Hello,

Given that it has been sometime since the public preview of the service principal integration with ADO, I'm attempting deployment via a SPN and have run across an issue, this is more of a post where I'm seeking confirmation that it's either with the script or the SPN credentials that were setup, feel free to point out any areas of redundancy or documentation though I haven't seen much documentation apart for the Git Repo. For the connection name it was for the configured connection which I'm not entirely sure what it meant by that. For the credentials for testing purposes it was all hardcoded into the script(no encryption): I have a feeling that its with my SPN credentials but wanted a 2nd opinion before expending more time, this is the response returned to me when I ran the DevOps Pipeline:

Entering function: SetFabricHeaders

Entering function: ConvertSecureStringToPlainText

Entering function: GetWorkspaceByName

Entering function: GetConnectionByName

Entering function: GetErrorResponse

Starting try block

Setting Fabric headers

Converting service principal secret to secure string

Creating PSCredential object

Authenticating with Azure using service principal

Retrieving access token

Error in GetSecureTokenForServicePrincipal: ClientSecretCredential authentication failed:

Error in SetFabricHeaders: ClientSecretCredential authentication failed:

Returning from function

Script failed. Error: ClientSecretCredential authentication failed:

# This sample script calls the Fabric API to programmatically connect to and update the workspace with content in Git. # For documentation, please see: # https://learn.microsoft.com/en-us/rest/api/fabric/core/git/connect # https://learn.microsoft.com/en-us/rest/api/fabric/core/git/initialize-connection # https://learn.microsoft.com/en-us/rest/api/fabric/core/git/update-from-git # https://learn.microsoft.com/en-us/rest/api/fabric/core/long-running-operations/get-operation-state # Instructions: # 1. Install PowerShell (https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell) # 2. Install Azure PowerShell Az module (https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell) # 3. Run PowerShell as an administrator # 4. Fill in the parameters below # 5. Change PowerShell directory to where this script is saved # 6. > ./GitIntegration-ConnectAndUpdateFromGit.ps1 # Parameters - fill these in before running the script! # ===================================================== $workspaceName = "workspace" # The name of the workspace $shouldDisconnect = $false # Determines whether the workspace should be disconnected before connecting to a new Azure DevOps connection details. # AzureDevOps details $azureDevOpsDetails = @{ gitProviderType = "AzureDevOps" organizationName = "org" projectName = "project" repositoryName = "project" branchName = "branch" directoryName = "directory" } # Relevant for Configured Connection authentication $connectionName = "connectionName" # Replace with the connection display name that stores the gitProvider credentials (Required for GitHub. For ADO it is required only when using ConfiguredConnection) $gitProviderDetails = $azureDevOpsDetails $principalType = "ServicePrincipal" # Relevant for ServicePrincipal $clientId = "clientId" #The application (client) ID of the service principal $tenantId = "tenantId" #The directory (tenant) ID of the service principal $servicePrincipalSecret = "spSecret" #The secret value of the service principal # End Parameters ======================================= $global:baseUrl = "https://api.fabric.microsoft.com/v1" # Replace with environment-specific base URL. For example: "https://api.fabric.microsoft.com/v1" $global:resourceUrl = "https://api.fabric.microsoft.com/v1" $global:fabricHeaders = @{} Write-Host "Entering function: SetFabricHeaders" function SetFabricHeaders() { try { if ($principalType -eq "ServicePrincipal") { $secureFabricToken = GetSecureTokenForServicePrincipal if (-not $secureFabricToken) { throw "Failed to retrieve secure token for service principal." } # Convert SecureString to plain text $fabricToken = ConvertSecureStringToPlainText($secureFabricToken) if (-not $fabricToken) { throw "Failed to convert secure token to plain text." } $global:fabricHeaders = @{ 'Content-Type' = "application/json" 'Authorization' = "Bearer $fabricToken" } Write-Host "Fabric headers successfully set." } else { throw "Invalid principal type. Please choose either 'UserPrincipal' or 'ServicePrincipal'." } } catch { Write-Host "Error in SetFabricHeaders: $($_.Exception.Message)" -ForegroundColor Red throw $_ } } function GetSecureTokenForServicePrincipal() { try { Write-Host "Converting service principal secret to secure string" $secureServicePrincipalSecret = ConvertTo-SecureString -String $servicePrincipalSecret -AsPlainText -Force Write-Host "Creating PSCredential object" $credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $clientId, $secureServicePrincipalSecret Write-Host "Authenticating with Azure using service principal" Connect-AzAccount -ServicePrincipal -TenantId $tenantId -Credential $credential -ErrorAction Stop | Out-Null Write-Host "Retrieving access token" $secureFabricToken = (Get-AzAccessToken -ResourceUrl $global:resourceUrl).Token if (-not $secureFabricToken) { throw "Access token retrieval failed." } Write-Host "Access token successfully retrieved." return $secureFabricToken } catch { Write-Host "Error in GetSecureTokenForServicePrincipal: $($_.Exception.Message)" -ForegroundColor Red throw $_ } } Write-Host "Entering function: ConvertSecureStringToPlainText" function ConvertSecureStringToPlainText($secureString) { $ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString) Write-Host "Starting try block" try { $plainText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr) } finally { [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr) } Write-Host "String: $plainText" return $plainText } Write-Host "Entering function: GetWorkspaceByName" function GetWorkspaceByName($workspaceName) { # Get workspaces $getWorkspacesUrl = "$global:baseUrl/workspaces" Write-Host "Invoking REST Method for GetWorkspaceByName" $workspaces = (Invoke-RestMethod -Headers $global:fabricHeaders -Uri $getWorkspacesUrl -Method GET).value # Try to find the workspace by display name $workspace = $workspaces | Where-Object {$_.DisplayName -eq $workspaceName} Write-Host "Returning from function" return $workspace } Write-Host "Entering function: GetConnectionByName" function GetConnectionByName($connectionName) { # Get workspaces $getConnectionsUrl = "$global:baseUrl/connections" Write-Host "Invoking REST Method for GetConnectionByName" $connections = (Invoke-RestMethod -Headers $global:fabricHeaders -Uri $getConnectionsUrl -Method GET).value # Try to find the connection by display name $connection = $connections | Where-Object {$_.DisplayName -eq $connectionName} Write-Host "Returning from function" return $connection } Write-Host "Entering function: GetErrorResponse" function GetErrorResponse($exception) { # Relevant only for PowerShell Core $errorResponse = $_.ErrorDetails.Message if(!$errorResponse) { # This is needed to support Windows PowerShell if (!$exception.Response) { Write-Host "Returning from function" return $exception.Message } $result = $exception.Response.GetResponseStream() $reader = New-Object System.IO.StreamReader($result) $reader.BaseStream.Position = 0 $reader.DiscardBufferedData() $errorResponse = $reader.ReadToEnd(); } Write-Host "Returning from function" return $errorResponse } Write-Host "Starting try block" try { Write-Host "Setting Fabric headers" SetFabricHeaders Write-Host "Fabric headers set." Write-Host "Getting workspace by name: $workspaceName" $workspace = GetWorkspaceByName $workspaceName Write-Host "Workspace lookup result: $($workspace | ConvertTo-Json -Depth 3)" if (!