System.ArgumentNullException : Value cannot be null. (Parameter 'clientId')

Question

System.ArgumentNullException : Value cannot be null. (Parameter 'clientId')

Rupali Bhore 60

My ADO pipeline give me error: at Test run task. System.ArgumentNullException : Value cannot be null. (Parameter 'clientId')

Stack trace

at Azure.Core.Argument.AssertNotNullT at Azure.Identity.ClientSecretCredential..ctor(String tenantId, String clientId, String clientSecret, TokenCredentialOptions options, CredentialPipeline pipeline, MsalConfidentialClient client) at Azure.Identity.ClientSecretCredential..ctor(String tenantId, String clientId, String clientSecret, ClientSecretCredentialOptions options) at ElementsOSIntegrationAPIAutomation.Services.CertificateService..ctor(IConfiguration configuration) in \src\Helpers\CertificateService.cs:line 29 at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor) at System.Reflection.MethodBaseInvoker.InvokeDirectByRefWithFewArgs(Object obj, Span`1 copyOfArgs, BindingFlags invokeAttr)

User's image

I changed the secret but I updated the same in variable group. I also declared the same values in KV secrets and fetching the clientId from it.
User's image

I also tried to print those values in CLI, but as they are secret could not see them. Do I miss anything?
User's image

Durga Reshma Malthi 11,590 Microsoft External Staff Moderator

Hi Rupali Bhore

Here, your secrets are pulled from Key Vault not just from variable groups and Your secrets are named as azureClientId, azureClientSecret and tenantId.

But you are not mapping the Key Vault secrets to the expected environment variables.

So, update your YAML Template or azure-pipelines.yml to map like this:

- task: AzureKeyVault@2
  inputs:
    azureSubscription: 'Your-Service-Connection'
    KeyVaultName: 'your-keyvault-name'
    SecretsFilter: 'azureClientId,azureClientSecret,tenantId'
    RunAsPreJob: true
- script: |
    echo "Setting expected ENV variables"
    echo "##vso[task.setvariable variable=ClientId;issecret=true]$(azureClientId)"
    echo "##vso[task.setvariable variable=Secret;issecret=true]$(azureClientSecret)"
    echo "##vso[task.setvariable variable=TenantId;issecret=true]$(tenantId)"
  displayName: 'Map KV secrets to expected keys'

Hope this helps!

Please Let me know if you have any queries.

Rupali Bhore 60 Reputation points

2025-07-31T10:08:24.0233333+00:00

Even after mapping the error is same

Rupali Bhore 60

stages:
  - stage: VsTest${{ parameters.envShort }}
    displayName: "VsTests ${{ parameters.envLong }}"
    condition: |
      and(
        not(failed()),
        not(canceled()),
        eq('${{ parameters.condition }}', true)
      )
    pool:
      vmImage: windows-latest
    variables:
      - group: vg-openspace-specflow-${{ parameters.envShort }}
      - group: vg-openspace-${{ parameters.envShort }}
      - template: azure-pipelines/vars/vars-${{ parameters.envShort }}.yml@self
    jobs:
      - job: vstest
        timeoutInMinutes: 360
        displayName: ${{ variables.envLong}}
        steps:
          - task: DownloadPipelineArtifact@2
            inputs:
              buildType: 'specific'
              project: $(System.TeamProject)
              definition: '104'
              buildVersionToDownload: 'latest'
              targetPath: '$(Pipeline.Workspace)'

          - task: AzureKeyVault@2
            inputs:
              azureSubscription: 'openspace-specflow'
              KeyVaultName: 'kv-specflow-qa'
              SecretsFilter: 'azureClientId,azureClientSecret,tenantId'
              RunAsPreJob: true
          - script: |
              echo "Setting expected ENV variables"
              echo "##vso[task.setvariable variable=ClientId;issecret=true]$(azureClientId)"
              echo "##vso[task.setvariable variable=Secret;issecret=true]$(azureClientSecret)"
              echo "##vso[task.setvariable variable=TenantId;issecret=true]$(tenantId)"
            displayName: 'Map KV secrets to expected keys'

          - task: AzurePowerShell@5
            displayName: 'Allow agent IP'
            inputs:
              azureSubscription: 'openspace-specflow'
              ScriptType: 'InlineScript'
              Inline: |
                az login --service-principal --username $(azureClientId) --password $(azureClientSecret) --tenant $(tenantId)
                $ip = (Invoke-WebRequest -uri "http://ifconfig.me/ip").Content.Trim()
                Write-Host "Agent IP Address: $ip"
                Write-Host "ClientId:  $(azureClientId)"
                Write-Host "Secret: $(azureClientSecret)"
                Write-Host "tenantId: $(tenantId)"
                
                # Add the IP address to the Key Vault firewall
                az keyvault network-rule add --resource-group $(KVresourcegroup) --name $(Keyvaultname) --ip-address $ip
                # Add the IP address to the SQL server firewall
                az sql server firewall-rule create -g $(DBresourcegroup) -s $(DBServername) -n build-$(Build.BuildId) --start-ip-address $ip --end-ip-address $ip
                # Save the IP in a pipeline variable to remove it later
                echo "##vso[task.setvariable variable=AGENT_IP]$ip"
              azurePowerShellVersion: 'LatestVersion'

          - task: ScreenResolutionUtility@1
            inputs:
              displaySettings: "specific"
              width: "1440"
              height: "900"

