Azure / Azure/ArcEnabledServersGroupPolicy
ServicePrincipal Secret Not Being Decrypted
- Dominant language
- PowerShell
- Stars
- 17
- Forks
- 25
- PR merge metrics
- No merged PRs in 30d
Description
We have been testing the 1.06 script version. We are getting errors in the logs that the client secret is wrong/bad and cannot authenticate.
Testing the secret decryption function in the EnableAzureArc.ps1, we get the following error:
Could not fetch service principal secret: System.Management.Automation.MethodInvocationException: Exception calling "UnprotectBase64" with "1" argument(s): "The specified data could not be decrypted.
" ---> System.Security.Cryptography.CryptographicException: The specified data could not be decrypted.
at DpapiNgUtil.Unprotect(Byte[] protectedData)
at DpapiNgUtil.UnprotectBase64(String input)
at CallSite.Target(Closure , CallSite , Type , Object )
--- End of inner exception stack trace ---
at System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception)
at System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame)
at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
False

Contributor guide
No contributing guide indexed for this repository
Research direction
Start in EnableAzureArc.ps1 at the service principal secret decryption function and reproduce the UnprotectBase64 failure shown in the issue. Trace why the protected data cannot be decrypted, then verify that the secret decrypts successfully and authentication no longer reports an invalid client secret.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100