Azure US Government OIDC

[jamesseiwert]

When using OIDC in azure government an error is thrown on login but still works successfully

Using OIDC authentication...
Error: undefined. Please make sure to give write permissions to id-token in the workflow.
/usr/bin/az cloud set -n azureusgovernment
WARNING: Switched active cloud to 'AzureUSGovernment'.
WARNING: Use 'az login' to log in to this cloud.
WARNING: Use 'az account set' to set the active subscription.
Done setting cloud: "azureusgovernment"
Login successful.

The workflow has the permissions set as well

permissions:
id-token: write
contents: read

[arnoldna]

There is an open PR on this issue #258. Waiting on approval of the PR since November

[BALAGA-GAYATRI]

Jim Seiwert (@jamesseiwert) Ideally it should throw an error saying Govt clouds are not supported. Can you share more details if you are using a forked version of the action where you are bypassing that condition. Please share your workflow yaml for better understanding. Coming to the support for Govt clouds we are following up and will get back to you with more info.

[jamesseiwert]

Balaga Gayatri (@BALAGA-GAYATRI) sorry for the delay. The workflow is simple and the login appears to work just with the false positive error. Below is the workflow file we are doing and at the end we can do a simple print out of all resource groups.

`

steps:
  - name: Login to Azure US Gov Cloud
    uses: azure/login@v1
    with:
      environment: "AzureUSGovernment"
      client-id: ${{ vars.AZURE_CLIENT_ID }}
      tenant-id: ${{ vars.AZURE_TENANT_ID }}
      subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

  - name: List Resource Groups
    run: |
      az group list`

[BALAGA-GAYATRI]

Can you please add the below permissions for OIDC token and check the logs once.

permissions:
      id-token: write
      contents: read

[jamesseiwert]

Balaga Gayatri (@BALAGA-GAYATRI) we do have those permissions in the workflow

[BALAGA-GAYATRI]

https://github.com/Azure/login/blob/master/src/main.ts#L116
The error is being thrown in this line while getting an id-token. Since we aren't handling the error correctly there, it's continuing the flow(not expected though). But login successful is still not expected here. Since the error was thrown before itself, our execution is not reaching this point to throw the error for Govt clouds. I need to look into more details to understand this better. Are you using this action in GitHub enterprise? If yes, make sure to check this out.

[github-actions]

This issue is idle because it has been open for 14 days with no activity.

[jamesseiwert]

We are using this in both Github.com and Github Enterprise

[github-actions]

This issue is idle because it has been open for 14 days with no activity.