          - task: VSTest@2
            displayName: "Run Tests"
            env:
              env:
              AccEmail: $(AccEmail)
              OSClientUserId: $(OSClientUserId)
              OSFirstName: $(OSFirstName)
              OSLastName: $(OSLastName)
              AccountId: $(AccountId)
              ElementsTenantID: $(ElementsTenantID)
              ElementsClientId: $(ElementsClientId)
              AccLinkEmail: $(AccLinkEmail)
              Password: $(Password)
              AccLinkPassword: $(AccLinkPassword)
              RouterServiceUrl: $(RouterServiceUrl)
              ConnectionStrings:DFContext: $(ConnectionStrings:DFContext)
              OpenspaceKeyvaultUrl: $(OpenspaceKeyvaultUrl)
              OpenspaceManagedIdentityClientId: $(OpenspaceManagedIdentityClientId)
              OpenspaceKeyvaultCertName: $(OpenspaceKeyvaultCertName)
              azureClientId: $(azureClientId)
              tenantId: $(tenantId)
              azureClientSecret: $(azureClientSecret)
              
            condition: |
              and(
                not(failed()),
                not(canceled())
              )

            inputs:
              testSelector: "testAssemblies"
              testAssemblyVer2: |
                **\ElementsOSIntegrationAPIAutomation.dll
                !**\*TestAdapter.dll
                !**\obj\**
              searchFolder: $(Pipeline.Workspace)/Solution/
              testFiltercriteria: "TestCategory=${{ parameters.tags }}"
              runInParallel: true
              batchingBasedOnAgentsOption: "customBatchSize"
              customBatchSizeValue: "1000"
              rerunFailedTests: true
              rerunFailedThreshold: "70"
              publishLocation: "pipeline"
              publishtestResults: true

          - task: AzurePowerShell@5
            displayName: 'Remove agent IP'
            inputs:
              azureSubscription: 'openspace-specflow'
              ScriptType: 'InlineScript'
              Inline: |
                az login --service-principal --username $(azureClientId) --password $(azureClientSecret) --tenant $(tenantId)
                $ip = (Invoke-WebRequest -uri "http://ifconfig.me/ip").Content.Trim()
                Write-Host "remove agent ip: $ip"              
                az sql server firewall-rule delete --name build-$(Build.BuildId) -g $(DBresourcegroup) --server $(DBServername)                                                                 
                az keyvault network-rule remove --name $(Keyvaultname) -g $(KVresourcegroup) --ip-address $ip 
                echo "##vso[task.setvariable variable=AGENT_IP]$ip"
              azurePowerShellVersion: 'LatestVersion'

I don't think the actual issue is for clientId. Pipeline is failing at test run pipeline, before that it is able to add MS agent IP in firewall for SQ server and KV both. After that it is failing at below task

Durga Reshma Malthi 11,590 Reputation points Microsoft External Staff Moderator

2025-08-04T08:20:58.73+00:00

Hi Rupali Bhore

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.
Durga Reshma Malthi 11,590 Reputation points Microsoft External Staff Moderator

2025-08-05T09:03:54.2366667+00:00

Hi Rupali Bhore

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.

Answer accepted by question author

0 additional answers

Your answer

Durga Reshma Malthi 11,590 Reputation points Microsoft External Staff Moderator

2025-07-31T08:48:29.51+00:00

Hi Rupali Bhore

Here, your secrets are pulled from Key Vault not just from variable groups and Your secrets are named as azureClientId, azureClientSecret and tenantId.

But you are not mapping the Key Vault secrets to the expected environment variables.

So, update your YAML Template or azure-pipelines.yml to map like this:

- task: AzureKeyVault@2 inputs: azureSubscription: 'Your-Service-Connection' KeyVaultName: 'your-keyvault-name' SecretsFilter: 'azureClientId,azureClientSecret,tenantId' RunAsPreJob: true - script: | echo "Setting expected ENV variables" echo "##vso[task.setvariable variable=ClientId;issecret=true]$(azureClientId)" echo "##vso[task.setvariable variable=Secret;issecret=true]$(azureClientSecret)" echo "##vso[task.setvariable variable=TenantId;issecret=true]$(tenantId)" displayName: 'Map KV secrets to expected keys'

Hope this helps!

Please Let me know if you have any queries.
Rupali Bhore 60 Reputation points

2025-07-31T10:08:24.0233333+00:00

Even after mapping the error is same
Durga Reshma Malthi 11,590 Reputation points Microsoft External Staff Moderator

2025-08-04T08:20:58.73+00:00

Hi Rupali Bhore

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.
Durga Reshma Malthi 11,590 Reputation points Microsoft External Staff Moderator

2025-08-05T09:03:54.2366667+00:00

Hi Rupali Bhore

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.

Answer 1

Durga Reshma Malthi 11,590 Microsoft External Staff Moderator

Hi Rupali Bhore

Can you update your VSTest@2 like this so that it will match configuration.GetValue<string>("ClientId") in CertificateService.cs

- task: VSTest@2
  displayName: "Run Tests"
  env:
    ClientId: $(azureClientId)
    Secret: $(azureClientSecret)
    TenantId: $(tenantId)

or alternatively you can update like this

AzureClientId = configuration.GetValue<string>("azureClientId");
AzureTenantId = configuration.GetValue<string>("tenantId");
AzureSecret = configuration.GetValue<string>("azureClientSecret");

Hope this helps!

Please Let me know if you have any queries.

Durga Reshma Malthi 11,590 Reputation points Microsoft External Staff Moderator

2025-08-06T06:40:07.9333333+00:00

Hi Rupali Bhore

Just checking in to see if you had a chance to review the response provided to your question.

Feel free to reach out if you have any further queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.
Rupali Bhore 60 Reputation points

2025-08-06T12:34:50.2233333+00:00

yes, it is working, Thank you

Share via

System.ArgumentNullException : Value cannot be null. (Parameter 'clientId')

0 additional answers

Your answer