$workspace) { Write-Host "A workspace with the requested name was not found." -ForegroundColor Red Write-Host "Returning from function Set Fabric Headers." return } Write-Host "Connecting the workspace '$workspaceName' to Git." $connectUrl = "$global:baseUrl/workspaces/$($workspace.Id)/git/connect" Write-Host "Connect URL: $connectUrl" $connectToGitBody = @{} if ($gitProviderDetails.gitProviderType -eq "AzureDevOps") { Write-Host "Getting connection by name: $connectionName" $connection = GetConnectionByName $connectionName Write-Host "Connection lookup result: $($connection | ConvertTo-Json -Depth 3)" if (-not $connection) { Write-Host "A connection with the requested name was not found." -ForegroundColor Red return } $connectToGitBodyObject = @{ gitProviderDetails = $gitProviderDetails myGitCredentials = @{ source = "ConfiguredConnection" connectionId = $connection.id } } $connectToGitBody = $connectToGitBodyObject | ConvertTo-Json -Depth 3 Write-Host "Connect to Git body: $connectToGitBody" try { Invoke-RestMethod -Headers $global:fabricHeaders -Uri $connectUrl -Method POST -Body $connectToGitBody Write-Host "Workspace '$workspaceName' connected to Git." -ForegroundColor Green } catch { Write-Host "Failed to connect workspace to Git: $($_.Exception.Message)" -ForegroundColor Red return } } Write-Host "Connect to Git body: $connectToGitBody" Invoke-RestMethod -Headers $global:fabricHeaders -Uri $connectUrl -Method POST -Body $connectToGitBody Write-Host "Workspace '$workspaceName' connected to Git." -ForegroundColor Green Write-Host "Initializing Git connection for workspace '$workspaceName'." $initializeConnectionUrl = "$global:baseUrl/workspaces/$($workspace.Id)/git/initializeConnection" Write-Host "Initialize Connection URL: $initializeConnectionUrl" $initializeConnectionResponse = Invoke-RestMethod -Headers $global:fabricHeaders -Uri $initializeConnectionUrl -Method POST Write-Host "Initialize Connection Response: $($initializeConnectionResponse | ConvertTo-Json -Depth 3)" if ($initializeConnectionResponse.RequiredAction -eq "UpdateFromGit") { Write-Host "Updating the workspace '$workspaceName' from Git." $updateFromGitUrl = "$global:baseUrl/workspaces/$($workspace.Id)/git/updateFromGit" $updateFromGitBody = @{ remoteCommitHash = $initializeConnectionResponse.RemoteCommitHash workspaceHead = $initializeConnectionResponse.WorkspaceHead } | ConvertTo-Json -Depth 3 Write-Host "Update from Git body: $updateFromGitBody" $updateFromGitResponse = Invoke-WebRequest -Headers $global:fabricHeaders -Uri $updateFromGitUrl -Method POST -Body $updateFromGitBody Write-Host "Update from Git response headers: $($updateFromGitResponse.Headers | ConvertTo-Json)" $operationId = $updateFromGitResponse.Headers['x-ms-operation-id'] $retryAfter = $updateFromGitResponse.Headers['Retry-After'] Write-Host "Operation ID: $operationId, Retry-After: $retryAfter" $getOperationState = "$global:baseUrl/operations/$operationId" do { Write-Host "Polling operation state from: $getOperationState" $operationState = Invoke-RestMethod -Headers $global:fabricHeaders -Uri $getOperationState -Method GET Write-Host "Operation status: $($operationState.Status)" if ($operationState.Status -in @("NotStarted", "Running")) { Write-Host "Sleeping for $retryAfter seconds" Start-Sleep -Seconds $retryAfter } } while ($operationState.Status -in @("NotStarted", "Running")) } else { Write-Host "Expected RequiredAction to be UpdateFromGit but found $($initializeConnectionResponse.RequiredAction)" -ForegroundColor Red } if ($operationState.Status -eq "Failed") { Write-Host "Update failed. Error: $($operationState.Error | ConvertTo-Json -Depth 3)" -ForegroundColor Red } else { Write-Host "Workspace '$workspaceName' successfully updated from Git." -ForegroundColor Green } } catch { $errorResponse = GetErrorResponse($_.Exception) Write-Host "Script failed. Error: $errorResponse" -ForegroundColor Red }

Any Assistance is much appreciated!

Thanks!

Forum Discussion

Automated Deployment w/ Service Principal in DevOps