0

We are facing some issues with all the pipeline a specific Azure DevOps project. When we are running it getting below error.

All these projects are calling KeyVault from the code to get the secret during build (we are using Build Cake extension) , it is failing now in pipeline. All these pipelines were working previously, even the pipelines working previously (not modified) also not working under same project.

{"error":{"code":"Unauthorized","message":"AKV10032: Invalid issuer. Expected one of https://sts.windows.net/xxxxxxxxxxxxx/, https://sts.windows.net/xxxxxxxxxxxxx/, https://sts.windows.net/xxxxxxxxxxxxx/, found https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/."}}

`- task: AzureCLI@2
  displayName: 'Cake Build with Azure CLI and Dotnet'
  inputs:
    scriptType: bash
    scriptLocation: inlineScript
    azureSubscription: 'Found-TEST'
    addSpnToEnvironment: true
    inlineScript: |
      az account set -s "XXXX-XXXXX-XXXXXX-"
      az account list
      dotnet run --project ${{parameters.project}}`

Steps/fixes we have followed

  1. Updated PAT Checked Service connection – it is correct
  2. Tried to access KeyVault from pipeline. Working.
  3. Tested the code locally to get the secret – Working
  4. We have set the subscription properly before calling dotnet project
5
  • Is it using defaultazurecredentials from code ?
    – Thomas
    Commented Jul 15, 2022 at 10:02
  • No we are using ChainedTokenCredential credential = new ChainedTokenCredential(new ManagedIdentityCredential(), new EnvironmentCredential(), new VisualStudioCredential(), new AzureCliCredential());
    – Ratheesh
    Commented Jul 15, 2022 at 10:09
  • 1
    I saw an error using the cli credentials. Try settings the tenant as env variable.
    – Thomas
    Commented Jul 15, 2022 at 11:12
  • Where do we set this? Is it in the application.settings or as a parameter?
    – Ratheesh
    Commented Jul 15, 2022 at 11:21
  • env variables. see learn.microsoft.com/en-us/dotnet/api/overview/azure/….
    – Thomas
    Commented Jul 16, 2022 at 4:21

1 Answer 1

1

There are few related open issues on github:

As a workaround for the moment, you could set the AAD Tenant Id as environment variable (powershell sample):

- task: AzureCLI@2
  displayName: 'Cake Build with Azure CLI and Dotnet'
  inputs:
    scriptType: pscore
    scriptLocation: inlineScript
    azureSubscription: 'Found-TEST'
    addSpnToEnvironment: true
    inlineScript: |
      az account set -s "XXXX-XXXXX-XXXXXX-"
      az account list
      $env:AZURE_TENANT_ID = "$($env:tenantId)";
      dotnet run --project ${{parameters.project}}
2
  • Awesome. This workaround fixed my pipeline. Thanks a ton, Thomas.
    – Ratheesh
    Commented Jul 18, 2022 at 4:26
  • 1
    I had the same issue last friday and saw your post so better share it :-)
    – Thomas
    Commented Jul 18, 2022 at 4:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.