Skip to content

Commit 9e519cb

Browse files
LeftTwixWandLeftTwixWand
authored
AzureCLI improved message on expired secrets (#19670)
* Add new message for expired secret scenario * Add new error message for expired secrets * Bump tasks versions * Add messages to task.loc.json
1 parent 94f0452 commit 9e519cb

File tree

26 files changed

+146
-56
lines changed

26 files changed

+146
-56
lines changed

‎Tasks/AzureCLIV1/Strings/resources.resjson/en-US/resources.resjson

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,6 @@
3434
"loc.messages.ErrorInSettingUpSubscription": "Error in setting up subscription",
3535
"loc.messages.SettingAzureConfigDir": "Setting AZURE_CONFIG_DIR env variable to: %s",
3636
"loc.messages.SettingAzureCloud": "Setting active cloud to: %s",
37-
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used"
37+
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
38+
"loc.messages.ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
3839
}

‎Tasks/AzureCLIV1/azureclitask.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,19 @@ export class azureclitask {
108108

109109
//set the task result to either succeeded or failed based on error was thrown or not
110110
if (toolExecutionError) {
111-
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailed", toolExecutionError));
111+
let message = tl.loc("ScriptFailed", toolExecutionError);
112+
113+
const expiredSecretErrorCode = "AADSTS7000222";
114+
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
115+
if (serviceEndpointSecretIsExpired) {
116+
const organizationURL = tl.getVariable('System.CollectionUri');
117+
const projectName = tl.getVariable('System.TeamProject');
118+
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
119+
120+
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
121+
}
122+
123+
tl.setResult(tl.TaskResult.Failed, message);
112124
}
113125
else {
114126
tl.setResult(tl.TaskResult.Succeeded, tl.loc("ScriptReturnCode", 0));

‎Tasks/AzureCLIV1/task.json

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 1,
2222
"Minor": 237,
23-
"Patch": 0
23+
"Patch": 2
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",
@@ -157,6 +157,7 @@
157157
"ErrorInSettingUpSubscription": "Error in setting up subscription",
158158
"SettingAzureConfigDir": "Setting AZURE_CONFIG_DIR env variable to: %s",
159159
"SettingAzureCloud": "Setting active cloud to: %s",
160-
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used"
160+
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
161+
"ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
161162
}
162163
}

‎Tasks/AzureCLIV1/task.loc.json

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 1,
2222
"Minor": 237,
23-
"Patch": 0
23+
"Patch": 2
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
@@ -157,6 +157,7 @@
157157
"ErrorInSettingUpSubscription": "ms-resource:loc.messages.ErrorInSettingUpSubscription",
158158
"SettingAzureConfigDir": "ms-resource:loc.messages.SettingAzureConfigDir",
159159
"SettingAzureCloud": "ms-resource:loc.messages.SettingAzureCloud",
160-
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning"
160+
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning",
161+
"ExpiredServicePrincipalMessageWithLink": "ms-resource:loc.messages.ExpiredServicePrincipalMessageWithLink"
161162
}
162163
}

‎Tasks/AzureCLIV2/Strings/resources.resjson/en-US/resources.resjson

+2-1
Original file line numberDiff line numberDiff line change
@@ -45,5 +45,6 @@
4545
"loc.messages.JS_InvalidFilePath": "Script file could not be found at specified script location: '%s'. Please verify the script exists at the specified path. If you want to use inline script, specify input `Script Location` as `inlineScript`.",
4646
"loc.messages.JS_InvalidErrorActionPreference": "Invalid ErrorActionPreference '%s'. The value must be one of: 'Stop', 'Continue', or 'SilentlyContinue'",
4747
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
48-
"loc.messages.UnacceptedScriptLocationValue": "%s is not a valid value for task input 'Script Location' (scriptLocation in YAML). Value can either be'inlineScript' or 'scriptPath'"
48+
"loc.messages.UnacceptedScriptLocationValue": "%s is not a valid value for task input 'Script Location' (scriptLocation in YAML). Value can either be'inlineScript' or 'scriptPath'",
49+
"loc.messages.ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
4950
}

