Save-AzContext is not working for service principal account

[jimvvv]

Description

I have two deployment group nodes in Azure DevOps. I put Save-AzContext in an Azure PowerShell task to save the context of the service connection. When I tried to restore the context from the json file, it worked on a node with Az.Accounts 2.8.0 but failed on the other node with Az.Accounts 2.12.2.

I followed the example 3 in this link to connect with the service principle account and then run Save-AzContext on each node.

Issue script & Debug output

PS C:\Users\ELK_Jimmy.Fan> $DebugPreference = "Continue"
PS C:\Users\ELK_Jimmy.Fan> Get-AzSubscription
DEBUG: 3:16:40 AM - GetAzureRMSubscriptionCommand begin processing with ParameterSet 'ListByIdInTenant'.
DEBUG: 3:16:40 AM - using account id 'b30d73d8-6b5f-4aa7-ab07-cd0c41e9109a'...
DEBUG: 3:16:40 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = [].
Returning default value [True].
WARNING: Unable to acquire token for tenant 'bf18836e-3a03-4f89-8750-e0392873f5c3' with error 'No certificate
thumbprint or secret provided for the given service principal 'b30d73d8-6b5f-4aa7-ab07-cd0c41e9109a'.'
WARNING: Unable to acquire token for tenant 'bf18836e-3a03-4f89-8750-e0392873f5c3' with error 'No certificate
thumbprint or secret provided for the given service principal 'b30d73d8-6b5f-4aa7-ab07-cd0c41e9109a'.'
DEBUG: 3:16:40 AM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning
default value [True].
DEBUG: AzureQoSEvent:  Module: Az.Accounts:2.12.2; CommandName: Get-AzSubscription; PSVersion: 5.1.17763.3770;
IsSuccess: True; Duration: 00:00:00.0096230
DEBUG: 3:16:40 AM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning
default value [True].
DEBUG: 3:16:40 AM - GetAzureRMSubscriptionCommand end processing.

Environment data

PS C:\Users\ELK_Jimmy.Fan> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.17763.3770
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17763.3770
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Module versions

PS C:\Users\ELK_Jimmy.Fan> Get-Module Az*

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     2.12.2     Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear...

Error output

PS C:\Users\ELK_Jimmy.Fan> Resolve-AzError
DEBUG: 3:19:26 AM - ResolveError begin processing with ParameterSet 'AnyErrorParameterSet'.
DEBUG: 3:19:26 AM - using account id 'b30d73d8-6b5f-4aa7-ab07-cd0c41e9109a'...
DEBUG: 3:19:26 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = [].
Returning default value [True].
WARNING: Upcoming breaking changes in the cmdlet 'Resolve-AzError' :
The `Resolve-Error` alias will be removed in a future release.  Please change any scripts that use this alias to use
`Resolve-AzError` instead.
Note : Go to https://aka.ms/azps-changewarnings for steps to suppress this breaking change warning, and other
information on breaking changes in Azure PowerShell.


DEBUG: 3:19:26 AM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning
default value [True].
DEBUG: AzureQoSEvent:  Module: Az.Accounts:2.12.2; CommandName: Resolve-AzError; PSVersion: 5.1.17763.3770; IsSuccess:
True; Duration: 00:00:00.0163423
DEBUG: 3:19:26 AM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning
default value [True].
DEBUG: 3:19:26 AM - ResolveError end processing.

[wyunchi-ms]

Hi @kzkz221 , do you mind to provide more details about the failure? Does the cmdlet throw an exception or just cannot restore it?
And a saw a warning message:

WARNING: Unable to acquire token for tenant 'xxx' with error 'No certificate
thumbprint or secret provided for the given service principal 'xxx'.'

Is this message shows in both nodes?

[jimvvv]

Hi @wyunchi-ms,

No, this message only showed on the node where Az.Accounts 2.12.2 installed.

I tried the execute Get-AzKeyVaultSecret from the node with Az-Accounts 2.12.2 and it threw the below exception:

Get-AzKeyVaultSecret : Your Azure credentials have not been set up or have expired, please run Connect-AzAccount to
set up your Azure credentials.
No certificate thumbprint or secret provided for the given service principal 'b30d73d8-6b5f-4aa7-ab07-cd0c41e9109a'.
At line:1 char:1
Get-AzKeyVaultSecret -VaultName PROD-REG-EUS2-MOA-VLT1 -Name CRMODS01 ...
CategoryInfo : CloseError: (:) [Get-AzKeyVaultSecret], AzPSArgumentException
FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.GetAzureKeyVaultSecret

But it works on the other node with Az-Accounts 2.8.0.

