Azure-cli: az acs create fails with service principal error

Created on 3 Jan 2018 · 9Comments · Source: Azure/azure-cli

Repro steps:

Delete ~/.azure/acsServicePrincipal.json
Try to create a cluster

az group create -n test1 -l eastus
az acs create -n acs-test -g test1 -t Kubernetes

Results:

Service principal is created
- CLI spins and waits for service principal propagation before proceeding
- acsServicePrincipal.json is created with the generated SP info
Command fails, and nothing is created in the resource group
- If you run az acs create a second time, the deployment succeeds, using the SP from the JSON file

Deployment failed. Correlation ID: c1cb9379-4dbf-4ac9-ab14-ff4ced046fa6. {
  "error": {
    "code": "BadRequest",
    "message": "The credentials in ServicePrincipalProfile were invalid. Please see https://aka.ms/acs-sp-help for more details. (Details: AADSTS70001: Application with identifier 'e451ac5a-b4da-4393-9315-d3dce6166a46' was not found in the directory 72f988bf-86f1-41af-91ab-2d7cd011db47\r\nTrace ID: 87322fd2-8fc4-412c-b708-429cab160900\r\nCorrelation ID: faf7eee4-322d-4198-b04d-5e41cf8d3b60\r\nTimestamp: 2018-01-03 22:04:29Z)"
  }
}

Environment summary

apt-get / 2.0.23 / Windows 10 Enterprise 1709 (16299.125) + Ubuntu 16.04.3 LTS / Bash on Windows

azure-cli (2.0.23)

acr (2.0.17)
acs (2.0.22)
advisor (0.1.0)
appservice (0.1.22)
backup (1.0.3)
batch (3.1.7)
batchai (0.1.3)
billing (0.1.6)
cdn (0.0.10)
cloud (2.0.10)
cognitiveservices (0.1.9)
command-modules-nspkg (2.0.1)
configure (2.0.12)
consumption (0.2.0)
container (0.1.15)
core (2.0.23)
cosmosdb (0.1.15)
dla (0.0.15)
dls (0.0.18)
eventgrid (0.1.5)
extension (0.0.6)
feedback (2.0.6)
find (0.2.7)
interactive (0.3.11)
iot (0.1.15)
keyvault (2.0.15)
lab (0.0.13)
monitor (0.0.13)
network (2.0.19)
nspkg (3.0.1)
profile (2.0.16)
rdbms (0.0.9)
redis (0.2.10)
reservations (0.1.0)
resource (2.0.19)
role (2.0.15)
servicefabric (0.0.7)
sql (2.0.17)
storage (2.0.21)
vm (2.0.20)

Python location '/opt/az/bin/python3'
Extensions directory '/home/noel/.azure/cliextensions'

Python (Linux) 3.6.1 (default, Dec 15 2017, 17:51:12)
[GCC 4.8.4]

ACS Service Attention bug

Source

noelbundick

All 9 comments

Related service principal error when creating AKS clusters

Repro steps:

Delete ~/.azure/acsServicePrincipal.json
Create an AKS cluster

az aks create -g trash1-dest-aks -n noel-dest-aks

Results:

Service principal is created
- acsServicePrincipal.json is created with the generated SP info
Command fails, and nothing is created in the resource group
- If you run az aks create a second time, the deployment succeeds, using the SP from the JSON file

output:

AAD role propagation done[############################################]  100.0000%Operation failed with status: 'Bad Request'. Details: Service principal clientID: fe8f564b-b2f9-48a4-aeac-ed707175f0f1 not found in Active Directory tenant
 72f988bf-86f1-41af-91ab-2d7cd011db47, Please see https://aka.ms/acs-sp-help for more details.

"AAD role propagation done" completes, but then I immediately get a service principal not found error

noelbundick on 3 Jan 2018

//cc: @rjtsdl @mboersma

yugangw-msft on 4 Jan 2018

@noelbundick, i think you are hitting the problem of slow SPN replication across Azure regions.

I want you to check, can you make another create of aks/acs in about 1 min after the failure ? And the second creation succeed ?

rjtsdl on 4 Jan 2018

Yes, it works the second time, using the sp that was created in the first run

This used to work great - not sure if this is related to a recent change?

noelbundick on 4 Jan 2018

@noelbundick

I made a PR for other stuff, but it will fix the error you are seeing as well. We used to retry on those errors, looks the error message changed. Just update it.

There are some other work around to fix or workaround the replication issue.

rjtsdl on 5 Jan 2018

Fixed

yugangw-msft on 9 Jan 2018

This error seems to be back again.

