Unable to decrypt Az CLI cred in ADO pipeline task

[syedhamjath]

Describe the bug

Unable to decrypt Az CLI cred in ADO pipeline task

Related command

It seems az login command is failing

Errors

PFA - Full log of task execution

Issue script & Debug output

PFA - Full log of task execution

Expected behavior

Using ADO - task: AzureCLI@2 az login needs to be successful with option addSpnToEnvironment: true

Environment Summary

azure-cli 2.52.0

core 2.52.0
telemetry 1.1.0

Extensions:
azure-devops 0.26.0

Dependencies:
msal 1.24.0b1
azure-mgmt-resource 23.1.0b2

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Program Files\Common Files\AzureCliExtensionDirectory'

Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

Below task is executed in a pool with more than one agent and it is utilized by more than few, I often get the error message : Key not valid for use in specified state.. App developer may consider this guidance:

dev.azure.com.txt

- task: AzureCLI@2
    displayName: 'Set credentials (RG SPN) for PrivilegedContext'
    inputs:
      azureSubscription:  ${{parameters.arm_service_connection}}
      scriptType: 'pscore'
      scriptLocation: 'inlineScript'
      addSpnToEnvironment: true
      useGlobalConfig: true
      inlineScript: |
        $azure_tenant_id = $env:tenantId
        Write-host "Variable name azure_tenant_id is set with Azure AD Tenant ID"
        Write-host "##vso[task.setvariable variable=azure_tenant_id;issecret=true]$azure_tenant_id"

        $azure_client_id = $env:servicePrincipalId
        Write-host "Variable name azure_client_id is set with resource group SPN Client ID"
        Write-host "##vso[task.setvariable variable=azure_client_id;issecret=true]$azure_client_id"

        $azure_client_secret = $env:servicePrincipalKey
        Write-host "Variable name azure_client_secret is set with resource group SPN credentials"
        Write-host "##vso[task.setvariable variable=azure_client_secret;issecret=true]$azure_client_secret"

[yonzhan]

Thank you for opening this issue, we will look into it.

[syedhamjath]

BTW., I found a work around for this but it does not mark the secret as secret

• task: AzureCLI@2
  displayName: 'Set credentials (RG SPN) for PrivilegedContext'
  inputs:
  azureSubscription: ${{parameters.arm_service_connection}}
  scriptType: 'pscore'
  scriptLocation: 'inlineScript'
  addSpnToEnvironment: true
  useGlobalConfig: true
  inlineScript: |
  Write-host "Variable name azure_tenant_id is set with Azure AD Tenant ID"
  Write-host "##vso[task.setvariable variable=azure_tenant_id;]$($env:tenantId)"

    Write-host "Variable name azure_client_id is set with resource group SPN Client ID"
    Write-host "##vso[task.setvariable variable=azure_client_id;]$($env:servicePrincipalId)"
  
    Write-host "Variable name azure_client_secret is set with resource group SPN credentials"
    Write-host "##vso[task.setvariable variable=azure_client_secret;]$($env:servicePrincipalKey)"