Azure-cli: The credentials in ServicePrincipalProfile were invalid.... token contains an invalid number of segments

[rickardp]

Describe the bug

When a service principal credential happens to contain a dash character (which it can and happens randomly) the "az aks create" command fails when it is supplied.

Error code:

Operation failed with status: 'Bad Request'. Details: The credentials in ServicePrincipalProfile were invalid. Please see https://aka.ms/aks-sp-help for more details. (Details: token contains an invalid number of segments)

To Reproduce
Reset the credential of a service principal until you get a dash (-) in the name. Use e.g.

az aks create --subscription x --name mycluster --resource-group cluster-rg --location westeurope --vm-set-type VirtualMachineScaleSets [...] --service-principal <service principal uuid> --client-secret <secret>

Expected behavior
The command succeeds and the cluster is created

Environment summary
az version
{
"azure-cli": "2.7.0",
"azure-cli-command-modules-nspkg": "2.0.3",
"azure-cli-core": "2.7.0",
"azure-cli-nspkg": "3.0.4",
"azure-cli-telemetry": "1.0.4",
"extensions": {}
}

!uname -a
Linux 089dccf9945f 4.19.76-linuxkit #1 SMP Tue May 26 11:42:35 UTC 2020 x86_64 Linux

!python --version
Python 3.8.1
Additional context

The command was invoked from a Python script specifying the arguments directly, so any kind of shell interference can be ruled out in this case.

[msftbot[bot]]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/aks-pm.

[yonzhan]

aks

[djsly]

seems that your service principal or the service principal secret weren't quoted properly ?

can you ensure that you pass the appID/AppSecret

[rickardp]

I verified that I pass the SP and secret correctly I, as in they are sent as distinct arguments to AZ CLI.

Am I supposed to quote the quoted secret, even if it is correctly handled as command line arguments?

My expectation was that as long as the secret was interpreted correctly as an argument, AZ CLI would do the rest for me.

[djsly]

seems that your issue has been seen by a few other folks

https://github.com/MicrosoftDocs/azure-docs/issues/56103

https://docs.microsoft.com/en-us/answers/questions/32361/az-aks-create-fails-with-details-token-contains-an.html

It seems that the changed they regex for accepted password at the AD SP create logic. the returned password are indeed not handled correctly by the azure CLI for AKS cluster creation, the above two issues are all using az cli, even with the latest and greatest version

[dcatalano-figure]

same issue.

did the format of secrets change? much different than what is in: https://docs.microsoft.com/en-us/azure/aks/update-credentials#update-aks-cluster-with-new-service-principal-credentials

Ran this command back in April and worked fine. Updating another cluster today is causing said problem.

[dcatalano-figure]

for reference we are attempting to update creds

az aks update-credentials --resource-group <rg> --name <name> --reset-service-principal --service-principal $SP_ID --client-secret $SP_SECRET

[dcatalano-figure]

was able to make this work by recreating a secret until the secret had no dashes, then ran the update-credential command

[djj0809]

We are also seeing this issue

[ArPharazon]

was able to make this work by recreating a secret until the secret had no dashes, then ran the update-credential command

Thanks! This tip fixed my issue.

[Soyofuki]

was able to make this work by recreating a secret until the secret had no dashes, then ran the update-credential command

This works for me as well. So it seems to be a bug when there're dashes in the secret?