Merge pull request #2612 from sebassem/az-powershell-accessToken-brea…

…king-change add secureString flag to Get-AzAccessToken
microsoft · Jul 17, 2024 · af7848e · af7848e
2 parents b36535a + 2c7842d
commit af7848e
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 8 deletions.
diff --git a/azure_arc_sqlsrv_jumpstart/aws/winsrv/terraform/scripts/install_arc_agent.ps1.tmpl b/azure_arc_sqlsrv_jumpstart/aws/winsrv/terraform/scripts/install_arc_agent.ps1.tmpl
@@ -65,9 +65,9 @@ function registerArcForServers() {
     elseif (Get-InstalledModule -Name Az.Accounts -MinimumVersion 2.2) {
         # New versions of Az.Account support getting access tokens
         #
-        $token = Get-AzAccessToken
+        $token = (Get-AzAccessToken -AsSecureString).token
         $params += "--access-token"
-        $params += $token.Token
+        $params += (ConvertFrom-SecureString $token -AsPlainText)
     }
 
     & "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" $params

diff --git a/azure_arc_sqlsrv_jumpstart/gcp/winsrv/terraform/scripts/install_arc_agent.ps1.tmpl b/azure_arc_sqlsrv_jumpstart/gcp/winsrv/terraform/scripts/install_arc_agent.ps1.tmpl
@@ -65,9 +65,9 @@ function registerArcForServers() {
     elseif (Get-InstalledModule -Name Az.Accounts -MinimumVersion 2.2) {
         # New versions of Az.Account support getting access tokens
         #
-        $token = Get-AzAccessToken
+        $token = (Get-AzAccessToken -AsSecureString).token
         $params += "--access-token"
-        $params += $token.Token
+        $params += (ConvertFrom-SecureString $token -AsPlainText)
     }
 
     & "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" $params

diff --git a/azure_arc_sqlsrv_jumpstart/vmware/winsrv/terraform/scripts/install_arc_agent.ps1.tmpl b/azure_arc_sqlsrv_jumpstart/vmware/winsrv/terraform/scripts/install_arc_agent.ps1.tmpl
@@ -65,9 +65,9 @@ function registerArcForServers() {
     elseif (Get-InstalledModule -Name Az.Accounts -MinimumVersion 2.2) {
         # New versions of Az.Account support getting access tokens
         #
-        $token = Get-AzAccessToken
+        $token = (Get-AzAccessToken -AsSecureString).token
         $params += "--access-token"
-        $params += $token.Token
+        $params += (ConvertFrom-SecureString $token -AsPlainText)
     }
 
     & "$env:ProgramFiles\AzureConnectedMachineAgent\azcmagent.exe" $params

diff --git a/azure_jumpstart_hcibox/artifacts/PowerShell/New-HCIBoxCluster.ps1 b/azure_jumpstart_hcibox/artifacts/PowerShell/New-HCIBoxCluster.ps1
@@ -1466,14 +1466,14 @@ function Set-HCIDeployPrereqs {
             Install-Module Az.Resources -Force
             $azureAppCred = (New-Object System.Management.Automation.PSCredential $clientId, (ConvertTo-SecureString -String $clientSecret -AsPlainText -Force))
             Connect-AzAccount -ServicePrincipal -SubscriptionId $subId -TenantId $tenantId -Credential $azureAppCred
-            $armtoken = Get-AzAccessToken
+            $armtoken = ConvertFrom-SecureString ((Get-AzAccessToken -AsSecureString).Token) -AsPlainText
 
             # Workaround for BITS transfer issue
             Get-NetAdapter StorageA | Disable-NetAdapter -Confirm:$false | Out-Null
             Get-NetAdapter StorageB | Disable-NetAdapter -Confirm:$false | Out-Null
 
             #Invoke the registration script.
-            Invoke-AzStackHciArcInitialization -SubscriptionID $subId -ResourceGroup $resourceGroup -TenantID $tenantId -Region $location -Cloud "AzureCloud" -ArmAccessToken $armtoken.Token -AccountID $clientId
+            Invoke-AzStackHciArcInitialization -SubscriptionID $subId -ResourceGroup $resourceGroup -TenantID $tenantId -Region $location -Cloud "AzureCloud" -ArmAccessToken $armtoken -AccountID $clientId
 
             Get-NetAdapter StorageA | Enable-NetAdapter -Confirm:$false | Out-Null
             Get-NetAdapter StorageB | Enable-NetAdapter -Confirm:$false | Out-Null