Azure / Azure/azure-powershell
Add-AzIoTDeviceProvisioningServiceCertificate incorrectly converts cert as base64 to file path
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
If I attempt to pass the certificate to `Add-AzIoTDeviceProvisioningServiceCertificate` as a base64 encoded string, it always prefixes the base64 string with the file path. This appears to be a bug.
### Issue script & Debug output
```PowerShell
DEBUG: 1:56:53 PM - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 1:56:53 PM - AddAzureRmIoTDeviceProvisioningServiceCertificate begin processing with ParameterSet 'ResourceSet'.
DEBUG: 1:56:53 PM - using account id 'Robin.Holt@daikinapplied.com'...
DEBUG: 1:56:53 PM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: [Common.Authentication]: Authenticating using Account: 'Robin.Holt@daikinapplied.com', environment: 'AzureCloud', tenant: '75fdb059-42c2-4e58-878b-9ea34858b48e'
DEBUG: 1:56:53 PM - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: 1:56:53 PM - [ConfigManager] Got [False] from [EnableLoginByWam], Module = [], Cmdlet = [].
DEBUG: 1:56:53 PM - [SilentAuthenticator] Calling SharedTokenCacheCredential.GetTokenAsync - TenantId:'75fdb059-42c2-4e58-878b-9ea34858b48e', Scopes:'https://management.core.windows.net//.default', AuthorityHost:'https://login.microsoftonline.com/', UserId:'Robin.Holt@daikinapplied.com'
DEBUG: SharedTokenCacheCredential.GetToken invoked. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId:
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - 3f248d31-1145-44b2-ae4a-a15c5bbec498] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - 3f248d31-1145-44b2-ae4a-a15c5bbec498] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - 3f248d31-1145-44b2-ae4a-a15c5bbec498] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - 3f248d31-1145-44b2-ae4a-a15c5bbec498] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - 3f248d31-1145-44b2-ae4a-a15c5bbec498] IsLegacyAdalCacheEnabled: yes
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z] Found 1 cache accounts and 0 broker accounts
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z] Returning 1 accounts
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] MSAL MSAL.CoreCLR with assembly version '4.65.0.0'. CorrelationId(f993860c-8cae-4385-8834-34bc0c50b752)
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] === AcquireTokenSilent Parameters ===
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] LoginHint provided: False
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] Account provided: True
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] ForceRefresh: False
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752]
=== Request Data ===
Authority Provided? - True
Scopes - https://management.core.windows.net//.default
Extra Query Params Keys (space separated) -
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint ? False
IsBrokerConfigured - False
HomeAccountId - False
CorrelationId - f993860c-8cae-4385-8834-34bc0c50b752
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured:
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] === Token Acquisition (SilentRequest) started:
Scopes: https://management.core.windows.net//.default
Authority Host: login.microsoftonline.com
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] Access token is not expired. Returning the found cache entry. [Current time (11/14/2024 13:56:53) - Expiration Time (11/14/2024 14:24:36 +00:00) - Extended Expiration Time (11/14/2024 14:24:36 +00:00)]
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] Returning access token found in cache. RefreshOn exists ? False
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] [Region discovery] Not using a regional authority.
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752]
=== Token Acquisition finished successfully:
DEBUG: False MSAL 4.65.0.0 MSAL.CoreCLR .NET 8.0.10 Linux [2024-11-14 13:56:53Z - f993860c-8cae-4385-8834-34bc0c50b752] AT expiration time: 11/14/2024 2:24:36 PM +00:00, scopes: https://management.core.windows.net//.default https://management.core.windows.net//user_impersonation. source: Cache
DEBUG: SharedTokenCacheCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId: ExpiresOn: 2024-11-14T14:24:36.0000000+00:00
DEBUG: [Common.Authentication]: Received token with LoginType 'User', Tenant: '75fdb059-42c2-4e58-878b-9ea34858b48e', UserId: 'Robin.Holt@daikinapplied.com'
DEBUG: ============================ HTTP REQUEST ============================
HTTP Method:
PUT
Absolute Uri:
https://management.azure.com/subscriptions/4d1cc857-55ea-4490-9cbd-313f673311c5/resourceGroups/IoTHub-cu-ft-rg/providers/Microsoft.Devices/provisioningServices/Telemetry-cu-ft-dps/certificates/SM-DPS-20241112-20441114-r007?api-version=2017-11-15
Headers:
Accept-Language : en-US
