Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bug report: botAadApp create encrypting botPassword multiple times #9780

Closed
Mikunj opened this issue Aug 30, 2023 · 4 comments
Closed

bug report: botAadApp create encrypting botPassword multiple times #9780

Mikunj opened this issue Aug 30, 2023 · 4 comments
Assignees
Labels
investigating needs more info Need user to provide more info no recent activity The issue labeled needs more info gets no reply from issue owner in time TA:Auth Team Area: Auth

Comments

@Mikunj
Copy link

Mikunj commented Aug 30, 2023

Describe the bug
Running botAadApp/create action will encrypt the existing secret if it exists.

To Reproduce

# yaml-language-server: $schema=https://aka.ms/teams-toolkit/1.0.0/yaml.schema.json
version: 1.0.0

environmentFolderPath: ./env

provision:
  - uses: botAadApp/create
    with:
      name: my-bot-name
    writeToEnvironmentFile:
      botId: MS_BOT_ID
      botPassword: SECRET_MS_BOT_SECRET
  1. Run provision using the configuration above
  2. Take note of SECRET_MS_BOT_SECRET value in user file
  3. Run provision again
  4. SECRET_MS_BOT_SECRET will be a completely different value from previous run and it will be a longer string

Decrypting SECRET_MS_BOT_SECRET from step 4 will yield you SECRET_MS_BOT_SECRET from step 2, which in turn being decrypted will yield the original secret.

Expected behavior
botPassword should only ever be encrypted once. Decrypting this should yield the secret instead of another encrypted string.

CLI Information:

  • OS: Ventura 13.5
  • Version 2.0.1
@microsoft-github-policy-service
Copy link
Contributor

Thank you for contacting us! Any issue or feedback from you is quite important to us. We will do our best to fully respond to your issue as soon as possible. Sometimes additional investigations may be needed, we will usually get back to you within 2 days by adding comments to this issue. Please stay tuned.

@jayzhang
Copy link
Member

@Mikunj Can you make sure that decrypted value is different? In principle, the two secrets are different, which is by design. But the decrypted value should be the same. I have tried to reproduce the steps, the decrypted value keeps the same.

@jayzhang jayzhang added the needs more info Need user to provide more info label Oct 16, 2023
@microsoft-github-policy-service microsoft-github-policy-service bot added the no recent activity The issue labeled needs more info gets no reply from issue owner in time label Oct 24, 2023
@microsoft-github-policy-service
Copy link
Contributor

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 7 days. It will be closed if no further activity occurs within 3 days of this comment. If it is closed, feel free to comment when you are able to provide the additional information and we will re-investigate.

@microsoft-github-policy-service
Copy link
Contributor

Due to lack of details for further investigation, we will archive the issue for now. In case you still have following-up questions on this issue, please always feel free to reopen the issue by clicking ‘reopen issue’ button below the comment box. We will get back to you as soon as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
investigating needs more info Need user to provide more info no recent activity The issue labeled needs more info gets no reply from issue owner in time TA:Auth Team Area: Auth
Projects
None yet
Development

No branches or pull requests

4 participants