ERROR: AADSTS700024: Client assertion is not within its valid time range

[krukowskid]

Hi! I am facing a similar issue (#180) that appears to have been resolved, but I'm still encountering this problem when executing dotnet tests in GitHub Runner.

Azure.Identity.CredentialUnavailableException : DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot
...
- Azure CLI authentication failed due to an unknown error. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/azclicredential/troubleshoot ERROR: AADSTS700024: Client assertion is not within its valid time range. Current time: 2023-10-31T11:53:04.4424859Z, assertion valid from 2023-10-31T11:39:49.0000000Z, expiry time of assertion 2023-10-31T11:44:49.0000000Z. Review the documentation at https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials . Trace ID: d64c537e-1d94-4274-9012-c0d7590f1c00 Correlation ID: 5c769bb7-e85a-4557-ba28-92f8eca1c4ff Timestamp: 2023-10-31 11:53:04Z
	Interactive authentication is needed. Please run:
	az login

I'm using action version 1.4.6 and azure.identity package version 1.10.4 + DefaultAzureCredential(). The issue doesn't occur on integration tests where nearly all of them utilize tokens. However, if I run API/UI tests where I employ identity in one or two tests, it fails with above error. Do you have any suggestions or workarounds?

[YanaXu]

Hi @krukowskid , could you provide the workflow file, run it again with debug mode, and provide the debug log?

[benjamin-rousseau-shift]

same issue here this is a real pain. The token are only valid for 5 minutes, and if you don't use it until very far in your workflow, then it just throw the error shown by OP

I tried azure/login@1.5.0 same issue. I'm not using any other way to login into azure.

[YanaXu]

same issue here this is a real pain. The token are only valid for 5 minutes, and if you don't use it until very far in your workflow, then it just throw the error shown by OP

I tried azure/login@1.5.0 same issue. I'm not using any other way to login into azure.

Hi @benjamin-rousseau-shift could you provide your workflow file and debug log? Do you also use OIDC login? OIDC login with SP should have an expiration of 1 hour and OIDC with User-assigned managed identity should have 24 hours.

[benjamin-rousseau-shift]

I will try to give you that , I am using OIDC with a service principal using federated credentials.

[krukowskid]

@YanaXu

here is my workflow definition (its reusable workflow). I have also enabled debug but it doesnt make sense to paste it here because it's so noisy. Workflow is failing in 🧪 Run tests for specified filter and rerun failed step. I will provide debug logs, just let me know which part/step you are interested in

reusable workflow definition

name: 'reusable/run-tests'
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string

      system-under-test:
        required: false
        type: string
        default: xwow

      test-configuration:
        required: true
        type: string

      tests-filter:
        description: 'Filter for selecting tests to run'
        required: true
        type: string

      tests-web-url:
        required: false
        type: string

      tests-apigateway-url:
        required: false
        type: string

      report-name:
        description: 'Name for execution report and attachments'
        required: false
        default: Default
        type: string

      allure-reports:
        required: false
        default: false
        type: boolean

      allure-project-id:
        required: false
        type: string

    secrets:
      KrukowskidBotAppId:
        required: false
      KrukowskidBotPrivateKey:
        required: false
      ad-username:
        required: false
      ad-password:
        required: false
      azure-client-id:
        required: false
      azure-tenant-id:
        required: false
      azure-subscription-id:
        required: false
      identity-url:
        required: false
      identity-client-id:
        required: false
      backoffice-identity-url:
        required: false
      backoffice-client-id:
        required: false
      backoffice-client-secret:
        required: false      
      backoffice-identity-scope:
        required: false
      allure-server-password:
        required: false

permissions:
  id-token: write
  contents: write
  actions: read
  checks: write

jobs:
  run-tests:
    name: run-tests
    environment: ${{ inputs.environment }}
    runs-on:
      labels: ubuntu-latest-8core32ram
    timeout-minutes: 20
    env:
      E2E-ENVIRONMENT: ${{ inputs.test-configuration }}
      E2E-SUT: ${{ inputs.system-under-test }}
      ALLURE_SERVER_URL: ${{ vars.ALLURE_SERVER_URL }}
      ALLURE_SERVER_USER: ${{ vars.ALLURE_SERVER_USER }}
      ALLURE_SERVER_PASSWORD: ${{ secrets.allure-server-password }}
    defaults:
      run:
        shell: pwsh
    steps:
    - name: Generate token
      if: ${{ github.repository != 'Krukowskid/Krukowskid.Tests' }}
      id: generate_token
      uses: tibdex/github-app-token@v1
      with:
        app_id: ${{ secrets.KrukowskidBotAppId }}
        private_key: ${{ secrets.KrukowskidBotPrivateKey }}

