DEVOPS-1901 Fix error: az login again to refresh permissions #4050

urbinaalex17 · 2024-05-03T17:51:58Z

Type of change

- [X] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Split the remove docker images steps per registry since that's what causing the issue:

WARNING: Unable to get AAD authorization tokens with message: 2024-03-22 14:54:44.177986 An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry 'bitwardenqa.azurecr.io' was denied. Response code: 403. Please try running 'az login' again to refresh permissions.

Code changes

.github/workflows/cleanup-after-pr.yml: Separate the removal of docker images per registry instead of using a list of registries.

Before you submit

Please check for formatting errors (dotnet format --verify-no-changes) (required)
If making database changes - make sure you also update Entity Framework queries and/or migrations
Please add unit tests where it makes sense to do so (encouraged but not required)
If this change requires a documentation update - notify the documentation team
If this change has particular deployment requirements - notify the DevOps team

codecov · 2024-05-03T18:01:15Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 38.79%. Comparing base (2a535ac) to head (d1089d4).
Report is 9 commits behind head on main.

❗ Current head d1089d4 differs from pull request most recent head 355e6d8. Consider uploading reports for the commit 355e6d8 to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4050   +/-   ##
=======================================
  Coverage   38.79%   38.79%           
=======================================
  Files        1216     1216           
  Lines       59175    59175           
  Branches     5648     5648           
=======================================
  Hits        22955    22955           
- Misses      35162    35163    +1     
+ Partials     1058     1057    -1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2024-05-03T18:30:36Z

Checkmarx One – Scan Summary & Details – 98a5966d-7048-4672-9b45-027a08aa3f4b

New Issues

Issue	Source File / Package	Checkmarx Insight
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 955	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 937	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 655	Attack Vector
Privacy_Violation	/src/Api/Auth/Controllers/AccountsController.cs: 518	Attack Vector
Log_Forging	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 82	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 929	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 947	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 510	Attack Vector
Log_Forging	/src/Api/Auth/Controllers/AccountsController.cs: 647	Attack Vector

Fixed Issues

Severity	Issue	Source File / Package
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 587
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 132
	CSRF	/src/Api/AdminConsole/Controllers/ProvidersController.cs: 141
	CSRF	/src/Api/SecretsManager/Controllers/AccessPoliciesController.cs: 229
	CSRF	/src/Admin/AdminConsole/Controllers/ProvidersController.cs: 309
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/Billing/Controllers/ProviderClientsController.cs: 30
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 190
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 331
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 331
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 710
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 686
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 891
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 173
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 752
	CSRF	/src/Api/Vault/Controllers/FoldersController.cs: 45
	CSRF	/src/Api/Controllers/SelfHosted/SelfHostedOrganizationLicensesController.cs: 51
	CSRF	/src/Api/Controllers/UsersController.cs: 22
	CSRF	/src/Api/Controllers/DevicesController.cs: 70
	CSRF	/src/Api/Controllers/DevicesController.cs: 57
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 69
	CSRF	/src/Api/AdminConsole/Public/Controllers/PoliciesController.cs: 49
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 92
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 49
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 142
	CSRF	/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs: 52
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 148
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 78
	CSRF	/src/Api/AdminConsole/Controllers/PoliciesController.cs: 61
	CSRF	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 163
	CSRF	/bitwarden_license/src/Sso/Controllers/AccountController.cs: 96
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs: 50
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 161
	CSRF	/src/Api/Auth/Controllers/EmergencyAccessController.cs: 159
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 98
	CSRF	/bitwarden_license/src/Scim/Controllers/v2/GroupsController.cs: 88
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 222
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 222
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 288
	CSRF	/src/Api/Controllers/SettingsController.cs: 36
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/Controllers/CollectionsController.cs: 411
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 193
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 362
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 766
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1100
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 244
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 571
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 284
	CSRF	/src/Api/Controllers/CollectionsController.cs: 303
	CSRF	/src/Admin/AdminConsole/Controllers/OrganizationsController.cs: 308
	CSRF	/src/Admin/AdminConsole/Controllers/ProvidersController.cs: 232
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 81
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 118
	CSRF	/src/Identity/Controllers/AccountsController.cs: 72
	CSRF	/src/Identity/Controllers/AccountsController.cs: 50
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 230
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 331
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 942
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 125
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 86
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 216
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 111
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 298
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 316
	CSRF	/src/Api/Tools/Controllers/ImportCiphersController.cs: 66
	CSRF	/src/Api/Tools/Controllers/ImportCiphersController.cs: 50
	CSRF	/src/Api/Public/Controllers/CollectionsController.cs: 64
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 408
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 550
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 607
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 159
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 299
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 586
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 433
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 222
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 702
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 967
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1023
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1023
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 563
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 563
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationsController.cs: 590
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 908
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 193
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/AdminConsole/Public/Controllers/OrganizationController.cs: 42
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 313
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 244
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 174
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 187
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 257
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 284
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 447
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 613
	CSRF	/src/Api/Controllers/CollectionsController.cs: 303
	CSRF	/src/Api/Controllers/CollectionsController.cs: 411
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 791
	CSRF	/src/Api/Controllers/CollectionsController.cs: 323
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 144
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 878
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 805
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1046
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1046
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 815
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 550
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 274
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 150
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 150
	CSRF	/src/Api/AdminConsole/Public/Controllers/GroupsController.cs: 133
	CSRF	/src/Api/Auth/Controllers/TwoFactorController.cs: 403
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 175
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 911
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 728
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1080
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 997
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 997
	CSRF	/src/Api/AdminConsole/Controllers/ProviderUsersController.cs: 188
	CSRF	/src/Api/Controllers/CollectionsController.cs: 196
	CSRF	/src/Api/Controllers/CollectionsController.cs: 187
	CSRF	/src/Api/Controllers/CollectionsController.cs: 156
	CSRF	/src/Api/Auth/Controllers/AccountsController.cs: 560
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 59
	CSRF	/src/Api/AdminConsole/Public/Controllers/MembersController.cs: 127
	CSRF	/src/Admin/AdminConsole/Controllers/ProviderOrganizationsController.cs: 39
	CSRF	/src/Api/Auth/Controllers/WebAuthnController.cs: 101
	CSRF	/src/Api/Auth/Controllers/WebAuthnController.cs: 130
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 659
	CSRF	/src/Api/Vault/Controllers/CiphersController.cs: 1100
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 117
	CSRF	/src/Api/AdminConsole/Controllers/GroupsController.cs: 93
	CSRF	/src/Api/Controllers/CollectionsController.cs: 375

