Hello,
Given that it has been sometime since the public preview of the service principal integration with ADO, I'm attempting deployment via a SPN and have run across an issue, this is more of a post where I'm seeking confirmation that it's either with the script or the SPN credentials that were setup, feel free to point out any areas of redundancy or documentation though I haven't seen much documentation apart for the Git Repo. For the connection name it was for the configured connection which I'm not entirely sure what it meant by that. For the credentials for testing purposes it was all hardcoded into the script(no encryption): I have a feeling that its with my SPN credentials but wanted a 2nd opinion before expending more time, this is the response returned to me when I ran the DevOps Pipeline:
Entering function: SetFabricHeaders
Entering function: ConvertSecureStringToPlainText
Entering function: GetWorkspaceByName
Entering function: GetConnectionByName
Entering function: GetErrorResponse
Converting service principal secret to secure string
Creating PSCredential object
Authenticating with Azure using service principal
Error in GetSecureTokenForServicePrincipal: ClientSecretCredential authentication failed:
Error in SetFabricHeaders: ClientSecretCredential authentication failed:
Script failed. Error: ClientSecretCredential authentication failed:
# This sample script calls the Fabric API to programmatically connect to and update the workspace with content in Git.
# For documentation, please see:
# https://learn.microsoft.com/en-us/rest/api/fabric/core/git/connect
# https://learn.microsoft.com/en-us/rest/api/fabric/core/git/initialize-connection
# https://learn.microsoft.com/en-us/rest/api/fabric/core/git/update-from-git
# https://learn.microsoft.com/en-us/rest/api/fabric/core/long-running-operations/get-operation-state
# Instructions:
# 1. Install PowerShell (https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell)
# 2. Install Azure PowerShell Az module (https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell)
# 3. Run PowerShell as an administrator
# 4. Fill in the parameters below
# 5. Change PowerShell directory to where this script is saved
# 6. > ./GitIntegration-ConnectAndUpdateFromGit.ps1
# Parameters - fill these in before running the script!
# =====================================================
$workspaceName = "workspace" # The name of the workspace
$shouldDisconnect = $false # Determines whether the workspace should be disconnected before connecting to a new Azure DevOps connection details.
# AzureDevOps details
$azureDevOpsDetails = @{
gitProviderType = "AzureDevOps"
organizationName = "org"
projectName = "project"
repositoryName = "project"
branchName = "branch"
directoryName = "directory"
}
# Relevant for Configured Connection authentication
$connectionName = "connectionName" # Replace with the connection display name that stores the gitProvider credentials (Required for GitHub. For ADO it is required only when using ConfiguredConnection)
$gitProviderDetails = $azureDevOpsDetails
$principalType = "ServicePrincipal"
# Relevant for ServicePrincipal
$clientId = "clientId" #The application (client) ID of the service principal
$tenantId = "tenantId" #The directory (tenant) ID of the service principal
$servicePrincipalSecret = "spSecret" #The secret value of the service principal
# End Parameters =======================================
$global:baseUrl = "https://api.fabric.microsoft.com/v1" # Replace with environment-specific base URL. For example: "https://api.fabric.microsoft.com/v1"
$global:resourceUrl = "https://api.fabric.microsoft.com/v1"
$global:fabricHeaders = @{}
Write-Host "Entering function: SetFabricHeaders"
function SetFabricHeaders() {
try {
if ($principalType -eq "ServicePrincipal") {
$secureFabricToken = GetSecureTokenForServicePrincipal
if (-not $secureFabricToken) {
throw "Failed to retrieve secure token for service principal."
}
# Convert SecureString to plain text
$fabricToken = ConvertSecureStringToPlainText($secureFabricToken)
if (-not $fabricToken) {
throw "Failed to convert secure token to plain text."
}
$global:fabricHeaders = @{
'Content-Type' = "application/json"
'Authorization' = "Bearer $fabricToken"
}
Write-Host "Fabric headers successfully set."
} else {
throw "Invalid principal type. Please choose either 'UserPrincipal' or 'ServicePrincipal'."
