ClientSecretCredential authentication failed: A configuration issue is preventing authentication - check the error message from the server for details

Question

I am trying to get the access token of the service principal using the following code.

$authUrl = "https://login.windows.net/" + $tenantid + "/oauth2/token/"
$body = @{
  grant_type    = "client_credentials"
  client_id     = $serviceprincipalid
  resource      = "https://management.azure.com/"
  client_secret = $serviceprincipalkey
};
$response = Invoke-RestMethod –Uri $authUrl –Method POST –Body $body

Write-Host $response
Write-Output $response.access_token
##vso[task.setvariable variable=myToken;]$response.access_token

The above code is working perfectly at my local machine's PowerShell but it is giving the following error when I am running the same code base in the Azure DevOps pipeline.

ClientSecretCredential authentication failed: A configuration issue is preventing 
authentication - check the error message from the server for details. You can modify the 
configuration in the application registration portal. See https://aka.ms/msal-net-invalid- 
client for details.  Original exception: AADSTS7000222: The provided client secret keys are 
expired. Visit the Azure Portal to create new keys for your app, or consider using certificate 
credentials for added security: https://docs.microsoft.com/azure/active- 
directory/develop/active-directory-certificate-credentials
Trace ID: 98787ui7-e8ae-4712-b8b5-7678u8765rt5
Correlation ID: yhjnbv43-56sy-9ksy-b8b5-mj876yu78i90
Timestamp: 2021-03-16 12:32:28Z
There was an error with the service principal used for the deployment.`

I checked the secret keys, but the secret keys not expired, it's expiry date is already set for the year 2022. And if it would expire then the code should not have worked at my local machine's PowerShell.

Does anyone have any idea? please let me know to resolve this issue.

user_9455659 · Answer

Well, actually the error was not caused by the script above, per my test, it works fine in devops.

If you use the Azure PowerShell task, it will let you configure a service connection to use, when you run the task, it will connect Azure powershell with the service principal configured in the service connection automatically. The error was caused by the expired secret of the service principal configured in the service connection, not the one in your script.

I can also reproduce your issue on my side.

To solve this issue, please follow the steps below.

1.Navigate to the Azure PowerShell task, check which service connection you used.

2.Navigate to the Project Settings in devops -> Service connections -> find the one you used -> click it -> Manage Service Principal.

Then it will open the related AD App page, just create a new secret and service connection, use it in the Azure Powershell task, follow the same steps I have mentioned here.

3.After configuration, test it again, it will work fine.

ClientSecretCredential authentication failed: A configuration issue is preventing authentication - check the error message from the server for details

1 Answers