azd pipeline config got error 401

[thanhrieker]

Good day,

Using "azd pipeline config" before running well as one day the service principal with the password expired (re-generated new password). Also PAT expired -> regenerate too.

After that I got error: "ERROR: Request returned status: 401 Unauthorized" I have no idea how to fix this issue.

Can someone please help me?

The debug file attached.
azd_debug.txt

Thank you
Thanh

[vhvb1989]

What azd version are you using? (run azd version)

Can you try setting a new service principal by running azd pipeline config --principal-name sp-name --auth-type federated . Azd should then create a new SP and a federated credential for it (instead of client secret) if you are using the latest azd version.

[vhvb1989]

It should work using export AZURE_DEVOPS_EXT_PAT=.... the same as using azd env set ...
It is actually recommended to use the first one and keep your PAT on system ENV instead of azd .env.

Sometimes pat has = symbol or other chars which can be recognized by your terminal and change the actual value that is saved to the env var.
After running export AZURE_DEVOPS_EXT_PAT=... , you can try echo $AZURE_DEVOPS_EXT_PAT and validate.
Ideally, you can run export AZURE_DEVOPS_EXT_PAT="yout-pat-here" . By adding the ", you can avoid parsing issues from the terminal.

[thanhrieker]

I did the same with your idea by using export AZURE_DEVOPS_EXT_PAT="your-pat-here" but it is not working.

Compare with echo $AZURE_DEVOPS_EXT_PAT is the same with azd env set. But yesterday it is not working.

Today I try: azd env set AZURE_DEVOPS_EXT_PAT $value

Then it is working without any error.

Best
Thanh

[vhvb1989]

Can you share what OS you are using @thanhrieker ? Is it Mac or some Linux distro? (or Windows+WSL?)
Is it x64 or ARM?
And what terminal are you using? (VSCode + cmd? sh? bash? )

thank you.

[thanhrieker]

I'm using Mac Sonoma 14.6.1, M1 CPU

I'm using VSCode + terminal.

Thanks
Thanh

[vhvb1989]

@weikanglim do you have an M1 Mac to try this? I am wondering if there might be a bug when handling the PAT coming from the system env. But I couldn't repro on Win/Lin

[webstean]

Please use OIDC Federation (OpenID Connect) for better security, that way you require no secrets.
Setting up Terraform Azure provider to use OIDC Federation
Setting up Terraform Entra ID provider to use OIDC Federation

[thanhrieker]

Please use OIDC Federation (OpenID Connect) for better security, that way you require no secrets. Setting up Terraform Azure provider to use OIDC Federation Setting up Terraform Entra ID provider to use OIDC Federation

Thanks you for your information.

From last try I got this error:

ERROR: pre-config check error from Azure DevOps provider: Azure DevOps does not support federated authentication. To explicitly use client credentials set the --auth-type client-credentials flag. pipeline authentication configuration is not supported.

I will retry this time again.

Get back to you.

Best
Thanh