‎Tasks/AzureCLIV2/azureclitask.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,19 @@ export class azureclitask {
9595
if(toolExecutionError === FAIL_ON_STDERR) {
9696
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedStdErr"));
9797
} else if (toolExecutionError) {
98-
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailed", toolExecutionError));
98+
let message = tl.loc("ScriptFailed", toolExecutionError);
99+
100+
const expiredSecretErrorCode = "AADSTS7000222";
101+
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
102+
if (serviceEndpointSecretIsExpired) {
103+
const organizationURL = tl.getVariable('System.CollectionUri');
104+
const projectName = tl.getVariable('System.TeamProject');
105+
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
106+
107+
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
108+
}
109+
110+
tl.setResult(tl.TaskResult.Failed, message);
99111
} else if (exitCode != 0){
100112
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedWithExitCode", exitCode));
101113
}

‎Tasks/AzureCLIV2/task.json

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 2,
2222
"Minor": 237,
23-
"Patch": 0
23+
"Patch": 2
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",
@@ -200,6 +200,7 @@
200200
"JS_InvalidFilePath": "Script file could not be found at specified script location: '%s'. Please verify the script exists at the specified path. If you want to use inline script, specify input `Script Location` as `inlineScript`.",
201201
"JS_InvalidErrorActionPreference": "Invalid ErrorActionPreference '%s'. The value must be one of: 'Stop', 'Continue', or 'SilentlyContinue'",
202202
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
203-
"UnacceptedScriptLocationValue": "%s is not a valid value for task input 'Script Location' (scriptLocation in YAML). Value can either be'inlineScript' or 'scriptPath'"
203+
"UnacceptedScriptLocationValue": "%s is not a valid value for task input 'Script Location' (scriptLocation in YAML). Value can either be'inlineScript' or 'scriptPath'",
204+
"ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
204205
}
205206
}

‎Tasks/AzureCLIV2/task.loc.json

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 2,
2222
"Minor": 237,
23-
"Patch": 0
23+
"Patch": 2
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
@@ -200,6 +200,7 @@
200200
"JS_InvalidFilePath": "ms-resource:loc.messages.JS_InvalidFilePath",
201201
"JS_InvalidErrorActionPreference": "ms-resource:loc.messages.JS_InvalidErrorActionPreference",
202202
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning",
203-
"UnacceptedScriptLocationValue": "ms-resource:loc.messages.UnacceptedScriptLocationValue"
203+
"UnacceptedScriptLocationValue": "ms-resource:loc.messages.UnacceptedScriptLocationValue",
204+
"ExpiredServicePrincipalMessageWithLink": "ms-resource:loc.messages.ExpiredServicePrincipalMessageWithLink"
204205
}
205206
}

‎_generated/AzureCLIV1.versionmap.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
Default|1.237.0
2-
Node20_229_2|1.237.1
1+
Default|1.237.2
2+
Node20_229_2|1.237.3

‎_generated/AzureCLIV1/Strings/resources.resjson/en-US/resources.resjson

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,6 @@
3434
"loc.messages.ErrorInSettingUpSubscription": "Error in setting up subscription",
3535
"loc.messages.SettingAzureConfigDir": "Setting AZURE_CONFIG_DIR env variable to: %s",
3636
"loc.messages.SettingAzureCloud": "Setting active cloud to: %s",
37-
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used"
37+
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
38+
"loc.messages.ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
3839
}

‎_generated/AzureCLIV1/azureclitask.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,19 @@ export class azureclitask {
108108

109109
//set the task result to either succeeded or failed based on error was thrown or not
110110
if (toolExecutionError) {
111-
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailed", toolExecutionError));
111+
let message = tl.loc("ScriptFailed", toolExecutionError);
112+
113+
const expiredSecretErrorCode = "AADSTS7000222";
114+
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
115+
if (serviceEndpointSecretIsExpired) {
116+
const organizationURL = tl.getVariable('System.CollectionUri');
117+
const projectName = tl.getVariable('System.TeamProject');
118+
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
119+
120+
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
121+
}
122+
123+
tl.setResult(tl.TaskResult.Failed, message);
112124
}
113125
else {
114126
tl.setResult(tl.TaskResult.Succeeded, tl.loc("ScriptReturnCode", 0));