x-ms-client-request-id : 4a55b87b-0b90-4715-b4af-95531a8ee6db
Body:
{
"certificate": "/home/holtr/src/SystemManager/Certificate_Signing_Service/Powershell_scripts/MIIDBTCCAe2gAwIBAgIJAICrzesfdeqVMA0GCSqGSIb3DQEBCwUAMCgxJjAkBgNVBAMTHVNNLURQUy0yMDI0MTExMi0yMDQ0MTExNC1yMDA3MB4XDTI0MTExMjAwMDAwMFoXDTQ0MTExNDAwMDAwMFowKDEmMCQGA1UEAxMdU00tRFBTLTIwMjQxMTEyLTIwNDQxMTE0LXIwMDcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrWllWcVi3Qt7WmJFMTjrCa8839AVokwqVc7mbHQryN5viNsi0r4VEgm5Vk9/NGdTdXEymSnoRHZ4hkdiFXuDIoS1jFk7g7hIeCM5VxjvtnLfhRh5Ico7cDN4oLG03wjzxvvuNNVyQe2fyNB84yhL7DwqUICwtUVwfyP9srYkW7MGDmBM3XpmGie/5Q0c2I2Ec1ba1Q2NdpANHZcdIhG8G3sZWjNTYLkd4pP3Kv+foDI5qSTAeXBv8N2vrImQtfoAfV9kM7KRMfBa9I1WkhvXlhjOD1trHNViZ/fScWda2A+/63nDPV443Zk70D4gMq0UKcUNQuQ2K0m5jbAXiepCBAgMBAAGjMjAwMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQCG1mhT9Oat1irnWf1NTDFTm+9FFsZKYIaVEtZlo44c+QgVcTqTW66+rXUjBRVnsG+XH75nxS9x2OYk866nUE4slJmJ4TG3ffVd6gozaoEXM213I5nO3N4Xg2d5WddmjyRFB5b9hm8TgqEMqjcH3E4PPd5HSjCHAOGShRl2m8c+Bvn+t3ln5q6btQmF8cktKgeTlXdMMOeA6dLIP4FIGizMBjtTz0M2x0KlHulXgGixUMvdbRb6GpXy0Tr0vbEGfOUyMnfHposUIpOpyutWn5IWBhG2bYTcq7VbUzExSZFe0DjQboQPPwHGQkXbaK3OcVPOjPzeI3O0ohM5gB+ykqM4"
}
DEBUG: ============================ HTTP RESPONSE ============================
Status Code:
BadRequest
Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-ratelimit-remaining-subscription-writes: 199
x-ms-ratelimit-remaining-subscription-global-writes: 2999
x-ms-request-id : 1729b4f9-0bbb-49a8-b03b-fbf05672d1df
x-ms-correlation-request-id : 1729b4f9-0bbb-49a8-b03b-fbf05672d1df
x-ms-routing-request-id : NORTHCENTRALUS:20241114T135653Z:1729b4f9-0bbb-49a8-b03b-fbf05672d1df
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
X-Cache : CONFIG_NOCACHE
X-MSEdge-Ref : Ref A: CA0E2F141A5740F4B9CEDCCD8F5E1D5B Ref B: CH1AA2020614011 Ref C: 2024-11-14T13:56:53Z
Date : Thu, 14 Nov 2024 13:56:53 GMT
Body:
{
"code": 400099,
"httpStatusCode": "BadRequest",
"message": "Value must be a valid Base64 string. If you contact a support representative please include this correlation identifier: 4626d68e-ba30-477a-9bac-2ae069926c2c, timestamp: 2024-11-14 13:56:53Z, errorcode: IH400099."
}
DEBUG: 1:56:54 PM - [ConfigManager] Got nothing from [EnableErrorRecordsPersistence], Module = [], Cmdlet = []. Returning default value [False].
Add-AzIoTDeviceProvisioningServiceCertificate: /home/holtr/src/SystemManager/Certificate_Signing_Service/Powershell_scripts/Create_Cert.ps1:151
Line |
151 | … tResponse = Add-AzIoTDeviceProvisioningServiceCertificate -ResourceGr …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Operation returned an invalid status code 'BadRequest'
DEBUG: 1:56:54 PM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 1:56:54 PM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 1:56:54 PM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.DeviceProvisioningServices:0.10.3; CommandName: Add-AzIoTDeviceProvisioningServiceCertificate; PSVersion: 7.4.6; IsSuccess: False; Duration: 00:00:00.5305279; SanitizeDuration: 00:00:00; Exception: Operation returned an invalid status code 'BadRequest';
DEBUG: 1:56:54 PM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 1:56:54 PM - AddAzureRmIoTDeviceProvisioningServiceCertificate end processing.
Get-AzIoTDeviceProvisioningServiceCertificate: /home/holtr/src/SystemManager/Certificate_Signing_Service/Powershell_scripts/Create_Cert.ps1:154
Line |
154 | … ationCode = Get-AzIoTDeviceProvisioningServiceCertificate -ResourceGr …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Operation returned an invalid status code 'NotFound'
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 7.4.6
PSEdition Core
GitCommitId 7.4.6
OS CBL-Mariner/Linux
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 3.0.5 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 0.10.3 Az.DeviceProvisioningServices {Add-AzIoTDeviceProvisioningServiceAccessPolicy, Add-AzIoTDeviceProvisioningServiceCertificate, Add-AzIoTDeviceProvisioningServiceEnrollment, Add-AzIoTDeviceProvisioningServiceEnrollmentGroup…}
Script 4.1.1 Az.Functions {Get-AzFunctionApp, Get-AzFunctionAppAvailableLocation, Get-AzFunctionAppPlan, Get-AzFunctionAppSetting…}
Script 6.2.0 Az.KeyVault {Add-AzKeyVaultCertificate, Add-AzKeyVaultCertificateContact, Add-AzKeyVaultKey, Add-AzKeyVaultManagedStorageAccount…}
```
### Error output
```PowerShell
```
Contributor guide
Research direction
Start with the call at Create_Cert.ps1 line 151 and the Add-AzIoTDeviceProvisioningServiceCertificate implementation; compare the base64 value sent in the request with the expected certificate field. Reproduce the 400 response, then verify that a base64 certificate is sent without the file path prefix and the provisioning-service certificate operation succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100