Unable to decrypt Az CLI cred in ADO pipeline task
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
### Describe the bug
Unable to decrypt Az CLI cred in ADO pipeline task
### Related command
It seems az login command is failing
### Errors
PFA - Full log of task execution
### Issue script & Debug output
PFA - Full log of task execution
### Expected behavior
Using ADO - task: AzureCLI@2 az login needs to be successful with option addSpnToEnvironment: true
### Environment Summary
azure-cli 2.52.0
core 2.52.0
telemetry 1.1.0
Extensions:
azure-devops 0.26.0
Dependencies:
msal 1.24.0b1
azure-mgmt-resource 23.1.0b2
Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Program Files\Common Files\AzureCliExtensionDirectory'
Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]
Legal docs and information: aka.ms/AzureCliLegal
### Additional context
Below task is executed in a pool with more than one agent and it is utilized by more than few, I often get the error message : Key not valid for use in specified state.. App developer may consider this guidance: []([](https://github.com/AzureAD/microsoft-authentication-extensions-for-python/wiki/PersistenceDecryptionError))
[dev.azure.com.txt](https://github.com/Azure/azure-cli/files/12664021/dev.azure.com.txt)
```
- task: AzureCLI@2
displayName: 'Set credentials (RG SPN) for PrivilegedContext'
inputs:
azureSubscription: ${{parameters.arm_service_connection}}
scriptType: 'pscore'
scriptLocation: 'inlineScript'
addSpnToEnvironment: true
useGlobalConfig: true
inlineScript: |
$azure_tenant_id = $env:tenantId
Write-host "Variable name azure_tenant_id is set with Azure AD Tenant ID"
Write-host "##vso[task.setvariable variable=azure_tenant_id;issecret=true]$azure_tenant_id"
$azure_client_id = $env:servicePrincipalId
Write-host "Variable name azure_client_id is set with resource group SPN Client ID"
Write-host "##vso[task.setvariable variable=azure_client_id;issecret=true]$azure_client_id"
$azure_client_secret = $env:servicePrincipalKey
Write-host "Variable name azure_client_secret is set with resource group SPN credentials"
Write-host "##vso[task.setvariable variable=azure_client_secret;issecret=true]$azure_client_secret"
```
Contributor guide
Assessment
This issue has not been assessed yet.