Open rkg-mm opened 2 months ago
Ok this indeed is not a bug, i traced it down - still not sure what the solution is though.
the $env:servicePrincipalKey is not provided by AzureCliTask, even though I set addSpnToEnvironment:true
. However, the other 2 values and the value "$env:idToken" are provided instead. Not sure how to use that idToken? I think it has to do with using federation identity in the service connection, instead of a client secret. Is there a way to use it this way?
edit, ok switching the service connection to type "service principal" instead of using federation type, it seems to work. Except wrong RBAC permissions, which I still need to figure out which ones are required.
So I would leave this open with 2 requests to save other some headaches:
"permissions": [
{
"actions": [],
"notActions": [],
"dataActions": [
"Microsoft.KeyVault/vaults/certificates/read",
"Microsoft.KeyVault/vaults/keys/read",
"Microsoft.KeyVault/vaults/keys/sign/action",
"Microsoft.KeyVault/vaults/keys/verify/action"
],
"notDataActions": []
}
]
I have faced similiar issue in Azure DevOps when using AzureSignTool. My current workaround is to get the access token with az cli and then pass that directly to AzureSignTool. It would be nice if AzureSignTool supported federated authentication as it is now recommended way of authenticating with Azure from Azure DevOps.
My workaround if anyone wants to use it:
- task: AzureCLI@2
displayName: 'Sign with AzureSignTool'
inputs:
scriptType: ps
scriptLocation: inlineScript
azureSubscription: xyz
addSpnToEnvironment: true
inlineScript: |
$accessToken = az account get-access-token --resource "https://vault.azure.net" --query "accessToken" --output tsv
AzureSignTool sign -du "https://www.xyz.com" -kvu "https://xyz.vault.azure.net" -kva $accessToken -kvc "xyz" -v "$(Build.ArtifactStagingDirectory)\xyz.msi"
On a side note I think displaying "File 'CertName' does not exist" as an error when there is authentication issue should be considered a bug.
This is likely not a bug but a mistake on my side, however I struggle to get this working with an RBAC enabled KeyVault via service connection, and wonder if there could be some details in the docs provided in the permissions necessary for RBAC, or some help if my issue is of totally different nature, since the error message is quiet strange.
I receive the error
File 'CertName' does not exist.
when running commandI am running it via AzureCLI@2 Task like this:
The certificate exists under the name "CertName" in the KeyVault. The service connection passed to "azureSubscription" does have access to the key vault (i even gave it Admin permissions on the vault in the end while testing).
So:
Thanks in advance!
edit: After looking through the source I think the message is from here https://github.com/vcsjones/AzureSignTool/blob/078c7620e590e0841ec4fa4e06cb045e7574a5d1/src/AzureSignTool/Program.cs#L501 , wouldn't that mean that the parameter is recognized as a file parameter instead the certificate parameter? If i delete the whole parameter it is bringing the same error with the next parameter (timestamp url), which sounds strange to me...