unable to see username and userpw for logicapp

Question

unable to see username and userpw for logicapp

Harsha Jha 61

I am trying to automate the process for downloading the ARM zip file of LogicApp. But it doesn't work at all using CLI script.
When i export the profile it keep saying redacted.

      profile=$(az webapp deployment list-publishing-profiles \            --name $LOGICAPP_NAME \

        --resource-group $RESOURCE_GROUP \

        --output json)

      username=$(echo "$profile" | jq -r '.[] | select(.publishMethod=="MSDeploy") | .userName')

      password=$(echo "$profile" | jq -r '.[] | select(.publishMethod=="MSDeploy") | .userPWD')

      creds=$(echo -n "$username:$password" | base64)

      curl -s -L -o $ZIP_PATH \

        -H "Authorization: Basic $creds" \

        https://$LOGICAPP_NAME.scm.azurewebsites.net/api/zip/site/wwwroot/

Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-11T20:58:05.81+00:00

Hello Harsha Jha,

You're downloading the ARM zip file of LogicApp using CLI script. Could you please share me the scrip you're executing to export template.

However, the behavior you're experiencing, where sensitive information like usernames and passwords is redacted, is expected when using the az webapp deployment list-publishing-profiles command. This is a security feature designed to protect sensitive credentials from being exposed in the output.

To resolve this, ensure that:

You have the necessary permissions to access the publishing profiles.

You're using the latest version of the Azure CLI, as older versions might have issues with this command.

Your environment variables ($LOGICAPP_NAME and $RESOURCE_GROUP) are correctly set and pointing to the right resources.

Please share me the requested details, we will instigate from our end and let you know with an update.

Harsha Jha 61

Hello Praveen,

Below is the script

name: Modify and Upload Logic App Content

on:

workflow_dispatch:

permissions:

id-token: write

contents: read

env:

LOGICAPP_NAME: XXXXXXXXXX

RESOURCE_GROUP: XXXXXX

LOCATION: westus2

ZIP_NAME: app.zip

jobs:

deploy:

runs-on: ubuntu-latest

steps:

  - name: Checkout Code

    uses: actions/checkout@v4

  - name: Set up Azure CLI

    uses: azure/login@v1

    with:

      creds: ${{ secrets.AZURE_CREDENTIALS }}

  - name: Create ZIP Package

    run: |

      mkdir -p packaged

      cp -r workflow packaged/

      cd packaged

      zip -r ${{ env.ZIP_NAME }} .

      cd ..

  - name: Get Publishing Credentials

    id: getProfile

    run: |

      profile=$(az webapp deployment list-publishing-profiles \

        --name $LOGICAPP_NAME \

        --resource-group $RESOURCE_GROUP \

        --output json)

      

      username=$(echo $profile | jq -r '.[] | select(.publishMethod=="ZipDeploy") | .userName')

      password=$(echo $profile | jq -r '.[] | select(.publishMethod=="ZipDeploy") | .userPWD')

      

      echo "USERNAME=$username" >> $GITHUB_ENV

      echo "PASSWORD=$password" >> $GITHUB_ENV

  - name: Deploy via ZIP

    run: |

      curl -X POST "https://${{ env.LOGICAPP_NAME }}.scm.azurewebsites.net/api/zipdeploy" \

        -u "${{ env.USERNAME }}:${{ env.PASSWORD }}" \

        --data-binary @packaged/${{ env.ZIP_NAME }}

Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-15T21:06:24.85+00:00

Hello Harsha Jha,

Could you please try below command to download ARM template if your using azure CLI.

Export-AzResourceGroup -ResourceGroupName <RGNAME> -Resource <RESOURCEID>

If not, please share me the details regarding script execution environment.
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-17T17:15:36.5066667+00:00

Hello Harsha Jha,

Following up to see if you have chance to check my previous response and help us with requested information to check and assist you further on this.
Harsha Jha 61 Reputation points

2025-04-17T20:23:05.79+00:00

I was able to resolve the issue by access token
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-18T20:08:48.95+00:00

Hello Harsha Jha,

Glad to hear that your issue has been resolved. If you have any further questions, please feel free to reach out us.