I think the issue is that the context is not able to restore for service principle account(application id/key) with Az.Accounts 2.12.2 but it is working with normal Azure account(username/password).

Could you help verify the restore with service principle account?

Thanks!

[wyunchi-ms]

Got it, we are investigating into this now and will response as soon as we find the root cause.

[msJinLei]

@kzkz221 Originally we store the service principal credentials in the context file (plain text) so that the customer can avoid inputting the credentials frequently. When you run Save-AzContext, we export the credentials into the exported file so that the customer can use it to login automatically from another machine. However, to enhance the security, we are now storing service principal credentials in an encrypted file and remove its plain text storage. That's why when run Save-AzContext, you cannot acquire token because the service principal credentials is removed. You cannot login automatically.
As a workaround, we are going to provide a switch parameter called -WithCredential to Save-AzContext in the next release. You can use this parameter to ask Az.Accounts to export service principal credentials so that you can use the exported file as before.

[LukeDearden]

@kzkz221 Originally we store the service principal credentials in the context file (plain text) so that the customer can avoid inputting the credentials frequently. When you run Save-AzContext, we export the credentials into the exported file so that the customer can use it to login automatically from another machine. However, to enhance the security, we are now storing service principal credentials in an encrypted file and remove its plain text storage. That's why when run Save-AzContext, you cannot acquire token because the service principal credentials is removed. You cannot login automatically. As a workaround, we are going to provide a switch parameter called -WithCredential to Save-AzContext in the next release. You can use this parameter to ask Az.Accounts to export service principal credentials so that you can use the exported file as before.

Which version of Az.Accounts was this security enhancement introduced?

We've got a strange issue where Save-AzContext is working as expected on two machines running Az.Accounts 2.11.2 but not on another which had Az.Accounts 2.12.2

We tried rolling back to 2.11.2 but still have the same problem

The context is created using

Connect-AzAccount -CertificateThumbprint $foo -ServicePrincipal -ApplicationId $baa -Tenant $foo

$PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.20348.1850
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.1850
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Save-AzContext -Path G:\test.json -Force
Save-AzContext : The parameter is incorrect.
At line:1 char:1
+ Save-AzContext -Path G:\test.json -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Save-AzContext], CryptographicException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SaveAzureRMContextCommand
    

Save-AzContext -Path G:\test.json -Force -Debug
DEBUG: 10:35:53 AM - SaveAzureRMContextCommand begin processing with ParameterSet '__AllParameterSets'.

Confirm

DEBUG: 10:35:54 AM - using account id 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx..
DEBUG: 10:35:54 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].

Confirm
Personally identifiable information and secrets may be written to the file at 'G:\test.json'.  Please ensure that the saved file is assigned appropriate access controls

DEBUG: 10:35:55 AM - [ConfigManager] Got [False] from [EnableDataCollection], Module = [], Cmdlet = [].

Confirm
The parameter is incorrect.

Save-AzContext : The parameter is incorrect.
At line:1 char:1
+ Save-AzContext -Path G:\test.json -Force -Debug
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Save-AzContext], CryptographicException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.SaveAzureRMContextCommand

DEBUG: 10:35:56 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent:  Module: Az.Accounts:2.11.2; CommandName: Save-AzContext; PSVersion: 5.1.20348.1850; IsSuccess: False; Duration: 00:00:03.5057523; Exception: The parameter is incorrect.
;
DEBUG: 10:35:56 AM - SaveAzureRMContextCommand end processing.

Resolve-AzError -Last |fl *
WARNING: Upcoming breaking changes in the cmdlet 'Resolve-AzError' :
The `Resolve-Error` alias will be removed in a future release.  Please change any scripts that use this alias to use `Resolve-AzError` instead.
Note : Go to https://aka.ms/azps-changewarnings for steps to suppress this breaking change warning, and other information on breaking changes in Azure PowerShell.


InnerException   : False
Exception        : System.Security.Cryptography.CryptographicException: The parameter is incorrect.

