Skip to content

Commit 5560264

Browse files
starkmsustarkmsu
committed
Added environment variable AZURESUBSCRIPTION_SERVICE_CONNECTION_ID for AzureCLIV2 and AzurePowerShellV5 for WIF auth flow
1 parent f963d4b commit 5560264

30 files changed

+1089
-1995
lines changed

‎Tasks/AzureCLIV2/azureclitask.ts

+7-3
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ export class azureclitask {
3333
var connectedService: string = tl.getInput("connectedServiceNameARM", true);
3434
await this.loginAzureRM(connectedService);
3535

36+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = connectedService;
37+
3638
let errLinesCount: number = 0;
3739
let aggregatedErrorLines: string[] = [];
3840
tool.on('errline', (errorLine: string) => {
@@ -100,16 +102,16 @@ export class azureclitask {
100102
if (typeof toolExecutionError === 'string') {
101103
const expiredSecretErrorCode = 'AADSTS7000222';
102104
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
103-
105+
104106
if (serviceEndpointSecretIsExpired) {
105107
const organizationURL = tl.getVariable('System.CollectionUri');
106108
const projectName = tl.getVariable('System.TeamProject');
107109
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
108-
110+
109111
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
110112
}
111113
}
112-
114+
113115
tl.setResult(tl.TaskResult.Failed, message);
114116
} else if (exitCode != 0){
115117
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedWithExitCode", exitCode));
@@ -122,6 +124,8 @@ export class azureclitask {
122124
if (this.isLoggedIn) {
123125
this.logoutAzure();
124126
}
127+
128+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = '';
125129
}
126130
}
127131

‎Tasks/AzureCLIV2/task.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
"demands": [],
2020
"version": {
2121
"Major": 2,
22-
"Minor": 238,
23-
"Patch": 4
22+
"Minor": 239,
23+
"Patch": 0
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",

‎Tasks/AzureCLIV2/task.loc.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
"demands": [],
2020
"version": {
2121
"Major": 2,
22-
"Minor": 238,
23-
"Patch": 4
22+
"Minor": 239,
23+
"Patch": 0
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",

‎Tasks/AzurePowerShellV5/AzurePowerShell.ps1

+1
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ finally {
195195
. "$PSScriptRoot\Utility.ps1"
196196
Import-Module "$PSScriptRoot\ps_modules\VstsAzureHelpers_"
197197
Remove-EndpointSecrets
198+
$env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = ''
198199
Update-PSModulePathForHostedAgent
199200
Disconnect-AzureAndClearContext -restrictContext 'True' -ErrorAction SilentlyContinue
200201
}

‎Tasks/AzurePowerShellV5/CoreAz.ps1

+3-1
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,6 @@ $endpointObject = ConvertFrom-Json $endpoint
2929
Import-Module "$PSScriptRoot\ps_modules\VstsAzureHelpers_"
3030
$encryptedToken = ConvertTo-SecureString $vstsAccessToken -AsPlainText -Force
3131
Initialize-AzModule -Endpoint $endpointObject -connectedServiceNameARM $connectedServiceNameARM `
32-
-azVersion $targetAzurePs -isPSCore $isPSCore -encryptedToken $encryptedToken
32+
-azVersion $targetAzurePs -isPSCore $isPSCore -encryptedToken $encryptedToken
33+
34+
$env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = $connectedServiceNameARM

‎Tasks/AzurePowerShellV5/InitializeAz.ps1

+5-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ param
66
[String] [Parameter(Mandatory = $false)]
77
$targetAzurePs,
88
[String] [Parameter(Mandatory = $false)]
9-
$clientAssertionJwt
9+
$clientAssertionJwt,
10+
[String] [Parameter(Mandatory = $false)]
11+
$serviceConnectionId
1012
)
1113

1214
$endpointObject = ConvertFrom-Json $endpoint
@@ -115,6 +117,8 @@ elseif ($endpointObject.scheme -eq 'WorkloadIdentityFederation') {
115117
Write-Host "##[command] Set-AzContext -SubscriptionId $($endpointObject.subscriptionID) -TenantId $($endpointObject.tenantId)"
116118
$null = Set-AzContext -SubscriptionId $endpointObject.subscriptionID -TenantId $endpointObject.tenantId
117119
}
120+
121+
$env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = $serviceConnectionId
118122
}
119123
else {
120124
# Provide an additional, custom, credentials-related error message. Will handle localization later

‎Tasks/AzurePowerShellV5/azurepowershell.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ async function run() {
8383
}
8484
if (endpointObject.scheme === 'WorkloadIdentityFederation') {
8585
const oidc_token = await endpointObject.applicationTokenCredentials.getFederatedToken();
86-
initAzCommand += ` -clientAssertionJwt ${oidc_token}`;
86+
initAzCommand += ` -clientAssertionJwt ${oidc_token} -serviceConnectionId ${serviceName}`;
8787
}
8888
contents.push(initAzCommand);
8989

@@ -171,6 +171,8 @@ async function run() {
171171
.arg('-Command')
172172
.arg(`. '${path.join(path.resolve(__dirname),'RemoveAzContext.ps1')}'`);
173173

