Microsoft.ApiManagement/service/certificates is asking for a password after giving the Kv secretIdentifier and ClientId

Es.Dev 1

Hello all,
I have a secret in Kv, and trying to get it to Api management as a certificate,
The managed identity is already in place, but when I deploy (bicep template) I get an error message:
"details": [
{
"code": "ValidationError",
"message": "The specified password is incorrect."
}
]

any idea why I'm getting this? or maybe where the password must be placed.

Thank you

JananiRamesh-MSFT 21,861 Reputation points

2022-11-30T18:17:54.597+00:00

Hi @Es.Dev Just a follow up to my previous comment and see if you can share the requested info. That would help in assisting you better

1 answer

Sonny Gillissen 3,346 Reputation points

2022-11-26T21:58:52.447+00:00

Thanks for reaching out!

Is the Managed Identity added to the Access Policy of the Key Vault with (at least) 'Get' rights for certificates?
If this is the case, please share your Bicep template for further investigation.
Please sign in to rate this answer.
Es.Dev 1 Reputation point

2022-11-28T08:55:06.103+00:00

Thanks for the response.

i have a keyvault that contains a application/x-pkcs12 secret.

Apim using managed identity to access the Keyvault, with Kv secrets user role assignment,
to fetch the secret I'm using the following:

resource apiManagement 'Microsoft.ApiManagement/service@2022-04-01-preview' = { name: apimName location: Location sku: { name: apimSku capacity: 0 } properties: { publisherEmail: 'User@email.com' publisherName: 'user' } identity: { type: 'UserAssigned' userAssignedIdentities: { '${managedIdentityId}':{} } } } resource ApimCert 'Microsoft.ApiManagement/service/certificates@2021-08-01' = { parent: apiManagement name: 'Apim-Certificate' properties:{ keyVault: { secretIdentifier: '${kvSecretUri}/a27f1aae17fd46b98ee47ab110c18414' identityClientId: 'ae77399e-8727-4f60-b1f9-1d87c2147e76' } } }

Sonny Gillissen 3,346 Reputation points

2022-11-28T09:41:45.64+00:00

Thanks for sharing!

I see you're using a User Assigned Managed Identity, to which you provided 'Get' rights for secrets? Just to make sure we're not confusing terms here: did you also provide 'Get' rights for "Certificates" as well?

A secret is different from a certificate, so I just want to confirm this.

Also I'd like to confirm if you are certain that the value provided in the 'identityClientId' is the ClientId of the User Assigned Managed Idenity, and not the ObjectId.

One other thing I'm thinking about right now: have you allowed ARM template deployment access to the Key Vault using the access configuration?

Es.Dev 1 Reputation point

2022-11-28T10:07:52.377+00:00

i cannot give custom access policies,
I'm using Rbac for this.

Sonny Gillissen 3,346 Reputation points

2022-11-28T12:56:45.07+00:00

Dove a bit deeper. In terms of rights it seems like you've set up everything correctly, however when looking at the documentation of Bicep it indeed looks like the password is not submitted. Below you'll find the sample code showing where the password of your certificate should be placed:

resource symbolicname 'Microsoft.ApiManagement/service/certificates@2021-12-01-preview' = { name: 'string' parent: resourceSymbolicName properties: { data: 'string' keyVault: { identityClientId: 'string' secretIdentifier: 'string' } password: 'string' } }

You can find more information in the article below:

https://learn.microsoft.com/en-us/azure/templates/microsoft.apimanagement/service/certificates?pivots=deployment-language-bicep

Please let me know if this was the solution :-)

Sonny Gillissen 3,346 Reputation points

2022-11-30T18:48:26.937+00:00

Hi @Es.Dev , did the solution provided above work for you? Please let me know if I can assist you further. When this answered your query please accept the answer.
Sign in to comment