search

jenkinsci / azure-keyvault-plugin

Jenkins plugin for Azure Keyvault
https://plugins.jenkins.io/azure-keyvault/
MIT License
15 stars 21 forks source link

[gov cloud] Not able to fetch secrets from Azure US Gov - AADSTS900382: Confidential Client is not supported in Cross Cloud #66

Open bhagathkumar opened 4 years ago

bhagathkumar commented 4 years ago

Your checklist for this issue

Description

When configuring key vault from Azure US gov .Test connection gives below error.

Max retries 3 times exceeded. Error Details: AADSTS900382: Confidential Client is not supported in Cross Cloud request. Trace ID: xxxxx Correlation ID: xxxxx Timestamp: 2020-10-12 10:09:35Z com.microsoft.aad.msal4j.MsalServiceException: AADSTS900382: Confidential Client is not supported in Cross Cloud request.

Trace ID: xxxxx

Correlation ID: xxxxx

Timestamp: 2020-10-12 10:09:35Z at com.microsoft.aad.msal4j.MsalServiceExceptionFactory.fromHttpResponse(MsalServiceExceptionFactory.java:46) at com.microsoft.aad.msal4j.TokenRequest.executeOauthRequestAndProcessResponse(TokenRequest.java:109) at com.microsoft.aad.msal4j.ClientApplicationBase.acquireTokenCommon(ClientApplicationBase.java:163) at com.microsoft.aad.msal4j.AcquireTokenByAuthorizationGrantSupplier.execute(AcquireTokenByAuthorizationGrantSupplier.java:52) at com.microsoft.aad.msal4j.AuthenticationResultSupplier.get(AuthenticationResultSupplier.java:57)

But key vault from azure cloud. I am able to test the connection as well as retrieve the secrets.

timja commented 4 years ago

@xuzhang3 any idea?

bhagathkumar commented 4 years ago

I think AzureCredentialBuilder() is changed in com.azure:azure-identity 1.1.0 which include the support for azure gov subscriptions.

Ref: https://blog.jongallant.com/2020/02/azure-identity-other-clouds/ https://stackoverflow.com/questions/62052854/how-connect-to-azure-key-vault-from-java-backend-using-azure-java-sdk

timja commented 4 years ago

ah sure, try set that environment variable otherwise PRs are welcome.

bhagathkumar commented 4 years ago

Tried with setting environment variable for jenkins runtime

option1 ,AZURE_AUTHORITY_HOST="https://login.microsoftonline.us"

option2, AZURE_AUTHORITY_HOST=https://login.microsoftonline.us

In Both ways.Its not working. Got the same error message.

timja commented 4 years ago

where were you setting it? I would expect you need to set it before Jenkins starts, maybe in pipeline it could work.

bhagathkumar commented 4 years ago

I am running jenkins as Docker .

Setting the environment variable in docker-compose.yml as below.

environment:

bhagathkumar commented 4 years ago

after setting in docker-compose.yml also .I am getting same error. Is there any other fixes i can try?

lovleshmalik commented 3 years ago

I am also getting the similar error on Azure GovCloud. @bhagathkumar any luck solving this?

timja commented 3 years ago

@lovleshmalik @bhagathkumar Can either of you try on https://github.com/jenkinsci/azure-keyvault-plugin/releases/tag/120.v42d9117f490e

I did some improvements in the azure-credentials plugin to resolve the environment properly I think, but I have no way of testing it

bkarlow-optimo commented 3 years ago

I am seeing this same error.

Has anyone made progress on a fix?

timja commented 3 years ago

this really needs someone with a us gov account to do it.

Are you seeing the same stacktrace @bkarlow-optimo ?

Have you configured a us gov endpoint on your credential?

bkarlow-optimo commented 3 years ago

Yes, same.

aktiver commented 1 year ago

The new-ish api also uses "https://management.core.usgovcloudapi.net" for its endpoint