CI/CD to Azure tenant, fetch client error

[tabit01]

I wish to implement a Sharepoint Framework CI/CD flow for our Sharepoint Framework solutions using Azure DevOps Pipelines. I am following MS CI/CD docs and PnP CLI login docs

Our goal is to create a deployment flow without interaction or using credentials. Here is a snippet of the deploy template yaml:

- script: |
    export CLIMICROSOFT365_AADAPPID=<AAD APP ID>
    export CLIMICROSOFT365_TENANT=<TENANT ID>
    printenv
  displayName: Set environment variables
- script: m365 login --authType secret --secret <SECRET VALUE>
  displayName: Login to Microsoft 365

The deployment fails in this task, presenting this error:

========================== Starting Command Output ===========================
/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/ce9d1fdf-66ef-4bb5-bb9a-7dfbaef33d52.sh
Error: network_error: Network request failed. Please check network trace to determine root cause. | Fetch client threw: Error: HTTP status code 401 | Attempted to reach: https://login.microsoftonline.com/common/oauth2/v2.0/token
##[error]Bash exited with code '1'.
Finishing: Login to Microsoft 365

Does anyone have related experience, or useful debugging directions?

[nanddeepn]

Hi @tor-axbit
The script sample example here might help you.

[tabit01]

thanks, sorry for cross-posting btw, meant to post only here.

So the script you provide is regarding authenticating with a certificate, rather than secret login as I was attempting. Would you recommend the certificate authentication instead of secret?

[nanddeepn]

Certificate is considered more secure than a Secret.

[waldekmastykarz]

Could it be that you disallow outgoing network connections on the agent @tor-axbit?

[tabit01]

Yes, something went wrong with token fetch. Obviously I can't rule out input error, though we have tried to assert that clientID, tenantID and secret matches the values in Azure.

Also, we get the exact same 401 error from both certificate and secret login methods.

- script: |
    export CLIMICROSOFT365_AADAPPID=<APP REGISTRATION ID>
    export CLIMICROSOFT365_TENANT=<TENANT ID>
    printenv
  displayName: Set environment variables
- task: DownloadSecureFile@1
  name: certificate
  displayName: 'Download CA certificate'
  inputs:
    secureFile: 'myCertificate.pfx'
- script: m365 login --authType certificate --certificateFile $(certificate.secureFilePath) --password $(m365_certificate_password)
  displayName: Login to Microsoft 365

To note:

• We are using the client ID from our AppRegistration
• The tenant has MFA enabled
• The tenant has enabled "Untrusted Device" policy

[waldekmastykarz]

Have you tried using the same credentials to login from your machine just to rule out an error there?

[tabit01]

I will try local login today, thank you for advice.

However, yesterday we managed to the make the login script work* in the pipeline, by setting clientID and tenantID as arguments in login, in addition to setting the environment variables:

- script: |
    export CLIMICROSOFT365_AADAPPID=<CLIENT ID>
    export CLIMICROSOFT365_TENANT=<TENANT ID>
    printenv
  displayName: Set environment variables
- task: DownloadSecureFile@1
  name: certificate
  displayName: 'Download CA certificate'
  inputs:
    secureFile: 'myCertificate.pfx'
- script: m365 login --authType certificate --certificateFile $(certificate.secureFilePath) --password $(m365_certificate_password) --appId <CLIENT ID> --tenant <TENANT ID>
  displayName: Login to Microsoft 365

* Work as in the script being marked as finished, then getting

/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/c56740ea-fa63-4318-ae79-2da7699ce49d.sh
Error: Request failed with status code 403
##[error]Bash exited with code '1'.

at the m365 spo add script run.

Is this a valid approach? According to docs, there should not be extra arguments for logging in with certificate?

[tabit01]

Answering myself here, sorry for verbosity. It seems that passing arguments to m365 login --authType certificate is valid, according to source code.

So it seems that client ID and tenant ID from environment variables are not picked up by our script. The arguments have to be set in login command.

[waldekmastykarz]

We should pick up env vars:

cli-microsoft365/src/config.ts

Line 7 in ae1ef3e

cliAadAppId: process.env.CLIMICROSOFT365_AADAPPID || cliAadAppId,

If that's not the case, let's submit an issue with steps to reproduce so that we can investigate it and fix it.

I appreciate your help and sharing all the information. I'm sure it will help others! Thank you!

[tabit01]

So the solution was twofold, it seems.

1. Upload certificate file to AppRegistration in Azure
2. Use arguments for Client ID and Tenant ID in login script:

- script: m365 login --authType certificate --certificateFile $(certificate.secureFilePath) --password $(m365_certificate_password) --appId <CLIENT ID> --tenant <TENANT ID>
          displayName: Login to Microsoft 365

[martinlingstuyl]

That's correct. Azure AD has no way to validate you are allowed to login using the certificate in combination with the appId if it doesn't know the certificate is related to the app. It's like you created a secure passsword in your password vault and forgot to configure it using the 'change Password' form.