Azure / Azure/azure-cli

Unable to decrypt Az CLI cred in ADO pipeline task

Open
#27,428 2 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad Auto-Assign Azure CLI Team customer-reported question Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

Unable to decrypt Az CLI cred in ADO pipeline task

### Related command

It seems az login command is failing

### Errors

PFA - Full log of task execution

### Issue script & Debug output

PFA - Full log of task execution

### Expected behavior

Using ADO - task: AzureCLI@2 az login needs to be successful with option addSpnToEnvironment: true

### Environment Summary

azure-cli 2.52.0

core 2.52.0
telemetry 1.1.0

Extensions:
azure-devops 0.26.0

Dependencies:
msal 1.24.0b1
azure-mgmt-resource 23.1.0b2

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Program Files\Common Files\AzureCliExtensionDirectory'

Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

### Additional context

Below task is executed in a pool with more than one agent and it is utilized by more than few, I often get the error message : Key not valid for use in specified state.. App developer may consider this guidance: []([](https://github.com/AzureAD/microsoft-authentication-extensions-for-python/wiki/PersistenceDecryptionError))

[dev.azure.com.txt](https://github.com/Azure/azure-cli/files/12664021/dev.azure.com.txt)

```
- task: AzureCLI@2
displayName: 'Set credentials (RG SPN) for PrivilegedContext'
inputs:
azureSubscription: ${{parameters.arm_service_connection}}
scriptType: 'pscore'
scriptLocation: 'inlineScript'
addSpnToEnvironment: true
useGlobalConfig: true
inlineScript: |
$azure_tenant_id = $env:tenantId
Write-host "Variable name azure_tenant_id is set with Azure AD Tenant ID"
Write-host "##vso[task.setvariable variable=azure_tenant_id;issecret=true]$azure_tenant_id"

$azure_client_id = $env:servicePrincipalId
Write-host "Variable name azure_client_id is set with resource group SPN Client ID"
Write-host "##vso[task.setvariable variable=azure_client_id;issecret=true]$azure_client_id"

$azure_client_secret = $env:servicePrincipalKey
Write-host "Variable name azure_client_secret is set with resource group SPN credentials"
Write-host "##vso[task.setvariable variable=azure_client_secret;issecret=true]$azure_client_secret"
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.