‎_generated/AzureCLIV1/task.json

+5-4
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 1,
2222
"Minor": 237,
23-
"Patch": 0
23+
"Patch": 2
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",
@@ -157,10 +157,11 @@
157157
"ErrorInSettingUpSubscription": "Error in setting up subscription",
158158
"SettingAzureConfigDir": "Setting AZURE_CONFIG_DIR env variable to: %s",
159159
"SettingAzureCloud": "Setting active cloud to: %s",
160-
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used"
160+
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
161+
"ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at\u00A0%s See\u00A0https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
161162
},
162163
"_buildConfigMapping": {
163-
"Default": "1.237.0",
164-
"Node20_229_2": "1.237.1"
164+
"Default": "1.237.2",
165+
"Node20_229_2": "1.237.3"
165166
}
166167
}

‎_generated/AzureCLIV1/task.loc.json

+5-4
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 1,
2222
"Minor": 237,
23-
"Patch": 0
23+
"Patch": 2
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
@@ -157,10 +157,11 @@
157157
"ErrorInSettingUpSubscription": "ms-resource:loc.messages.ErrorInSettingUpSubscription",
158158
"SettingAzureConfigDir": "ms-resource:loc.messages.SettingAzureConfigDir",
159159
"SettingAzureCloud": "ms-resource:loc.messages.SettingAzureCloud",
160-
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning"
160+
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning",
161+
"ExpiredServicePrincipalMessageWithLink": "ms-resource:loc.messages.ExpiredServicePrincipalMessageWithLink"
161162
},
162163
"_buildConfigMapping": {
163-
"Default": "1.237.0",
164-
"Node20_229_2": "1.237.1"
164+
"Default": "1.237.2",
165+
"Node20_229_2": "1.237.3"
165166
}
166167
}

‎_generated/AzureCLIV1_Node20/Strings/resources.resjson/en-US/resources.resjson

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,6 @@
3434
"loc.messages.ErrorInSettingUpSubscription": "Error in setting up subscription",
3535
"loc.messages.SettingAzureConfigDir": "Setting AZURE_CONFIG_DIR env variable to: %s",
3636
"loc.messages.SettingAzureCloud": "Setting active cloud to: %s",
37-
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used"
37+
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
38+
"loc.messages.ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
3839
}

‎_generated/AzureCLIV1_Node20/azureclitask.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,19 @@ export class azureclitask {
108108

109109
//set the task result to either succeeded or failed based on error was thrown or not
110110
if (toolExecutionError) {
111-
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailed", toolExecutionError));
111+
let message = tl.loc("ScriptFailed", toolExecutionError);
112+
113+
const expiredSecretErrorCode = "AADSTS7000222";
114+
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
115+
if (serviceEndpointSecretIsExpired) {
116+
const organizationURL = tl.getVariable('System.CollectionUri');
117+
const projectName = tl.getVariable('System.TeamProject');
118+
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
119+
120+
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
121+
}
122+
123+
tl.setResult(tl.TaskResult.Failed, message);
112124
}
113125
else {
114126
tl.setResult(tl.TaskResult.Succeeded, tl.loc("ScriptReturnCode", 0));

‎_generated/AzureCLIV1_Node20/task.json

+5-4
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 1,
2222
"Minor": 237,
23-
"Patch": 1
23+
"Patch": 3
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "Azure CLI $(scriptPath)",
@@ -161,10 +161,11 @@
161161
"ErrorInSettingUpSubscription": "Error in setting up subscription",
162162
"SettingAzureConfigDir": "Setting AZURE_CONFIG_DIR env variable to: %s",
163163
"SettingAzureCloud": "Setting active cloud to: %s",
164-
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used"
164+
"GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
165+
"ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at\u00A0%s See\u00A0https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
165166
},
166167
"_buildConfigMapping": {
167-
"Default": "1.237.0",
168-
"Node20_229_2": "1.237.1"
168+
"Default": "1.237.2",
169+
"Node20_229_2": "1.237.3"
169170
}
170171
}