                      at System.Security.Cryptography.ProtectedData.Unprotect(Byte[] encryptedData, Byte[] optionalEntropy, DataProtectionScope scope)
                      at Microsoft.Identity.Client.Extensions.Msal.DpApiEncryptedFileAccessor.Read()
                      at Microsoft.Identity.Client.Extensions.Msal.Storage.ReadData()
                      at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper.LoadUnencryptedTokenCache()
                      at Microsoft.Azure.Commands.ResourceManager.Common.AzureRmProfileConverter.WriteJson(JsonWriter writer, Object value, JsonSerializer serializer)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeConvertable(JsonWriter writer, JsonConverter converter, Object value, JsonContract contract, JsonContainerContract collectionContract,
                   JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeObject(JsonWriter writer, Object value, JsonObjectContract contract, JsonProperty member, JsonContainerContract collectionContract,
                   JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeDictionary(JsonWriter writer, IDictionary values, JsonDictionaryContract contract, JsonProperty member, JsonContainerContract
                   collectionContract, JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeObject(JsonWriter writer, Object value, JsonObjectContract contract, JsonProperty member, JsonContainerContract collectionContract,
                   JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.Serialize(JsonWriter jsonWriter, Object value, Type objectType)
                      at Newtonsoft.Json.JsonSerializer.SerializeInternal(JsonWriter jsonWriter, Object value, Type objectType)
                      at Newtonsoft.Json.JsonConvert.SerializeObjectInternal(Object value, Type type, JsonSerializer jsonSerializer)
                      at Newtonsoft.Json.JsonConvert.SerializeObject(Object value, Formatting formatting, JsonConverter[] converters)
                      at Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile.Save(IFileProvider provider, Boolean serializeCache)
                      at Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile.Save(String path, Boolean serializeCache)
                      at Microsoft.Azure.Commands.Profile.SaveAzureRMContextCommand.ExecuteCmdlet()
                      at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Message          : The parameter is incorrect.

StackTrace       :    at System.Security.Cryptography.ProtectedData.Unprotect(Byte[] encryptedData, Byte[] optionalEntropy, DataProtectionScope scope)
                      at Microsoft.Identity.Client.Extensions.Msal.DpApiEncryptedFileAccessor.Read()
                      at Microsoft.Identity.Client.Extensions.Msal.Storage.ReadData()
                      at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper.LoadUnencryptedTokenCache()
                      at Microsoft.Azure.Commands.ResourceManager.Common.AzureRmProfileConverter.WriteJson(JsonWriter writer, Object value, JsonSerializer serializer)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeConvertable(JsonWriter writer, JsonConverter converter, Object value, JsonContract contract, JsonContainerContract collectionContract,
                   JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeObject(JsonWriter writer, Object value, JsonObjectContract contract, JsonProperty member, JsonContainerContract collectionContract,
                   JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeDictionary(JsonWriter writer, IDictionary values, JsonDictionaryContract contract, JsonProperty member, JsonContainerContract
                   collectionContract, JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.SerializeObject(JsonWriter writer, Object value, JsonObjectContract contract, JsonProperty member, JsonContainerContract collectionContract,
                   JsonProperty containerProperty)
                      at Newtonsoft.Json.Serialization.JsonSerializerInternalWriter.Serialize(JsonWriter jsonWriter, Object value, Type objectType)
                      at Newtonsoft.Json.JsonSerializer.SerializeInternal(JsonWriter jsonWriter, Object value, Type objectType)
                      at Newtonsoft.Json.JsonConvert.SerializeObjectInternal(Object value, Type type, JsonSerializer jsonSerializer)
                      at Newtonsoft.Json.JsonConvert.SerializeObject(Object value, Formatting formatting, JsonConverter[] converters)
                      at Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile.Save(IFileProvider provider, Boolean serializeCache)
                      at Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile.Save(String path, Boolean serializeCache)
                      at Microsoft.Azure.Commands.Profile.SaveAzureRMContextCommand.ExecuteCmdlet()
                      at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
HelpLink         :
ErrorDetails     :
ErrorCategory    : CloseError: (:) [Save-AzContext], CryptographicException
InvocationInfo   : System.Management.Automation.InvocationInfo
ScriptStackTrace : at <ScriptBlock>, <No file>: line 1`

```

[LukeDearden]

Hi @wyunchi-ms,

No, this message only showed on the node where Az.Accounts 2.12.2 installed.

I tried the execute Get-AzKeyVaultSecret from the node with Az-Accounts 2.12.2 and it threw the below exception:

Get-AzKeyVaultSecret : Your Azure credentials have not been set up or have expired, please run Connect-AzAccount to
set up your Azure credentials.
No certificate thumbprint or secret provided for the given service principal 'b30d73d8-6b5f-4aa7-ab07-cd0c41e9109a'.
At line:1 char:1
Get-AzKeyVaultSecret -VaultName PROD-REG-EUS2-MOA-VLT1 -Name CRMODS01 ...
CategoryInfo : CloseError: (:) [Get-AzKeyVaultSecret], AzPSArgumentException
FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.GetAzureKeyVaultSecret

But it works on the other node with Az-Accounts 2.8.0.

I think the issue is that the context is not able to restore for service principle account(application id/key) with Az.Accounts 2.12.2 but it is working with normal Azure account(username/password).

Could you help verify the restore with service principle account?

Thanks!

Did you have any success rolling back to a known working version of Az.Accounts?