Repro Sets:

Delete existing SP credentials

rm .azure/acsServicePrincipal.json

Try to create a ACS Cluster

az group create -n wesyao-kube -l westus
az acs create --orchestrator-type kubernetes --resource-group wesyao-kube --name wesyaocluster --generate-ssh-keys

Error Message:

Deployment failed. Correlation ID: 3658af8f-5d83-4bab-a07e-4558a750a92d. {
  "error": {
    "code": "BadRequest",
    "message": "The credentials in ServicePrincipalProfile were invalid. Please see https://aka.ms/acs-sp-help for more details. (Details: AADSTS70001: Application with identifier 'd0dcd55f-3601-445e-9755-8daeef61a155' was not found in the directory 72f988bf-86f1-41af-91ab-2d7cd011db47\r\nTrace ID: 745d04a6-2263-43aa-876b-48e8784a4600\r\nCorrelation ID: 37abb4ac-cadc-4ca4-9ba0-ebe167b22235\r\nTimestamp: 2018-03-20 22:32:20Z)"
  }
}

CLI Version

➜  ~ az --version
azure-cli (2.0.29)

acr (2.0.22)
acs (2.0.28)
advisor (0.5.0)
appservice (0.1.29)
backup (1.0.7)
batch (3.1.11)
batchai (0.1.6)
billing (0.1.7)
cdn (0.0.13)
cloud (2.0.12)
cognitiveservices (0.1.11)
command-modules-nspkg (2.0.1)
configure (2.0.14)
consumption (0.2.2)
container (0.1.19)
core (2.0.29)
cosmosdb (0.1.19)
dla (0.0.18)
dls (0.0.19)
eventgrid (0.1.11)
eventhubs (0.1.0)
extension (0.0.10)
feedback (2.1.0)
find (0.2.8)
interactive (0.3.17)
iot (0.1.18)
keyvault (2.0.20)
lab (0.0.17)
monitor (0.1.3)
network (2.0.25)
nspkg (3.0.2)
profile (2.0.20)
rdbms (0.1.0)
redis (0.2.11)
reservations (0.1.1)
resource (2.0.25)
role (2.0.20)
servicebus (0.1.0)
servicefabric (0.0.11)
sql (2.0.23)
storage (2.0.27)
vm (2.0.28)

Python location '/Users/wesyao/anaconda3/bin/python3.6'
Extensions directory '/Users/wesyao/.azure/cliextensions'

Python (Darwin) 3.6.2 |Anaconda custom (x86_64)| (default, Sep 21 2017, 18:29:43)
[GCC 4.2.1 Compatible Clang 4.0.1 (tags/RELEASE_401/final)]

Legal docs and information: aka.ms/AzureCliLegal

wesyao on 20 Mar 2018

👍1

Can we re-open this please, because it's clearly not fixed. Fails for me too with 2.2.0 version. Same issue: propagation completes, then cluster create fails straight away. The same happens if I reset password for an existing SP and try to create AKS.

AAD role propagation done[############################################]  100.0000%
Operation failed with status: 'Bad Request'. Details: The credentials in ServicePrincipalProfile were invalid. 
Please see https://aka.ms/aks-sp-help for more details. 
(Details: adal: Refresh request failed. Status Code = '400'. Response body: 
{
    "error": "unauthorized_client",
    "error_description": "AADSTS700016: Application with identifier 'REDACTED' was not found in the directory 'REDACTED'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: REDACTED\r\nCorrelation ID: REDACTED\r\nTimestamp: 2020-03-31 17:38:47Z",
    "error_codes": [
        700016
    ],
    "timestamp": "2020-03-31 17:38:47Z",
    "trace_id": "REDACTED",
    "correlation_id": "REDACTED",
    "error_uri": "https://login.microsoftonline.com/error?code=700016"
})

$ az --version
azure-cli                          2.2.0 *

command-modules-nspkg              2.0.3
core                               2.2.0 *
nspkg                              3.0.4
telemetry                          1.0.4

Python location '/usr/local/Cellar/azure-cli/2.2.0_1/libexec/bin/python'
Extensions directory '/Users/philippanyukov/.azure/cliextensions'

Python (Darwin) 3.8.2 (default, Mar 11 2020, 00:29:50)
[Clang 11.0.0 (clang-1100.0.33.17)]

ppanyukov on 31 Mar 2020

👍1

Hi!

Same problem here.
Command

$az aks create \                                         
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --node-vm-size Standard_NC6 \
    --node-count 1 --generate-ssh-keys

outputs:

> Finished service principal creation[##################################] 100.0000%Operation failed with status: 'Bad Request'. Details: The credentials in ServicePrincipalProfile were invalid. Please see https://aka.ms/aks-sp-help for more details. (Details: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier 'db3eceed-57c4-4e86-b898-e051d711c761' was not found in the directory '585127aa-8691-4f25-9777-8cb78ccf0d91'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: 81418b4c-ca53-4c3f-beaf-d63ab40fa600\r\nCorrelation ID: 64233089-88b9-4f45-9f31-75ea8adf06a5\r\nTimestamp: 2020-05-12 16:21:41Z","error_codes":[700016],"timestamp":"2020-05-12 16:21:41Z","trace_id":"81418b4c-ca53-4c3f-beaf-d63ab40fa600","correlation_id":"64233089-88b9-4f45-9f31-75ea8adf06a5","error_uri":"https://login.microsoftonline.com/error?code=700016"})

$ az --version
azure-cli                          2.5.1

command-modules-nspkg              2.0.3
core                               2.5.1
nspkg                              3.0.4
telemetry                          1.0.4

Python location '/usr/local/Cellar/azure-cli/2.5.1/libexec/bin/python'
Extensions directory '/Users/lebedana/.azure/cliextensions'

Python (Darwin) 3.8.2 (default, Mar 11 2020, 00:29:50) 
[Clang 11.0.0 (clang-1100.0.33.17)]