More results are available on AST platform

mimartin12

Some of the fixes include references to a container registry that just isn't used, as shown in the build workflows. We don't need it and can remove.

.github/workflows/cleanup-after-pr.yml

urbinaalex17 · 2024-05-03T19:47:44Z

@mimartin12 , is the qa registry the one that we are not using?

mimartin12 · 2024-05-03T19:50:33Z

@mimartin12 , is the qa registry the one that we are not using?

Yes, the build workflow only pushes to prod.

server/.github/workflows/build.yml

Lines 13 to 14 in 5a5e5c5

 env: 

 _AZ_REGISTRY: "bitwardenprod.azurecr.io"

…r.yml

…ask/DEVOPS-1901

…r.yml

.github/workflows/cleanup-after-pr.yml

Co-authored-by: MtnBurrit0 <[email protected]>

DEVOPS-1901 REFACTOR: Remove the Docker image per registry

a6860be

urbinaalex17 self-assigned this May 3, 2024

urbinaalex17 requested a review from a team as a code owner May 3, 2024 17:51

urbinaalex17 changed the title ~~DEVOPS-1901 Fix az login' again to refresh permissions for multiple registries~~ DEVOPS-1901 Fix az login again to refresh permissions for multiple registries May 3, 2024

urbinaalex17 changed the title ~~DEVOPS-1901 Fix az login again to refresh permissions for multiple registries~~ DEVOPS-1901 Fix error: az login again to refresh permissions for multiple registries May 3, 2024

urbinaalex17 changed the title ~~DEVOPS-1901 Fix error: az login again to refresh permissions for multiple registries~~ DEVOPS-1901 Fix error: az login again to refresh permissions May 3, 2024

mimartin12 requested changes May 3, 2024

View reviewed changes

.github/workflows/cleanup-after-pr.yml Outdated Show resolved Hide resolved

.github/workflows/cleanup-after-pr.yml Outdated Show resolved Hide resolved

urbinaalex17 and others added 2 commits May 3, 2024 16:37

DEVOPS-1901 REFACTOR: Docker image removal process in cleanup-after-p…

b6bae5c

…r.yml

Merge branch 'main' into task/DEVOPS-1901

3815265

urbinaalex17 requested a review from mimartin12 May 3, 2024 22:38

urbinaalex17 enabled auto-merge (squash) May 3, 2024 22:38

urbinaalex17 and others added 4 commits May 3, 2024 16:39

DEVOPS-1901 REFACTOR: Docker image removal process in cleanup-after-p…

434ef28

…r.yml

Merge branch 'task/DEVOPS-1901' of github.com:bitwarden/server into t…

d4e29ee

…ask/DEVOPS-1901

DEVOPS-1901 REFACTOR: Docker image removal process in cleanup-after-p…

5301c4a

…r.yml

Merge branch 'main' into task/DEVOPS-1901

d1089d4

mimartin12 requested changes May 7, 2024

View reviewed changes

.github/workflows/cleanup-after-pr.yml Outdated Show resolved Hide resolved

Update .github/workflows/cleanup-after-pr.yml

355e6d8

Co-authored-by: MtnBurrit0 <[email protected]>

urbinaalex17 requested a review from mimartin12 May 7, 2024 19:15

mimartin12 approved these changes May 7, 2024

View reviewed changes

urbinaalex17 merged commit 1ede40d into main May 7, 2024
26 checks passed

urbinaalex17 deleted the task/DEVOPS-1901 branch May 7, 2024 19:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DEVOPS-1901 Fix error: az login again to refresh permissions #4050

DEVOPS-1901 Fix error: az login again to refresh permissions #4050

urbinaalex17 commented May 3, 2024

codecov bot commented May 3, 2024 •

edited

github-actions bot commented May 3, 2024 •

edited

mimartin12 left a comment

urbinaalex17 commented May 3, 2024

mimartin12 commented May 3, 2024

DEVOPS-1901 Fix error: az login again to refresh permissions #4050

DEVOPS-1901 Fix error: az login again to refresh permissions #4050

Conversation

urbinaalex17 commented May 3, 2024

Type of change

Objective

Code changes

Before you submit

codecov bot commented May 3, 2024 • edited

Codecov Report

github-actions bot commented May 3, 2024 • edited

New Issues

Fixed Issues

mimartin12 left a comment

Choose a reason for hiding this comment

urbinaalex17 commented May 3, 2024

mimartin12 commented May 3, 2024

codecov bot commented May 3, 2024 •

edited

github-actions bot commented May 3, 2024 •

edited