Azure / Azure/azure-cli-extensions

Failed to add policy signer certificate

Open
#6,210 7 comments 0 reactions 0 assignees View on GitHub
Attestation bug needs-team-attention Service Attention
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

### Related command

```shell
az attestation signer add \
--name $AZURE_MAA_CUSTOM_RESOURCE_NAME \
--resource-group $AZURE_RESOURCE_GROUP \
--signer-file my_policy_signing_cert.pem.jws
```

Note: the file `my_policy_signing_cert.pem.jws` is generated by the scripts available in https://github.com/jiazhang0/azure-attestation-scripts

### Extension name (the extension in question)

attestation

### Description of issue (in as much detail as possible)

```
Command group 'attestation signer' is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
The command failed with an unexpected error. Here is the traceback:
Invalid header padding
Traceback (most recent call last):
File "/opt/az/lib/python3.10/site-packages/jwt/api_jws.py", line 226, in _load
header_data = base64url_decode(header_segment)
File "/opt/az/lib/python3.10/site-packages/jwt/utils.py", line 34, in base64url_decode
return base64.urlsafe_b64decode(input)
File "/opt/az/lib/python3.10/base64.py", line 133, in urlsafe_b64decode
return b64decode(s)
File "/opt/az/lib/python3.10/base64.py", line 87, in b64decode
return binascii.a2b_base64(s)
binascii.Error: Invalid base64-encoded string: number of data characters (181) cannot be 1 more than a multiple of 4

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
raise ex
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
result = cmd_copy(params)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
return self.handler(*args, **kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
return op(**command_args)
File "/root/.azure/cliextensions/attestation/azext_attestation/manual/custom.py", line 127, in add_signer
header = jwt.get_unverified_header(token)
File "/opt/az/lib/python3.10/site-packages/jwt/api_jws.py", line 207, in get_unverified_header
headers = self._load(jwt)[2]
File "/opt/az/lib/python3.10/site-packages/jwt/api_jws.py", line 228, in _load
raise DecodeError("Invalid header padding") from err
jwt.exceptions.DecodeError: Invalid header padding
```

### Fix

```
--- attestation/azext_attestation/manual/custom.py 2023-04-17 19:04:20.714795846 +0800
+++ attestation/azext_attestation/manual/custom.py.new 2023-04-17 19:04:16.164762483 +0800
@@ -121,6 +121,7 @@
provider_client = cf_attestation_provider(cmd.cli_ctx)
provider = provider_client.get(resource_group_name=resource_group_name, provider_name=provider_name)
token = client.add(tenant_base_url=provider.attest_uri, policy_certificate_to_add=signer)
+ token = json.loads(token.replace('\'', '"')).get('token')
result = {'Jwt': token}

if token:
```

The expected result with the fix is:
```json
{
"Algorithm": "RS256",
"CertificateCount": 0,
"Certificates": [],
"JKU": "https://xxx.yyyyyy.attest.azure.net/certs",
"Jwt": "eyJhbGciOi..."
}
```

-----

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.