174+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = '';
175+
174176
let options = <tr.IExecOptions>{
175177
cwd: input_workingDirectory,
176178
failOnStdErr: false,

‎Tasks/AzurePowerShellV5/task.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"version": {
1919
"Major": 5,
2020
"Minor": 239,
21-
"Patch": 0
21+
"Patch": 2
2222
},
2323
"releaseNotes": "Added support for Az Module and cross platform agents.",
2424
"groups": [

‎Tasks/AzurePowerShellV5/task.loc.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"version": {
1919
"Major": 5,
2020
"Minor": 239,
21-
"Patch": 0
21+
"Patch": 2
2222
},
2323
"releaseNotes": "ms-resource:loc.releaseNotes",
2424
"groups": [

‎_generated/AzureCLIV2.versionmap.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
Default|2.238.4
2-
Node20_229_2|2.238.5
1+
Default|2.239.0
2+
Node20_229_2|2.239.1

‎_generated/AzureCLIV2/azureclitask.ts

+7-3
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ export class azureclitask {
3333
var connectedService: string = tl.getInput("connectedServiceNameARM", true);
3434
await this.loginAzureRM(connectedService);
3535

36+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = connectedService;
37+
3638
let errLinesCount: number = 0;
3739
let aggregatedErrorLines: string[] = [];
3840
tool.on('errline', (errorLine: string) => {
@@ -100,16 +102,16 @@ export class azureclitask {
100102
if (typeof toolExecutionError === 'string') {
101103
const expiredSecretErrorCode = 'AADSTS7000222';
102104
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
103-
105+
104106
if (serviceEndpointSecretIsExpired) {
105107
const organizationURL = tl.getVariable('System.CollectionUri');
106108
const projectName = tl.getVariable('System.TeamProject');
107109
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
108-
110+
109111
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
110112
}
111113
}
112-
114+
113115
tl.setResult(tl.TaskResult.Failed, message);
114116
} else if (exitCode != 0){
115117
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedWithExitCode", exitCode));
@@ -122,6 +124,8 @@ export class azureclitask {
122124
if (this.isLoggedIn) {
123125
this.logoutAzure();
124126
}
127+
128+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = '';
125129
}
126130
}
127131

‎_generated/AzureCLIV2/task.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
"demands": [],
2020
"version": {
2121
"Major": 2,
22-
"Minor": 238,
23-
"Patch": 4
22+
"Minor": 239,
23+
"Patch": 0
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",
@@ -204,7 +204,7 @@
204204
"ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at\u00A0%s See\u00A0https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
205205
},
206206
"_buildConfigMapping": {
207-
"Default": "2.238.4",
208-
"Node20_229_2": "2.238.5"
207+
"Default": "2.239.0",
208+
"Node20_229_2": "2.239.1"
209209
}
210210
}

‎_generated/AzureCLIV2/task.loc.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
"demands": [],
2020
"version": {
2121
"Major": 2,
22-
"Minor": 238,
23-
"Patch": 4
22+
"Minor": 239,
23+
"Patch": 0
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
@@ -204,7 +204,7 @@
204204
"ExpiredServicePrincipalMessageWithLink": "ms-resource:loc.messages.ExpiredServicePrincipalMessageWithLink"
205205
},
206206
"_buildConfigMapping": {
207-
"Default": "2.238.4",
208-
"Node20_229_2": "2.238.5"
207+
"Default": "2.239.0",
208+
"Node20_229_2": "2.239.1"
209209
}
210210
}

‎_generated/AzureCLIV2_Node20/azureclitask.ts

+7-3
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ export class azureclitask {
3333
var connectedService: string = tl.getInput("connectedServiceNameARM", true);
3434
await this.loginAzureRM(connectedService);
3535

36+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = connectedService;
37+
3638
let errLinesCount: number = 0;
3739
let aggregatedErrorLines: string[] = [];
3840
tool.on('errline', (errorLine: string) => {
@@ -100,16 +102,16 @@ export class azureclitask {
100102
if (typeof toolExecutionError === 'string') {
101103
const expiredSecretErrorCode = 'AADSTS7000222';
102104
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
103-
105+
104106
if (serviceEndpointSecretIsExpired) {
105107
const organizationURL = tl.getVariable('System.CollectionUri');
106108
const projectName = tl.getVariable('System.TeamProject');
107109
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
108-
110+
109111
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
110112
}
111113
}
112-
114+
113115
tl.setResult(tl.TaskResult.Failed, message);
114116
} else if (exitCode != 0){
115117
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedWithExitCode", exitCode));
@@ -122,6 +124,8 @@ export class azureclitask {
122124
if (this.isLoggedIn) {
123125
this.logoutAzure();
124126
}
127+
128+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = '';
125129
}
126130
}
127131

‎_generated/AzureCLIV2_Node20/task.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
"demands": [],
2020
"version": {
2121
"Major": 2,
22-
"Minor": 238,
23-
"Patch": 5
22+
"Minor": 239,
23+
"Patch": 1
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",
@@ -208,7 +208,7 @@
208208
"ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at\u00A0%s See\u00A0https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
209209
},
210210
"_buildConfigMapping": {
211-
"Default": "2.238.4",
212-
"Node20_229_2": "2.238.5"
211+
"Default": "2.239.0",
212+
"Node20_229_2": "2.239.1"
213213
}
214214
}

