无法在 Azure Devops 中使用 PowerShell 任务获取令牌

Question

I have developed a PowerShell script which runs as expected when running on my laptop directly. However when running the script through Azure Devops it is failing to acquire the token and throws an error saying the client secret is incorrect.

The script is called as a PowerShell task from the pipeline, it runs on an ubuntu ADO agent.

The script creates an AAD App Registration, sets some API permissions up, and then uses this registration to create some other elements in the AAD.

Once the app registration is created, the script generates a Client Secret using

$clientSecret = (az ad app credential reset --id $appId --append  | ConvertFrom-Json).password

I can do a Write-Host $clientSecret in the script and the job shows the correct secret that was generated.

The section that fails is during the Invoke-WebRequest command used to get the token.

# connect to graph using the application registration
$url = "https://login.microsoftonline.com/$b2cTenantId/oauth2/token"
$resource = "https://graph.microsoft.com/"
$restbody = @{
     grant_type    = 'client_credentials'
     client_id     = $appID
     client_secret = $clientSecret
     resource      = $resource
}

Write-Host "Rest Body = "
Write-Host ($restbody | out-string)
# Get the return Auth Token
$token = Invoke-WebRequest -Method POST -Uri $url -Body $restbody 
     

The error thrown is

{"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app

As I said, exactly the same script, using the same credentials runs locally fine. The script does an AZ Login and Connect-AZAccount first.

Answer 1

To protect the secrets (password, access token, etc..) and prevent them from being leaked, Azure Pipelines does not recommend direct plaintext of secrets in the scripts.

You need to set the secrets as secret variables through the logging command " SetVariable ".

- pwsh: |
    Write-Host "##vso[task.setvariable variable=clientSecret;issecret=true]{Secret Value}"
  name: 'Set Secret'

Then in the subsequently PowerShell tasks, you can map the secret variables as environment variables for use in the PowerShell scripts.

  - powershell: | 
      Write-Host "This is a script that could use $CLIENT_SECRET"
      Write-Host "$CLIENT_SECRET= $(clientSecret)"
    env:
      CLIENT_SECRET: $(clientSecret)