Authentication error in Azure Automation with certificates - Powershell code

Question

Today I'm experiencing another problem related with Powershell and Azure Automation.

Let's see... My intention is build an automatic deploy, that deploy does something picking and saving data from and to my blobs and after all theses processes, delete that deploy.

So, I developed that on my powershell console and I had no problems. The point comes when I try to "import" my script to Automation. I write "import" with brackets because I just copied my code to Automation console.

I'd like to post images but I can't, so I'll try to be clear explaining the steps that I did, making sure that I didn't forget something.

First of all I created my certs, one with .cer extension and the other one with .pfx, ok.

Once I uploaded the first certificate in the management certificate section (in settings menu) I created the assets:

First the credential one, where I put the other certificate that I generated (.PFX).

After that, I created the last asset, the connection one, where I wrote the certificate name where it was need and also the subscription ID.

Now, after these points I'm suposed to operate with my Azure subscription using snippets in Automation, some of these snippets are not recognized by Azure, that's why I used "InlineScript" for write down these that were not recognized.

The point here is that once I followed the whole steps to prepare and configure my envirorment to make possible whatever I want in Automation, I get some error related with my certificate and stuff.

I'm gonna paste here the first part of my script:

workflow testing2

{

# Specify Azure Subscription Name
$subName = 'AzureConnection'

# Connect to Azure Subscription
Connect-Azure `
    -AzureConnectionName $subName

Select-AzureSubscription `
    -SubscriptionName $subName 

inlineScript{

    # VM related variables

    $pwd = "xxxxxxxxx"
    $aun = "LrootA"
    $VMimage = "a699494373c04fc0bc8f2bb1389d6106__Windows-Server-2012-R2-201405.01-en.us-127GB.vhd"

    # CSExtension Version

    $CSEVersion = Get-AzureVMAvailableExtension | Where { $_.ExtensionName -like "*Custom*" } | Select Version

}

}

The error that I get when I test this script is the next one:

6/23/2014 2:20:56 PM, Error: Get-AzureVMAvailableExtension : No current subscription has been designated. Use Select-AzureSubscription -Current to set the current subscription. At testing2:19 char:19 + + CategoryInfo : CloseError: (:) [Get-AzureVMAvailableExtension], Exception + FullyQualifiedErrorId : Microsoft.WindowsAzure.Commands.ServiceManagement.IaaS.Extensions.GetAzureVMAvailableExtensionCommand 6/23/2014 2:20:56 PM, Error: New-AzureVMConfig : Must specify MediaLocation or set a current storage account using Set-AzureSubscription. At testing2:19 char:19

As we can see, in these errors we noticed that there are some problems with the subscription.

Instead use:

# Specify Azure Subscription Name
$subName = 'AzureConnection'

# Connect to Azure Subscription
Connect-Azure `
    -AzureConnectionName $subName

Select-AzureSubscription `
    -SubscriptionName $subName

I tried with set-azuresubscription... but I had a similar problem. I don't know if I should combine set-azuresubscription and the other part specifying my subscription and trying to establish connection with this... (I mean, the last code that I wrote).

So... How can I fix that?

Thanks in advance, hope that I've been clear.

Joe Joe · Accepted Answer · 2014-08-08T21:15:02

I think the issue is that you are calling Select-AzureSubscription outside of the inlinescript. Select-AzureSubscription sets a session variable to tell Azure cmdlets what subscription to connect to, and all activities in runbook (PowerShell Workflow) are run in different sessions. The workaround is InlineScript, where everything in a single inlinescript runs in the same session, in PowerShell context. So putting the Select-AzureSubscription call in there should place it in the correct session.

It also appears the Get-AzureVMAvailableExtension cmdlet, specifically, interacts with Azure Storage and so needs you to set an Azure Storage Account in the subscription data file. Connect-Azure does not currently do this for you.

Here's the runbook I think will work:

workflow testing2
{

    # Specify Azure Subscription Name
    $subName = 'AzureConnection'

    # Specify the Azure Storage Account to use
    $StorageAccountName = 'MyStorageAccount'

    # Connect to Azure Subscription
    Connect-Azure `
        -AzureConnectionName $subName

    InlineScript {

        Select-AzureSubscription `
            -SubscriptionName $Using:subName

        Set-AzureSubscription ` 
            -SubscriptionName $Using:subName ` 
            -CurrentStorageAccount $Using:StorageAccountName 

        # VM related variables

        $pwd = "xxxxxxxxx"
        $aun = "LrootA"
        $VMimage = "a699494373c04fc0bc8f2bb1389d6106__Windows-Server-2012-R2-201405.01-en.us-127GB.vhd"

        # CSExtension Version
        $CSEVersion = Get-AzureVMAvailableExtension | Where { $_.ExtensionName -like "*Custom*" } | Select Version
    }
}

Authentication error in Azure Automation with certificates - Powershell code

2 Answers