From 1d7d77d62237a571bf0e07c416122839d0e918e1 Mon Sep 17 00:00:00 2001 From: Kamil Nowinski Date: Sat, 6 Jun 2026 20:42:13 +0100 Subject: [PATCH 1/5] Fixed ClientAssertionCredential authentication failure for federated identity (OIDC) credentials by removing redundant `Get-AzAccessToken` calls in `Get-AzDFV2Credential` and `Remove-AdfObjectRestAPI` #492 --- changelog.md | 6 ++++++ private/Get-AzDFV2Credential.ps1 | 7 ------- private/Remove-AdfObjectRestAPI.ps1 | 8 +------- test/Get-AzDFV2Credential.Tests.ps1 | 14 -------------- 4 files changed, 7 insertions(+), 28 deletions(-) diff --git a/changelog.md b/changelog.md index 91a3b61..78210eb 100644 --- a/changelog.md +++ b/changelog.md @@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). +## [1.16.0] - 2026-06-06 + +### Fixed + +* Fixed ClientAssertionCredential authentication failure for federated identity (OIDC) credentials by removing redundant `Get-AzAccessToken` calls in `Get-AzDFV2Credential` and `Remove-AdfObjectRestAPI` #492 + ## [1.15.0] - 2026-05-26 ### Added * Credential type of ADF objects is now supported for deployment via REST API diff --git a/private/Get-AzDFV2Credential.ps1 b/private/Get-AzDFV2Credential.ps1 index c0cffad..b054e0f 100644 --- a/private/Get-AzDFV2Credential.ps1 +++ b/private/Get-AzDFV2Credential.ps1 @@ -5,13 +5,6 @@ function Get-AzDFV2Credential { ) Write-Debug "BEGIN: Get-AzDFV2Credential" - # Retrieve all credentials via API without parsing - $token = Get-AzAccessToken -ResourceUrl 'https://management.azure.com' - $tokenStr = [System.Net.NetworkCredential]::new('', $token.Token).Password - $authHeader = @{ - 'Content-Type' = 'application/json' - 'Authorization' = 'Bearer ' + $tokenStr - } $url = "$($script:BaseApiUrl)$($adfi.DataFactoryId)/credentials?api-version=2018-06-01" # Retrieve all credentials via Rest API diff --git a/private/Remove-AdfObjectRestAPI.ps1 b/private/Remove-AdfObjectRestAPI.ps1 index 8aba3d6..0517882 100644 --- a/private/Remove-AdfObjectRestAPI.ps1 +++ b/private/Remove-AdfObjectRestAPI.ps1 @@ -8,16 +8,10 @@ function Remove-AdfObjectRestAPI { Write-Debug "BEGIN: Remove-AdfObjectRestAPI()" - $token = Get-AzAccessToken -ResourceUrl 'https://management.azure.com' - $tokenStr = [System.Net.NetworkCredential]::new('', $token.Token).Password - $authHeader = @{ - 'Content-Type' = 'application/json' - 'Authorization' = 'Bearer ' + $tokenStr - } $url = "$($script:BaseApiUrl)$($adfInstance.Id)/$type_plural/$($name)?api-version=2018-06-01" # Delete given object via Rest API - $r = Invoke-AzRestMethod -Method 'DELETE' -Uri $url #-Headers $authHeader -ContentType "application/json" + $r = Invoke-AzRestMethod -Method 'DELETE' -Uri $url if ($r.StatusCode -ne 200) { Write-Error -Message "Unexpected response code: $($r.StatusCode) from the API." } diff --git a/test/Get-AzDFV2Credential.Tests.ps1 b/test/Get-AzDFV2Credential.Tests.ps1 index 2b80afd..211bb4c 100644 --- a/test/Get-AzDFV2Credential.Tests.ps1 +++ b/test/Get-AzDFV2Credential.Tests.ps1 @@ -20,9 +20,6 @@ InModuleScope azure.datafactory.tools { BeforeEach { $script:adfi = [PSCustomObject]@{ DataFactoryId = '/subscriptions/sub-123/resourceGroups/rg/providers/Microsoft.DataFactory/factories/adf1' } - Mock Get-AzAccessToken { - return [PSCustomObject]@{ Token = 'fake-token-abc' } - } Mock Invoke-AzRestMethod { return [PSCustomObject]@{ StatusCode = 200; Content = '{"value":[]}' } } @@ -33,11 +30,6 @@ InModuleScope azure.datafactory.tools { @($result).Count | Should -Be 0 } - It 'Should call Get-AzAccessToken once' { - Get-AzDFV2Credential -adfi $script:adfi - Assert-MockCalled Get-AzAccessToken -Times 1 -Exactly - } - It 'Should call Invoke-AzRestMethod once' { Get-AzDFV2Credential -adfi $script:adfi Assert-MockCalled Invoke-AzRestMethod -Times 1 -Exactly @@ -66,9 +58,6 @@ InModuleScope azure.datafactory.tools { $cred2 = [PSCustomObject]@{ name = 'cred2'; type = 'Microsoft.DataFactory/factories/credentials'; properties = @{} } $script:credJson = @{ value = @($cred1, $cred2) } | ConvertTo-Json -Depth 5 - Mock Get-AzAccessToken { - return [PSCustomObject]@{ Token = 'fake-token-abc' } - } Mock Invoke-AzRestMethod { return [PSCustomObject]@{ StatusCode = 200; Content = $script:credJson } } @@ -97,9 +86,6 @@ InModuleScope azure.datafactory.tools { BeforeEach { $script:adfi = [PSCustomObject]@{ DataFactoryId = '/subscriptions/sub-123/resourceGroups/rg/providers/Microsoft.DataFactory/factories/adf1' } - Mock Get-AzAccessToken { - return [PSCustomObject]@{ Token = 'fake-token-abc' } - } Mock Invoke-AzRestMethod { throw 'Unauthorized' } } From 65e4ca82bec1b0e4f6bed09167ba13cdaa469e46 Mon Sep 17 00:00:00 2001 From: Kamil Nowinski Date: Tue, 9 Jun 2026 22:07:07 +0100 Subject: [PATCH 2/5] Update version 1.16.0 --- azure.datafactory.tools.psd1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/azure.datafactory.tools.psd1 b/azure.datafactory.tools.psd1 index 8bccb32..f99e0db 100644 --- a/azure.datafactory.tools.psd1 +++ b/azure.datafactory.tools.psd1 @@ -12,7 +12,7 @@ RootModule = 'azure.datafactory.tools.psm1' # Version number of this module. - ModuleVersion = '1.15.0' + ModuleVersion = '1.16.0' # Supported PSEditions # CompatiblePSEditions = @() From 73939583cd4739e05115f7bfc50bb9f25f83aae7 Mon Sep 17 00:00:00 2001 From: Kamil Nowinski Date: Tue, 9 Jun 2026 22:44:13 +0100 Subject: [PATCH 3/5] All in one CI/CD --- .github/workflows/ci-cd.yml | 55 +++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 .github/workflows/ci-cd.yml diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml new file mode 100644 index 0000000..3ddcf5f --- /dev/null +++ b/.github/workflows/ci-cd.yml @@ -0,0 +1,55 @@ +name: CI/CD + +on: + push: + branches: ['**'] + pull_request: + workflow_dispatch: + +permissions: + contents: read + checks: write # required by dorny/test-reporter + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Run Unit Tests + runs-on: windows-latest + + steps: + - uses: actions/checkout@v4 + + - name: Run Unit Tests + shell: pwsh + run: | + test/!RunAllTests.ps1 -folder '${{ github.workspace }}/' -TestFilenameFilter "*" -InstallModules:$false -ResultOutputFormat "JUnitXml" + + - name: Publish Test Results + uses: dorny/test-reporter@v3 + if: ${{ !cancelled() }} + with: + name: Pester Tests + path: '**/TEST-*.xml' + reporter: java-junit + collapsed: 'auto' + + publish: + name: Publish to PS Gallery + runs-on: windows-latest + needs: test + if: ${{ github.event_name != 'pull_request' }} + + steps: + - uses: actions/checkout@v4 + + - name: Publish module to PowerShell Gallery + shell: pwsh + env: + PSGALLERY_API_KEY: ${{ secrets.PSGALLERY_API_KEY }} + run: | + $isPreview = '${{ github.ref_name }}' -ne 'master' + Write-Host "Branch: ${{ github.ref_name }} | Preview: $isPreview" + ./tools/Publish-ToGallery.ps1 -IsPreview:$isPreview -NuGetApiKey $env:PSGALLERY_API_KEY From 16f2fd740d988a274fc0882fb5a48fa604bd1b15 Mon Sep 17 00:00:00 2001 From: Kamil Nowinski Date: Wed, 10 Jun 2026 03:51:30 +0100 Subject: [PATCH 4/5] Login to run correct tests --- .github/workflows/ci-cd.yml | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 3ddcf5f..0c93938 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -22,10 +22,18 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Login via Az module + uses: azure/login@v3 + with: + creds: ${{ secrets.AZURE_CREDENTIALS }} + enable-AzPSSession: true + - name: Run Unit Tests - shell: pwsh - run: | - test/!RunAllTests.ps1 -folder '${{ github.workspace }}/' -TestFilenameFilter "*" -InstallModules:$false -ResultOutputFormat "JUnitXml" + uses: azure/powershell@v3 + with: + inlineScript: | + test/!RunAllTests.ps1 -folder '${{ github.workspace }}/' -TestFilenameFilter "*" -InstallModules:$false -ResultOutputFormat "JUnitXml" + azPSVersion: "latest" - name: Publish Test Results uses: dorny/test-reporter@v3 From bcbdc3473f59f687dedcc558dcc7a60c74eb0176 Mon Sep 17 00:00:00 2001 From: Kamil Nowinski Date: Wed, 10 Jun 2026 03:57:46 +0100 Subject: [PATCH 5/5] deploy preview module version only from `develop` branch --- .github/workflows/ci-cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 0c93938..bdcabaf 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -48,7 +48,7 @@ jobs: name: Publish to PS Gallery runs-on: windows-latest needs: test - if: ${{ github.event_name != 'pull_request' }} + if: ${{ github.event_name != 'pull_request' && (github.ref_name == 'master' || github.ref_name == 'develop') }} steps: - uses: actions/checkout@v4