‎_generated/AzureCLIV1_Node20/task.loc.json

+5-4
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"version": {
2121
"Major": 1,
2222
"Minor": 237,
23-
"Patch": 1
23+
"Patch": 3
2424
},
2525
"minimumAgentVersion": "2.0.0",
2626
"instanceNameFormat": "ms-resource:loc.instanceNameFormat",
@@ -161,10 +161,11 @@
161161
"ErrorInSettingUpSubscription": "ms-resource:loc.messages.ErrorInSettingUpSubscription",
162162
"SettingAzureConfigDir": "ms-resource:loc.messages.SettingAzureConfigDir",
163163
"SettingAzureCloud": "ms-resource:loc.messages.SettingAzureCloud",
164-
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning"
164+
"GlobalCliConfigAgentVersionWarning": "ms-resource:loc.messages.GlobalCliConfigAgentVersionWarning",
165+
"ExpiredServicePrincipalMessageWithLink": "ms-resource:loc.messages.ExpiredServicePrincipalMessageWithLink"
165166
},
166167
"_buildConfigMapping": {
167-
"Default": "1.237.0",
168-
"Node20_229_2": "1.237.1"
168+
"Default": "1.237.2",
169+
"Node20_229_2": "1.237.3"
169170
}
170171
}

‎_generated/AzureCLIV2.versionmap.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
Default|2.237.0
2-
Node20_229_2|2.237.1
1+
Default|2.237.2
2+
Node20_229_2|2.237.3

‎_generated/AzureCLIV2/Strings/resources.resjson/en-US/resources.resjson

+2-1
Original file line numberDiff line numberDiff line change
@@ -45,5 +45,6 @@
4545
"loc.messages.JS_InvalidFilePath": "Script file could not be found at specified script location: '%s'. Please verify the script exists at the specified path. If you want to use inline script, specify input `Script Location` as `inlineScript`.",
4646
"loc.messages.JS_InvalidErrorActionPreference": "Invalid ErrorActionPreference '%s'. The value must be one of: 'Stop', 'Continue', or 'SilentlyContinue'",
4747
"loc.messages.GlobalCliConfigAgentVersionWarning": "For agent version < 2.115.0, only global Azure CLI configuration can be used",
48-
"loc.messages.UnacceptedScriptLocationValue": "%s is not a valid value for task input 'Script Location' (scriptLocation in YAML). Value can either be'inlineScript' or 'scriptPath'"
48+
"loc.messages.UnacceptedScriptLocationValue": "%s is not a valid value for task input 'Script Location' (scriptLocation in YAML). Value can either be'inlineScript' or 'scriptPath'",
49+
"loc.messages.ExpiredServicePrincipalMessageWithLink": "Secret expired, update service connection at %s See https://aka.ms/azdo-rm-workload-identity-conversion to learn more about conversion to secret-less service connections."
4950
}

‎_generated/AzureCLIV2/azureclitask.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,19 @@ export class azureclitask {
9595
if(toolExecutionError === FAIL_ON_STDERR) {
9696
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedStdErr"));
9797
} else if (toolExecutionError) {
98-
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailed", toolExecutionError));
98+
let message = tl.loc("ScriptFailed", toolExecutionError);
99+
100+
const expiredSecretErrorCode = "AADSTS7000222";
101+
let serviceEndpointSecretIsExpired = toolExecutionError.indexOf(expiredSecretErrorCode) >= 0;
102+
if (serviceEndpointSecretIsExpired) {
103+
const organizationURL = tl.getVariable('System.CollectionUri');
104+
const projectName = tl.getVariable('System.TeamProject');
105+
const serviceConnectionLink = encodeURI(`${organizationURL}${projectName}/_settings/adminservices?resourceId=${connectedService}`);
106+
107+
message = tl.loc('ExpiredServicePrincipalMessageWithLink', serviceConnectionLink);
108+
}
109+
110+
tl.setResult(tl.TaskResult.Failed, message);
99111
} else if (exitCode != 0){
100112
tl.setResult(tl.TaskResult.Failed, tl.loc("ScriptFailedWithExitCode", exitCode));
101113
}

0 commit comments

Comments
 (0)