Skip to content

Switch ESRP service connection to wif2 to fix npm publish #672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
David Obando (DavidObando) merged 1 commit into from
Aug 25, 2026
Merged

Switch ESRP service connection to wif2 to fix npm publish #672

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions .pipelines/typescript-build-and-publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,21 @@ variables:

# ESRP Code Signing
# ESRP Registration: https://portal.esrp.microsoft.com/Onboarding/AccountDetails?clientId=142047f4-eda8-4853-8776-c2e81803ea13
# Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi (https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices?resourceId=702454c9-77bd-4750-820e-5ce2e483f9f5)
# Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi-wif2
# (listed under https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices)
# This replaces the earlier 'Devtunnels-esrp-ame-msi' connection (resourceId 702454c9-77bd-4750-820e-5ce2e483f9f5).
# That connection's federated identity credential no longer matches the assertion subject presented by the
# ADO v5 agent, so EsrpRelease fails to acquire a token with 'AADSTS700213: No matching federated identity
# record found for presented assertion subject'. dev-tunnels-ssh made the same switch in
# microsoft/dev-tunnels-ssh@d8a9ff1.
# Managed identity that this service connection has federated access to: tunnels-ppe-esrp-id (client id 01ee3ff5-3b24-4b62-996e-6217f7cf3487) in AME tenant (33e01921-4d64-4f8c-a055-5bdaffd5e33d).
# Signing certificate: esrp-sign in tunnels-ppe-esrp-kv
# ESRP used to use a cert to authenticate as app in Microsoft tenant, but now it uses a managed identity in AME tenant.
# The migration was done following these TSGs:
# https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg501-eliminate-access-to-codesigning-from-corp-tenants
# https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg506-integrating-esrp-release-ado-extension

EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi' # Service connection with ESRP MSI based authentication
EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi-wif2' # Service connection with ESRP MSI based authentication
EsrpClientId: '142047f4-eda8-4853-8776-c2e81803ea13' # ESRP Client Id, the Old App Registration Id to which we mapped our Managed Identity Id to
EsrpAuthAKVName: 'tunnels-ppe-esrp-kv' # Key Vault name where the signing certificate is stored
EsrpAuthSignCertName: 'esrp-sign' # Code signing certificate name in the Key Vault
Expand Down
Loading