers running into this problem and our only recommendation is to downgrade to earlier versions.
In client assertion login flow, when token cache option is set to be in memory, the following condition should be hit. https://github.com/Azure/azure-powershell/blob/a710e74ca88d6733b98affc7cc1f158ea296f9dd/src/Accounts/Authentication/Identity/TokenCache.cs#L90
The object we passed is inherited from Azure.Identity.UnsafeTokenCacheOptions
while the type above is Microsoft.Azure.PowerShell.Authenticators.Identity.UnsafeTokenCacheOptions
. That's why the condition is not hit.
The reason we create a new UnsafeTokenCacheOptions
in the namespace Microsoft.Azure.PowerShell.Authenticators.Identity
is because the assignment cannot be executed if the UnsafeTokenCacheOptions
is not in the same package with internal class TokenCache
https://github.com/Azure/azure-powershell/blob/a710e74ca88d6733b98affc7cc1f158ea296f9dd/src/Accounts/Authentication/Identity/TokenCache.cs#L92
https://github.com/Azure/azure-powershell/blob/a710e74ca88d6733b98affc7cc1f158ea296f9dd/src/Accounts/Authentication/Identity/TokenCache.cs#L93
Microsoft.Azure.PowerShell.Authenticators.Identity.UnsafeTokenCacheOptions
for client assertion flowISupportsTokenCachePersistenceOptions
for ClientAssertionCredentialOptions
so that we can remove all these codes.
After PR https://github.com/Azure/azure-powershell/pull/24416 is merged
Disable-AzContextAutosave -Scope "Process"
Connect-AzAccount -ServicePrincipal -Tenant $tenantId -ApplicationId $appId -FederatedToken $federatedToken
$token = (Get-AzAccessToken).Token
Disconnect-AzAccount
Connect-AzAccount -AccessToken $token -Tenant $tenantId -AccountId $appId
@isra-fel Please take a look
The issue will be fixed by https://github.com/Azure/azure-powershell/pull/25733 @YanaXu Could you follow this issue? Thanks
Description
the following fails:
Issue script & Debug output
Environment data
Module versions
Error output