‎_generated/AzureCLIV2_Node20/task.loc.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@
1919
"demands": [],
2020
"version": {
2121
"Major": 2,
22-
"Minor": 238,
23-
"Patch": 5
22+
"Minor": 239,
23+
"Patch": 1
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
@@ -208,7 +208,7 @@
208208
"ExpiredServicePrincipalMessageWithLink": "ms-resource:loc.messages.ExpiredServicePrincipalMessageWithLink"
209209
},
210210
"_buildConfigMapping": {
211-
"Default": "2.238.4",
212-
"Node20_229_2": "2.238.5"
211+
"Default": "2.239.0",
212+
"Node20_229_2": "2.239.1"
213213
}
214214
}

‎_generated/AzurePowerShellV5.versionmap.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
Default|5.239.0
2-
Node20_229_2|5.239.1
1+
Default|5.239.2
2+
Node20_229_2|5.239.3

‎_generated/AzurePowerShellV5/AzurePowerShell.ps1

+1
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ finally {
195195
. "$PSScriptRoot\Utility.ps1"
196196
Import-Module "$PSScriptRoot\ps_modules\VstsAzureHelpers_"
197197
Remove-EndpointSecrets
198+
$env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = ''
198199
Update-PSModulePathForHostedAgent
199200
Disconnect-AzureAndClearContext -restrictContext 'True' -ErrorAction SilentlyContinue
200201
}

‎_generated/AzurePowerShellV5/CoreAz.ps1

+3-1
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,6 @@ $endpointObject = ConvertFrom-Json $endpoint
2929
Import-Module "$PSScriptRoot\ps_modules\VstsAzureHelpers_"
3030
$encryptedToken = ConvertTo-SecureString $vstsAccessToken -AsPlainText -Force
3131
Initialize-AzModule -Endpoint $endpointObject -connectedServiceNameARM $connectedServiceNameARM `
32-
-azVersion $targetAzurePs -isPSCore $isPSCore -encryptedToken $encryptedToken
32+
-azVersion $targetAzurePs -isPSCore $isPSCore -encryptedToken $encryptedToken
33+
34+
$env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = $connectedServiceNameARM

‎_generated/AzurePowerShellV5/InitializeAz.ps1

+5-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ param
66
[String] [Parameter(Mandatory = $false)]
77
$targetAzurePs,
88
[String] [Parameter(Mandatory = $false)]
9-
$clientAssertionJwt
9+
$clientAssertionJwt,
10+
[String] [Parameter(Mandatory = $false)]
11+
$serviceConnectionId
1012
)
1113

1214
$endpointObject = ConvertFrom-Json $endpoint
@@ -115,6 +117,8 @@ elseif ($endpointObject.scheme -eq 'WorkloadIdentityFederation') {
115117
Write-Host "##[command] Set-AzContext -SubscriptionId $($endpointObject.subscriptionID) -TenantId $($endpointObject.tenantId)"
116118
$null = Set-AzContext -SubscriptionId $endpointObject.subscriptionID -TenantId $endpointObject.tenantId
117119
}
120+
121+
$env:AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = $serviceConnectionId
118122
}
119123
else {
120124
# Provide an additional, custom, credentials-related error message. Will handle localization later

‎_generated/AzurePowerShellV5/azurepowershell.ts

+3-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ async function run() {
8383
}
8484
if (endpointObject.scheme === 'WorkloadIdentityFederation') {
8585
const oidc_token = await endpointObject.applicationTokenCredentials.getFederatedToken();
86-
initAzCommand += ` -clientAssertionJwt ${oidc_token}`;
86+
initAzCommand += ` -clientAssertionJwt ${oidc_token} -serviceConnectionId ${serviceName}`;
8787
}
8888
contents.push(initAzCommand);
8989

@@ -171,6 +171,8 @@ async function run() {
171171
.arg('-Command')
172172
.arg(`. '${path.join(path.resolve(__dirname),'RemoveAzContext.ps1')}'`);
173173

174+
process.env.AZURESUBSCRIPTION_SERVICE_CONNECTION_ID = '';
175+
174176
let options = <tr.IExecOptions>{
175177
cwd: input_workingDirectory,
176178
failOnStdErr: false,

‎_generated/AzurePowerShellV5/task.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
"version": {
1919
"Major": 5,
2020
"Minor": 239,
21-
"Patch": 0
21+
"Patch": 2
2222
},
2323
"releaseNotes": "Added support for Az Module and cross platform agents.",
2424
"groups": [
@@ -204,7 +204,7 @@
204204
"PS_ExitCode": "PowerShell exited with code '{0}'."
205205
},
206206
"_buildConfigMapping": {
207-
"Default": "5.239.0",
208-
"Node20_229_2": "5.239.1"
207+
"Default": "5.239.2",
208+
"Node20_229_2": "5.239.3"
209209
}
210210
}

0 commit comments

Comments
 (0)