}
} catch {
Write-Host "Error in SetFabricHeaders: $($_.Exception.Message)" -ForegroundColor Red
throw $_
}
}
function GetSecureTokenForServicePrincipal() {
try {
Write-Host "Converting service principal secret to secure string"
$secureServicePrincipalSecret = ConvertTo-SecureString -String $servicePrincipalSecret -AsPlainText -Force
Write-Host "Creating PSCredential object"
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $clientId, $secureServicePrincipalSecret
Write-Host "Authenticating with Azure using service principal"
Connect-AzAccount -ServicePrincipal -TenantId $tenantId -Credential $credential -ErrorAction Stop | Out-Null
Write-Host "Retrieving access token"
$secureFabricToken = (Get-AzAccessToken -ResourceUrl $global:resourceUrl).Token
if (-not $secureFabricToken) {
throw "Access token retrieval failed."
}
Write-Host "Access token successfully retrieved."
return $secureFabricToken
} catch {
Write-Host "Error in GetSecureTokenForServicePrincipal: $($_.Exception.Message)" -ForegroundColor Red
throw $_
}
}
Write-Host "Entering function: ConvertSecureStringToPlainText"
function ConvertSecureStringToPlainText($secureString) {
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureString)
Write-Host "Starting try block"
try {
$plainText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)
} finally {
[System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)
}
Write-Host "String: $plainText"
return $plainText
}
Write-Host "Entering function: GetWorkspaceByName"
function GetWorkspaceByName($workspaceName) {
# Get workspaces
$getWorkspacesUrl = "$global:baseUrl/workspaces"
Write-Host "Invoking REST Method for GetWorkspaceByName"
$workspaces = (Invoke-RestMethod -Headers $global:fabricHeaders -Uri $getWorkspacesUrl -Method GET).value
# Try to find the workspace by display name
$workspace = $workspaces | Where-Object {$_.DisplayName -eq $workspaceName}
Write-Host "Returning from function"
return $workspace
}
Write-Host "Entering function: GetConnectionByName"
function GetConnectionByName($connectionName) {
# Get workspaces
$getConnectionsUrl = "$global:baseUrl/connections"
Write-Host "Invoking REST Method for GetConnectionByName"
$connections = (Invoke-RestMethod -Headers $global:fabricHeaders -Uri $getConnectionsUrl -Method GET).value
# Try to find the connection by display name
$connection = $connections | Where-Object {$_.DisplayName -eq $connectionName}
Write-Host "Returning from function"
return $connection
}
Write-Host "Entering function: GetErrorResponse"
function GetErrorResponse($exception) {
# Relevant only for PowerShell Core
$errorResponse = $_.ErrorDetails.Message
if(!$errorResponse) {
# This is needed to support Windows PowerShell
if (!$exception.Response) {
Write-Host "Returning from function"
return $exception.Message
}
$result = $exception.Response.GetResponseStream()
$reader = New-Object System.IO.StreamReader($result)
$reader.BaseStream.Position = 0
$reader.DiscardBufferedData()
$errorResponse = $reader.ReadToEnd();
}
Write-Host "Returning from function"
return $errorResponse
}
Write-Host "Starting try block"
try {
Write-Host "Setting Fabric headers"
SetFabricHeaders
Write-Host "Fabric headers set."
Write-Host "Getting workspace by name: $workspaceName"
$workspace = GetWorkspaceByName $workspaceName
Write-Host "Workspace lookup result: $($workspace | ConvertTo-Json -Depth 3)"
if (!$workspace) {
Write-Host "A workspace with the requested name was not found." -ForegroundColor Red
Write-Host "Returning from function Set Fabric Headers."
return
}
Write-Host "Connecting the workspace '$workspaceName' to Git."
