Azure / Azure/ArcEnabledServersGroupPolicy

ServicePrincipal Secret Not Being Decrypted

Open
#21 14 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
17
Forks
25
PR merge metrics
No merged PRs in 30d

Description

We have been testing the 1.06 script version. We are getting errors in the logs that the client secret is wrong/bad and cannot authenticate.

Testing the secret decryption function in the EnableAzureArc.ps1, we get the following error:
Could not fetch service principal secret: System.Management.Automation.MethodInvocationException: Exception calling "UnprotectBase64" with "1" argument(s): "The specified data could not be decrypted.
" ---> System.Security.Cryptography.CryptographicException: The specified data could not be decrypted.

at DpapiNgUtil.Unprotect(Byte[] protectedData)
at DpapiNgUtil.UnprotectBase64(String input)
at CallSite.Target(Closure , CallSite , Type , Object )
--- End of inner exception stack trace ---
at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
False

![image](https://github.com/Azure/ArcEnabledServersGroupPolicy/assets/123653421/97011a55-aaf0-4fdb-9ddb-abea82d6c4cd)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in EnableAzureArc.ps1 at the service principal secret decryption function and reproduce the UnprotectBase64 failure shown in the issue. Trace why the protected data cannot be decrypted, then verify that the secret decrypts successfully and authentication no longer reports an invalid client secret.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.