From cc8de87855228a16c6bf609fc3e45a3db1474a6f Mon Sep 17 00:00:00 2001 From: David Obando Date: Mon, 24 Aug 2026 19:45:59 -0700 Subject: [PATCH] Switch ESRP service connection to wif2 to fix npm publish The TypeScript build-and-publish pipeline fails in the EsrpRelease task while acquiring a token: AADSTS700213: No matching federated identity record found for presented assertion subject The 'Devtunnels-esrp-ame-msi' service connection's federated identity credential no longer matches the assertion subject presented by the ADO v5 agent, so the release gateway is never reached and no package is published. dev-tunnels-ssh hit the same failure and resolved it by moving to the 'Devtunnels-esrp-ame-msi-wif2' connection in microsoft/dev-tunnels-ssh@d8a9ff1. This applies the equivalent change here; everything else about the ESRP configuration (tenant, client id, key vault, signing certificate, task version) is unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .pipelines/typescript-build-and-publish.yaml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.pipelines/typescript-build-and-publish.yaml b/.pipelines/typescript-build-and-publish.yaml index cf005b77..ae411618 100644 --- a/.pipelines/typescript-build-and-publish.yaml +++ b/.pipelines/typescript-build-and-publish.yaml @@ -17,7 +17,13 @@ variables: # ESRP Code Signing # ESRP Registration: https://portal.esrp.microsoft.com/Onboarding/AccountDetails?clientId=142047f4-eda8-4853-8776-c2e81803ea13 - # Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi (https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices?resourceId=702454c9-77bd-4750-820e-5ce2e483f9f5) + # Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi-wif2 + # (listed under https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices) + # This replaces the earlier 'Devtunnels-esrp-ame-msi' connection (resourceId 702454c9-77bd-4750-820e-5ce2e483f9f5). + # That connection's federated identity credential no longer matches the assertion subject presented by the + # ADO v5 agent, so EsrpRelease fails to acquire a token with 'AADSTS700213: No matching federated identity + # record found for presented assertion subject'. dev-tunnels-ssh made the same switch in + # microsoft/dev-tunnels-ssh@d8a9ff1. # Managed identity that this service connection has federated access to: tunnels-ppe-esrp-id (client id 01ee3ff5-3b24-4b62-996e-6217f7cf3487) in AME tenant (33e01921-4d64-4f8c-a055-5bdaffd5e33d). # Signing certificate: esrp-sign in tunnels-ppe-esrp-kv # ESRP used to use a cert to authenticate as app in Microsoft tenant, but now it uses a managed identity in AME tenant. @@ -25,7 +31,7 @@ variables: # https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg501-eliminate-access-to-codesigning-from-corp-tenants # https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg506-integrating-esrp-release-ado-extension - EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi' # Service connection with ESRP MSI based authentication + EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi-wif2' # Service connection with ESRP MSI based authentication EsrpClientId: '142047f4-eda8-4853-8776-c2e81803ea13' # ESRP Client Id, the Old App Registration Id to which we mapped our Managed Identity Id to EsrpAuthAKVName: 'tunnels-ppe-esrp-kv' # Key Vault name where the signing certificate is stored EsrpAuthSignCertName: 'esrp-sign' # Code signing certificate name in the Key Vault