ConvertFrom-SecureString

Question

Hi All,

I have created an Azure App Registration and would like to use it in my script. I have saved the client secret in a text file located at C:\temp\key.txt, and I encrypted the secret using the following command.

$keyfile = 'C:\temp\key.txt' 
Read-Host -AsSecureString | ConvertFrom-SecureString | Out-File $keyfile

Then, in my script, I am using the following lines:

$ClientId = "111111111111111111" 
$ClientSecret = Get-Content "C:\temp\key.txt" | ConvertTo-SecureString 
$TenantId = "2222222222222222"

However, when I run the script, I get the following error when i decrypt my client secret i am getting the correct value.

invoke-RestMethod: {"error":"invalid_client","error_description":"AADTS8987345: invalid client secret provided.

Answer 1

It looks like the issue might be related to how the client secret is being read and used in your script. Here are a few things to check and try:

1. Ensure the Client Secret is Correct:
   • Verify that the client secret stored in C:\temp\key.txt is correct and hasn’t expired. You can do this by generating a new client secret in the Azure portal and updating your text file.
2. Convert the Client Secret Properly:

• When reading the client secret from the file, ensure it is being converted correctly. You might need to use ConvertTo-SecureString with the -AsPlainText and -Force parameters if the secret is stored as plain text.
  1. Use the Correct Parameters:
     • Update your script to ensure the client secret is being passed correctly. Here is an example of how you might modify your script: $ClientId = "111111111111111111"

         `$ClientSecret = Get-Content "C:\temp\key.txt" | ConvertTo-SecureString -AsPlainText -Force`
       
         `$TenantId = "2222222222222222"`
       
         `$body = @{`
       
         `    client_id     = $ClientId`
       
         `    client_secret = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($ClientSecret))`
       
         `    tenant_id     = $TenantId`
       
         `    grant_type    = "client_credentials"`
       
         `}`
       

     $response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" -Method Post -Body $body

1. Check for Typos:
   • Ensure there are no typos in your ClientId, ClientSecret, or TenantId.
2. Review Azure Documentation:
   • Refer to the Azure documentation for detailed steps on registering an app and using client credentials.

Answer 2

Depending on the contents of the key you might have to encode the key contents in the same way you do when you create a URL. E.g., some characters may need to be "escaped", such as "%".

Add-Type -AssemblyName System.Web
$encodedURL = [System.Web.HttpUtility]::UrlEncode($ClientSecret)