Azure Resource Manager using Workload Identity federation

[sannicolao]

Describe the bug
During Publish ADF i receive the error: Unsupported authentication scheme 'WorkloadIdentityFederation' for Azure endpoint.

To Reproduce

With Service Principal, it works very well. With "Azure Resource Manager using Workload Identity federation" i receive the error.

Thanks.

Installed Version:

[NowinskiK]

Change version from 1.x to 2.x to get support for WIF:

[dvartanian]

@NowinskiK
We've just made the switch to federated service connections and so I too have updated my yaml to use the v2 version. Unfortunately, I'm now getting an error:

##[error]You cannot call a method on a null-valued expression.

This appears to be happen when it attempts to get the federated service connection's token:

##[debug]Get-VstsFederatedToken : You cannot call a method on a null-valued expression.
##[debug]At C:\a\_tasks\PublishADFTask_1af843b5-35a0-411f-9a18-9eb7a59fb8b8\2.0.1514\ps_modules\VstsAzureHelpers_\InitializeAzModuleFunctions.ps1:327 char:31
##[debug]+ ... ertionJwt = Get-VstsFederatedToken -serviceConnectionId $connectedSer ...
##[debug]+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
##[debug]    + CategoryInfo          : InvalidOperation: (:) [Get-VstsFederatedToken], RuntimeException
##[debug]    + FullyQualifiedErrorId : InvokeMethodOnNull,Get-VstsFederatedToken

I have supplied that service connection name in the task inputs as shown below:

Is there something else I'm missing that might be causing this?

[sannicolao]

@NowinskiK Oh dam.... it works perfectly. Thanks.

[fbglv]

@NowinskiK I was wondering: are you using the (old) Release Pipelines or the "normal" ones?

[NowinskiK]

Do you mean "Classic" vs "YAML"?
If so - it doesn't matter. It's just the way how DevOps engineer works with Azure DevOps while defining pipelines.
The code of #adftools is exactly the same. The only nuance is that in YAML you can define precise version of the task, whereas in Classic UI you can define only the major part of version (1.* or 2.*)

[dvartanian]

We've just made the switch to federated service connections and so I too had to update my yaml to use the v2 version. Unfortunately, I'm now getting an error:

##[error]You cannot call a method on a null-valued expression.

This appears to be happen when it attempts to get the federated service connection's token:

##[debug]Get-VstsFederatedToken : You cannot call a method on a null-valued expression.
##[debug]At C:\a\_tasks\PublishADFTask_1af843b5-35a0-411f-9a18-9eb7a59fb8b8\2.0.1514\ps_modules\VstsAzureHelpers_\InitializeAzModuleFunctions.ps1:327 char:31
##[debug]+ ... ertionJwt = Get-VstsFederatedToken -serviceConnectionId $connectedSer ...
##[debug]+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
##[debug]    + CategoryInfo          : InvalidOperation: (:) [Get-VstsFederatedToken], RuntimeException
##[debug]    + FullyQualifiedErrorId : InvokeMethodOnNull,Get-VstsFederatedToken

I have supplied that service connection name in the task inputs as shown below:

Is there something else I'm missing that might be causing this?

[NowinskiK]

@dvartanian, can you please create a new issue for this? This looks like a problem with your Azure DevOps Service Connection using workload identity federation. Try to run any other PowerShell command checking access to Azure Subscription under this connection.
For example: Get-AzContext or Get-AzSubscription and see what you'll get.

[NowinskiK]

Check also if you have all PS modules up to date: Azure-Player/azure.datafactory.devops#170