1 answer

Your answer

Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-11T20:58:05.81+00:00

Hello Harsha Jha,

You're downloading the ARM zip file of LogicApp using CLI script. Could you please share me the scrip you're executing to export template.

However, the behavior you're experiencing, where sensitive information like usernames and passwords is redacted, is expected when using the az webapp deployment list-publishing-profiles command. This is a security feature designed to protect sensitive credentials from being exposed in the output.

To resolve this, ensure that:

You have the necessary permissions to access the publishing profiles.

You're using the latest version of the Azure CLI, as older versions might have issues with this command.

Your environment variables ($LOGICAPP_NAME and $RESOURCE_GROUP) are correctly set and pointing to the right resources.

Please share me the requested details, we will instigate from our end and let you know with an update.
Harsha Jha 61 Reputation points

2025-04-14T14:34:04.5333333+00:00

Hello Praveen,

Below is the script

name: Modify and Upload Logic App Content

on:

workflow_dispatch:

permissions:

id-token: write

contents: read

env:

LOGICAPP_NAME: XXXXXXXXXX

RESOURCE_GROUP: XXXXXX

LOCATION: westus2

ZIP_NAME: app.zip

jobs:

deploy:

runs-on: ubuntu-latest steps: - name: Checkout Code uses: actions/checkout@v4 - name: Set up Azure CLI uses: azure/login@v1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} - name: Create ZIP Package run: | mkdir -p packaged cp -r workflow packaged/ cd packaged zip -r ${{ env.ZIP_NAME }} . cd .. - name: Get Publishing Credentials id: getProfile run: | profile=$(az webapp deployment list-publishing-profiles \ --name $LOGICAPP_NAME \ --resource-group $RESOURCE_GROUP \ --output json) username=$(echo $profile | jq -r '.[] | select(.publishMethod=="ZipDeploy") | .userName') password=$(echo $profile | jq -r '.[] | select(.publishMethod=="ZipDeploy") | .userPWD') echo "USERNAME=$username" >> $GITHUB_ENV echo "PASSWORD=$password" >> $GITHUB_ENV - name: Deploy via ZIP run: | curl -X POST "https://${{ env.LOGICAPP_NAME }}.scm.azurewebsites.net/api/zipdeploy" \ -u "${{ env.USERNAME }}:${{ env.PASSWORD }}" \ --data-binary @packaged/${{ env.ZIP_NAME }}
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-15T21:06:24.85+00:00

Hello Harsha Jha,

Could you please try below command to download ARM template if your using azure CLI.

Export-AzResourceGroup -ResourceGroupName <RGNAME> -Resource <RESOURCEID>

If not, please share me the details regarding script execution environment.
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-17T17:15:36.5066667+00:00

Hello Harsha Jha,

Following up to see if you have chance to check my previous response and help us with requested information to check and assist you further on this.
Harsha Jha 61 Reputation points

2025-04-17T20:23:05.79+00:00

I was able to resolve the issue by access token
Praveen Kumar Gudipudi 1,875 Reputation points Microsoft External Staff Moderator

2025-04-18T20:08:48.95+00:00

Hello Harsha Jha,

Glad to hear that your issue has been resolved. If you have any further questions, please feel free to reach out us.

Answer 1

@Harsha Jha I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: Customer is trying to download the logic app workflow using script and by using deployment publishing profile credentials. the value of username and password is showing as redacted.

Solution: Instead of using the publishing profile credentials, customer has shifted to access token to authenticate and download the workflows as zip file.

Adding to the above you leverage the PowerShell script mentioned in this blog post here to download the content of site/wwwroot folder using the kudu rest api.

Note: The above script present in the blog post uses the service principal-based authentication rather than the publishing profile credentials or the access token.

Hope this helps !

Please accept as Yes if the answer is helpful so that it can help others in the community

Share via

unable to see username and userpw for logicapp

1 answer

Your answer