Connect-AzAccount: ClientCertificateCredential authentication failed #22480
Comments
runemy
added
bug
ghost
added
customer-reported
and removed
needs-triage
|
I use tenant-id to connect, not tenant-name |
|
@msJinLei please take a look. Thanks. |
|
@msJinLei did you get any chance to look into this? |
|
@runemy to use Thumbprint to login, you should firstly ensure the certificate is installed in your local machine. try to use the following way to see whether the certificate is installed Get-ChildItem -Path 'cert:\LocalMachine\My' | Where-Object { $_.Thumbprint -eq '984E459FF99D87FD97AFC46DCDCBCB90E0B7FCD5' } | Select Thumbprint,Subject,NotAfter,FriendlyName |
msJinLei
added
the
needs-author-feedback
microsoft-github-policy-service
bot
added
the
no-recent-activity
The certificate must locate in "LocalMachine" and be removed from "CurrentUser" to work. |
microsoft-github-policy-service
bot
removed
the
no-recent-activity
microsoft-github-policy-service
bot
added
the
no-recent-activity
|
Hi, I'm hitting what I think is a similar issue. I have a wrapper/proxy/helper function that attempts to connect to the Graph API (via Connect-MgGraph) and ARM (via Connect-AzAccount). This function works fine from the command line when executing as myself, using a certificate in the Edit: Removed text as I think I've narrowed this down to PowerShell 5.1. When running as PowerShell 7.3.9 it works but 5.1 errors with: PSVersionTable:
Any ideas? Thank you. |
microsoft-github-policy-service
bot
removed
the
no-recent-activity
microsoft-github-policy-service
bot
added
the
no-recent-activity
|
This impacts multiple users across Windows 10, Windows 11 and Windows Server 2022. PowerShell 5.1 will not connect, but PowerShell 7+ works. |
microsoft-github-policy-service
bot
removed
the
no-recent-activity
I think this error message was from the query-tenant-id-by-domain-name feature @msJinLei please take a look. Also @robinmalik if you know the ID of the tenant (directory) we'd suggest connecting with |
|
@isra-fel Thanks for the reply. Just to confirm that we're only using the tenant id, and not the domain name. |
microsoft-github-policy-service
bot
added
the
no-recent-activity
|
This bot needs looking at. It's commenting this across a range of issues when the onus isn't on the people with the issue to reply (again). |
microsoft-github-policy-service
bot
removed
the
no-recent-activity
|
Getting the same error as Robin on PSv5. Certificate is installed systemwide, TenantId being passed, with a service principal that is already used elsewhere. As far as I can tell the only difference between working and non-working code is that I'm on As an aside, the error message doesn't make sense if you're using a GUID to connect. |
|
Confirmed that the "Entrypoint not found" error goes away by downgrading |
microsoft-github-policy-service
bot
added
the
no-recent-activity
|
Comment because of bot. |
microsoft-github-policy-service
bot
removed
the
no-recent-activity
microsoft-github-policy-service
bot
added
the
no-recent-activity
|
What needs done to fix this? Do I need to identify the exact release the issue occurred? It's fine if you need more information to help but radio silence and having the bot close this is not helpful. |
microsoft-github-policy-service
bot
removed
the
no-recent-activity
|
Why does this keep getting closed when there is no resolution? |
|
Issue persists |
|
@Makzemann Agreed, I've had to downgrade several modules to maintain functionality. It seems the bug was introduced around October 2022, so everything released before then continues to work. |
|
Ran into this error again on Az.Accounts v2.17.0 and gained some new insights. NOTE: I'm describing an instance of the 'Keyset' error, not the 'Entrypoint' error which may or may not be fixed. The Error Insights:
Based on that, you can try one of the following to fix the issue:
This script tries to determine your access level to the certificate by checking if the private key exists and whether the private key property returns an object or null back. $Thumbprint = 'thumbprint_here'
# Search everything
$Certificate = Get-ChildItem 'cert:\' -Recurse |
Where-Object { $_.Thumbprint -eq $Thumbprint } |
Select-Object -First 1
# Test programmatic access to the private key
if ($Certificate) {
if ($Certificate.HasPrivateKey -and
[String]::IsNullOrEmpty($Certificate.PrivateKey))
{
Write-Host "This user does not have permissions to the private key."
} else {
Write-Host "This user has permissions to the private key."
}
} else {
Write-Host "Could not find cert with thumbprint '$Thumbprint'"
} |
This fixed the issue for me. I had to update the private key permissions. |
Description
Hi,
With reference to #20728, that is now closed 3 weeks ago?
Looks like that my case have similarities with this issue.
I need to do an Connect-AzAccount with use of ServicePrincipal, with a CertificateThumbprint to a specific tenant (I have many tenants).
I have tried with use of both "-Tenant" and "-TenantId". Get the same Error on both.
PS C:\Users\T1-runemy\ps> Connect-AzAccount -CertificateThumbprint $Thumbprint -ApplicationId $ApplicationId -TenantId $TenantId -ServicePrincipal
Connect-AzAccount: ClientCertificateCredential authentication failed: Keyset does not exist
Could not find tenant id for provided tenant domain ''. Please ensure that the provided service principal '' is found in the provided tenant domain.
I have verified that the provided SPN ApplicationId (ClientId) is in my tenant and that this SPN do have valid CertificateThumbprint.
Issue script & Debug output
Environment data
Module versions
Error output
The text was updated successfully, but these errors were encountered: