Azure OIDC login fails in Github Actions #22628
Comments
v2kiran
added
bug
|
Hey @msJinLei I see "Could not find tenant id for provided tenant domain 'xxx'." in the result of |
isra-fel
added
Azure PS Team
Investigate 🔍
Authentication
and removed
needs-triage
|
Any update on this? |
The reported error is @v2kiran could you provide information about github action (here is an example #20720) you are using so that we can reproduce your case, thanks |
msJinLei
added
the
needs-author-feedback
microsoft-github-policy-service
bot
added
the
no-recent-activity
|
@msJinLei - sure . here is the workflow file: name: oidc-ps
# Required for OIDC
permissions:
id-token: write
contents: read
env:
ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
ARM_ENVIRONMENT: public
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
CLIENT_ID: ${{ secrets.CLIENT_ID }}
on:
workflow_dispatch:
push:
branches:
- 'main'
- 'releases/**'
jobs:
OIDCPSLogin:
name: Login using PS OIDC
runs-on: DEV-ACI
environment:
name: dev
steps:
- uses: actions/checkout@v2
- name: Login using oidc
shell: pwsh
run: |
$Audience = "api://AzureADTokenExchange"
$GitToken = $env:ACTIONS_ID_TOKEN_REQUEST_TOKEN
$GitTokenUrl = $env:ACTIONS_ID_TOKEN_REQUEST_URL
$apiUrl = "{0}&audience={1}" -f $GitTokenUrl, $Audience
$jwt_tokens = Invoke-RestMethod $apiUrl -Headers @{Authorization = ("bearer {0}" -f $GitToken)}
Write-Host "GitHub JWT url: $apiUrl"
Write-Host "GitHub JWT payload:"
$federatedToken = ($jwt_tokens.Value -split "\.")[1]
if(($federatedToken.Length % 4) -ne 0) {
$federatedToken = $federatedToken.PadRight($federatedToken.Length + 4 - ($federatedToken.Length % 4), "=")
}
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($federatedToken)) | convertfrom-json | convertto-json # Pretty print
Disable-AzContextAutosave -Scope Process
try
{
Connect-azaccount -TenantId ${{ env.ARM_TENANT_ID }} -ApplicationId ${{ env.ARM_CLIENT_ID }} -federatedtoken $GitToken -ServicePrincipal -erroraction stop
}
catch{
get-error -newest 1
resolve-azerror
write-verbose "psversiontable"
$psversiontable | out-string
write-verbose "az modules"
get-module az*
}
- name: Get secrets - Job__az_oidc_tst__Step-3
uses: azure/powershell@v1
with:
inlineScript: |
get-azresourcegroup | select -first 1 | out-string
azPSVersion: "latest"
|
microsoft-github-policy-service
bot
added
needs-team-attention
|
We're experiencing this same issue, are there any updates? |
|
Any updates on this? Using |
… is set to in memory token cache option Workaround Azure#22628
… is set to in memory token cache option Workaround Azure#22628
Root CauseIn client assertion login flow, when token cache option is set to be in memory, the following condition should be hit. The object we passed is inherited from The reason we create a new Solution
WorkaroundAfter PR #24416 is merged Disable-AzContextAutosave -Scope "Process"
Connect-AzAccount -ServicePrincipal -Tenant $tenantId -ApplicationId $appId -FederatedToken $federatedToken
$token = (Get-AzAccessToken).Token
Disconnect-AzAccount
Connect-AzAccount -AccessToken $token -Tenant $tenantId -AccountId $appId@isra-fel Please take a look |
Description
the following fails:
Issue script & Debug output
Environment data
Module versions
Error output
The text was updated successfully, but these errors were encountered: