search

pulumi / pulumi-azure-native

Azure Native Provider
Apache License 2.0
126 stars 34 forks source link

Old version of hashicorp/go-azure-helpers causing certificate authentication issues #2734

Open floyd-may opened 1 year ago

floyd-may commented 1 year ago

What happened?

Unable to authenticate using a client certificate; error message the Client Certificate Path is not a valid pfx file: pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1]. There is an closed terraform bug on this here:

https://github.com/hashicorp/terraform-provider-azurerm/issues/16228

If you follow the chain, the difference appears to be that pulumi-azure-native is using an older version of terraform/go-azure-helpers that has since been updated to properly handle a wider variety of certificates.

Expected Behavior

Authentication equivalent to the terraform azure module.

Steps to reproduce

see above

Output of pulumi about

irrelevant

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

mikhailshilkov commented 1 year ago

Thank you for the note @floyd-may , I opened a PR to upgrade it

floyd-may commented 1 year ago

Thank you for jumping on that so quickly @mikhailshilkov! Can you point me in the right direction of tracing that PR to a release? Would like to know when I can abandon my workaround.

mikhailshilkov commented 1 year ago

@floyd-may It turns out the update is not as straightforward, since 0.52 of terraform/go-azure-helpers had a breaking change that we can't easily get past. Do you know which version had the fix that you need?

floyd-may commented 1 year ago

@mikhailshilkov Not surprised that there's a breaking change there 😖 Appreciate the attempt, though! I don't know that I can give you a precise version, but I did see this commit that seems to indicate some pretty significant changes related to authentication in go-azure-helpers. The commit message seems to indicate that there was some wheel-reinvention and that the better approach was to defer to auth functionality in go-azure-sdk.