We get errors on our build pipeline about Azure certificate not working. we need a build for Talespin App that are failing currently.

Question

W:\talespin-airframe\3.0\streaming\builds>AzureSignTool sign --azure-key-vault-tenant-id **** --azure-key-vault-url **** --azure-key-vault-client-id **** --azure-key-vault-client-secret **** --azure-key-vault-certificate Engineering --timestamp-rfc3161 http://timestamp.digicert.com --verbose "Streaming.exe" 
trce: AzureSignTool.SignCommand[0]
      Retrieving certificate Engineering.
fail: AzureSignTool.SignCommand[0]
      Failed to retrieve certificate Engineering from Azure Key Vault. Please verify the name of the certificate and the permissions to the certificate. Error message: ClientSecretCredential authentication failed: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS7000222: The provided client secret keys for app **** are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.
      Trace ID: 123199a0-bd24-40c3-add4-35f331e99601
      Correlation ID: abced7da-f9a8-4f13-ae08-fabead88ac58
      Timestamp: 2023-02-09 15:26:06Z.
trce: AzureSignTool.SignCommand[0]
      Azure.Identity.AuthenticationFailedException: ClientSecretCredential authentication failed: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS7000222: The provided client secret keys for app **** are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.
      Trace ID: 123199a0-bd24-40c3-add4-35f331e99601
      Correlation ID: abced7da-f9a8-4f13-ae08-fabead88ac58
      Timestamp: 2023-02-09 15:26:06Z
       ---> MSAL.NetCore.4.30.1.0.MsalServiceException: 
    ErrorCode: invalid_client
Microsoft.Identity.Client.MsalServiceException: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS7000222: The provided client secret keys for app **** are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.
      Trace ID: 123199a0-bd24-40c3-add4-35f331e99601
      Correlation ID: abced7da-f9a8-4f13-ae08-fabead88ac58
      Timestamp: 2023-02-09 15:26:06Z
         at Microsoft.Identity.Client.Internal.Requests.RequestBase.HandleTokenRefreshError(MsalServiceException e, MsalAccessTokenCacheItem cachedAccessTokenItem)
         at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.ExecuteAsync(CancellationToken cancellationToken)
         at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
         at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenForClientParameters clientParameters, CancellationToken cancellationToken)
         at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.ExecuteAsync[T](AbstractAcquireTokenParameterBuilder`1 builder, Boolean async, CancellationToken cancellationToken)
         at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientAsync(String[] scopes, Boolean async, CancellationToken cancellationToken)
         at Azure.Identity.ClientSecretCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
    StatusCode: 401 
    ResponseBody: {"error":"invalid_client","error_description":"AADSTS7000222: The provided client secret keys for app **** are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.\r\nTrace ID: 123199a0-bd24-40c3-add4-35f331e99601\r\nCorrelation ID: abced7da-f9a8-4f13-ae08-fabead88ac58\r\nTimestamp: 2023-02-09 15:26:06Z","error_codes":[7000222],"timestamp":"2023-02-09 15:26:06Z","trace_id":"123199a0-bd24-40c3-add4-35f331e99601","correlation_id":"abced7da-f9a8-4f13-ae08-fabead88ac58","error_uri":"https://login.microsoftonline.com/error?code=7000222"} 
    Headers: Cache-Control: no-store, no-cache
      Pragma: no-cache
      Strict-Transport-Security: max-age=31536000; includeSubDomains
      X-Content-Type-Options: nosniff
      P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
      client-request-id: abced7da-f9a8-4f13-ae08-fabead88ac58
      x-ms-request-id: 123199a0-bd24-40c3-add4-35f331e99601
      x-ms-ests-server: 2.1.14526.6 - EUS ProdSlices
      x-ms-clitelem: 1,7000222,0,,
      X-XSS-Protection: 0
      Set-Cookie: fpc=Ag1PvVq10X9NsAz6mKDHvFaaULwvAQAAAI4Hd9sOAAAA; expires=Sat, 11-Mar-2023 15:26:06 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
      Date: Thu, 09 Feb 2023 15:26:06 GMT
      
         --- End of inner exception stack trace ---
         at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
         at Azure.Identity.ClientSecretCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
         at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueFromCredentialAsync(TokenRequestContext context, Boolean async, CancellationToken cancellationToken)
         at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueAsync(HttpMessage message, TokenRequestContext context, Boolean async)
         at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueAsync(HttpMessage message, TokenRequestContext context, Boolean async)
         at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AuthenticateAndAuthorizeRequestAsync(HttpMessage message, TokenRequestContext context)
         at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthorizeRequestOnChallengeAsyncInternal(HttpMessage message, Boolean async)
         at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         at Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
         at Azure.Core.Pipeline.HttpPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
         at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
         at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync[TResult](RequestMethod method, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
         at Azure.Security.KeyVault.Certificates.CertificateClient.GetCertificateAsync(String certificateName, CancellationToken cancellationToken)
         at AzureSignTool.KeyVaultConfigurationDiscoverer.Materialize(AzureKeyVaultSignConfigurationSet configuration) in /_/src/AzureSignTool/KeyVaultConfigurationDiscoverer.cs:line 45
fail: AzureSignTool.SignCommand[0]
      Failed to get configuration from Azure Key Vault.
script returned exit code -2147024809

Answer 1

@David Hew [EXT]

Thank you for your post and I apologize for the delayed response!

By looking into the Correlation ID and timestamp from your error message, I found that the Client Secret provided by your application is expired, due to this you're running into the AADSTS7000222 error. For more info.

AADSTS7000222: The provided client secret keys for app **** are expired. Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds.

To resolve the error, you need to sign in to Azure Portal using Global Administrator or Application Administrator account and navigate to:

Azure Active Directory > Application Registrations > Search for ClusterServicePrincipal-todo-0002 > Under Manage section, click on Certificates & Secrets > Under client secrets, click on + New client secret as highlighted below:

For more info - Add a client secret

If you have specified the old secret in any your application(s), you need to update your application code with the new code.

If you have any other questions, please let me know!

---

Additional Link - Handling error codes in your application