$connectUrl = "$global:baseUrl/workspaces/$($workspace.Id)/git/connect"
Write-Host "Connect URL: $connectUrl"
$connectToGitBody = @{}
if ($gitProviderDetails.gitProviderType -eq "AzureDevOps") {
Write-Host "Getting connection by name: $connectionName"
$connection = GetConnectionByName $connectionName
Write-Host "Connection lookup result: $($connection | ConvertTo-Json -Depth 3)"
if (-not $connection) {
Write-Host "A connection with the requested name was not found." -ForegroundColor Red
return
}
$connectToGitBodyObject = @{
gitProviderDetails = $gitProviderDetails
myGitCredentials = @{
source = "ConfiguredConnection"
connectionId = $connection.id
}
}
$connectToGitBody = $connectToGitBodyObject | ConvertTo-Json -Depth 3
Write-Host "Connect to Git body: $connectToGitBody"
try {
Invoke-RestMethod -Headers $global:fabricHeaders -Uri $connectUrl -Method POST -Body $connectToGitBody
Write-Host "Workspace '$workspaceName' connected to Git." -ForegroundColor Green
} catch {
Write-Host "Failed to connect workspace to Git: $($_.Exception.Message)" -ForegroundColor Red
return
}
}
Write-Host "Connect to Git body: $connectToGitBody"
Invoke-RestMethod -Headers $global:fabricHeaders -Uri $connectUrl -Method POST -Body $connectToGitBody
Write-Host "Workspace '$workspaceName' connected to Git." -ForegroundColor Green
Write-Host "Initializing Git connection for workspace '$workspaceName'."
$initializeConnectionUrl = "$global:baseUrl/workspaces/$($workspace.Id)/git/initializeConnection"
Write-Host "Initialize Connection URL: $initializeConnectionUrl"
$initializeConnectionResponse = Invoke-RestMethod -Headers $global:fabricHeaders -Uri $initializeConnectionUrl -Method POST
Write-Host "Initialize Connection Response: $($initializeConnectionResponse | ConvertTo-Json -Depth 3)"
if ($initializeConnectionResponse.RequiredAction -eq "UpdateFromGit") {
Write-Host "Updating the workspace '$workspaceName' from Git."
$updateFromGitUrl = "$global:baseUrl/workspaces/$($workspace.Id)/git/updateFromGit"
$updateFromGitBody = @{
remoteCommitHash = $initializeConnectionResponse.RemoteCommitHash
workspaceHead = $initializeConnectionResponse.WorkspaceHead
} | ConvertTo-Json -Depth 3
Write-Host "Update from Git body: $updateFromGitBody"
$updateFromGitResponse = Invoke-WebRequest -Headers $global:fabricHeaders -Uri $updateFromGitUrl -Method POST -Body $updateFromGitBody
Write-Host "Update from Git response headers: $($updateFromGitResponse.Headers | ConvertTo-Json)"
$operationId = $updateFromGitResponse.Headers['x-ms-operation-id']
$retryAfter = $updateFromGitResponse.Headers['Retry-After']
Write-Host "Operation ID: $operationId, Retry-After: $retryAfter"
$getOperationState = "$global:baseUrl/operations/$operationId"
do {
Write-Host "Polling operation state from: $getOperationState"
$operationState = Invoke-RestMethod -Headers $global:fabricHeaders -Uri $getOperationState -Method GET
Write-Host "Operation status: $($operationState.Status)"
if ($operationState.Status -in @("NotStarted", "Running")) {
Write-Host "Sleeping for $retryAfter seconds"
Start-Sleep -Seconds $retryAfter
}
} while ($operationState.Status -in @("NotStarted", "Running"))
} else {
Write-Host "Expected RequiredAction to be UpdateFromGit but found $($initializeConnectionResponse.RequiredAction)" -ForegroundColor Red
}
if ($operationState.Status -eq "Failed") {
Write-Host "Update failed. Error: $($operationState.Error | ConvertTo-Json -Depth 3)" -ForegroundColor Red
} else {
Write-Host "Workspace '$workspaceName' successfully updated from Git." -ForegroundColor Green
}
} catch {
$errorResponse = GetErrorResponse($_.Exception)
Write-Host "Script failed. Error: $errorResponse" -ForegroundColor Red
}
Any Assistance is much appreciated!
Thanks!