    - name: Checkout Tests
      if: ${{ github.repository != 'Krukowskid/Krukowskid.Tests' }}
      uses: actions/checkout@v3
      with:
        repository: Krukowskid/Krukowskid.Tests
        token: "${{ steps.generate_token.outputs.token }}"
        ref: main
        
    - name: Checkout Tests
      if: ${{ github.repository == 'Krukowskid/Krukowskid.Tests' }}
      uses: actions/checkout@v3
        
    - name: Azure login
      uses: Azure/login@v1.4.6
      with:
        client-id: ${{ secrets.azure-client-id }}
        tenant-id: ${{ secrets.azure-tenant-id }}
        subscription-id: ${{ secrets.azure-subscription-id }}

    - name: Setup .NET
      uses: actions/setup-dotnet@v3
      with:
        dotnet-version: 7.0.x

    - name: Check Other Chrome Version
      run: /usr/bin/google-chrome --version
    
    - name: Restore dependencies
      run: dotnet restore src

    - name: List Config Files
      run: ls src/Krukowskid.Tests.Common/Krukowskid.Tests.Common.Configuration

    - name: Add TestResults dir
      run: | 
        mkdir src/TestAutomation
        mkdir src/TestAutomation/TestResults
        mkdir src/TestAutomation/TestResults/AllureReports
      
    - name: 🦿 Override WebUrl
      if: ${{ inputs.tests-web-url != '' }}
      shell: bash --noprofile --norc {0}
      run: |
        echo "Setting E2E_TESTS__WEB__URL env var to ${{ inputs.tests-web-url }}"
        echo "E2E_TESTS__WEB__URL=${{ inputs.tests-web-url }}" >> $GITHUB_ENV
    
    - name: 🦿 Override ApiGatewayUrl
      if: ${{ inputs.tests-apigateway-url != '' }}
      shell: bash --noprofile --norc {0}
      run: |
        echo "Setting E2E_TESTS__APIGATEWAY__URL env var to ${{ inputs.tests-apigateway-url }}"
        echo "E2E_TESTS__APIGATEWAY__URL=${{ inputs.tests-apigateway-url }}" >> $GITHUB_ENV

    - name: 🏗 Build
      run: dotnet build src --no-restore

    - name: List Files
      run: |
        ls src -lR > src/TestAutomation/TestResults/post-build-files.txt
        ls ${{ github.workspace }}
        
    - name: 🦾 Install browser for Playwright tests
      shell: pwsh
      run: src/Krukowskid.Tests.UI/Krukowskid.Tests.UI.x/bin/Debug/net7.0/playwright.ps1 install --with-deps chromium
    
    - name: 🧪 Run tests for specified filter and rerun failed
      shell: bash --noprofile --norc {0}
      env:
        LC_ALL: en_US.utf8
      run: |
        counter=1
        exitcode=0
        reset="\e[0m"
        warn="\e[0;33m"
        green="\e[0;92m"
        blue="\e[0;94m"
        while [ $counter -lt 4 ]
        do
            if [ $filter ]
            then
                echo -e "${warn}Run number: $counter. Re-running failed tests filter: $filter ${reset}"
                # run test and forward output also to a file in addition to stdout (tee command)
                cp src/TestAutomation/TestResults/runtestsoutput.log src/TestAutomation/TestResults/runtestsoutput_first.log
                dotnet test src --no-build --filter=$filter --verbosity minimal --logger trx --results-directory src/TestAutomation/TestResults --settings:src/Krukowskid.Tests.Common/Krukowskid.Tests.Common.Configuration/cicd.runsettings | tee src/TestAutomation/TestResults/runtestsoutput.log
            else
                echo -e "${blue}First run. Running tests with filter "${{ inputs.tests-filter }}" ${reset}"
                dotnet test src --no-build --filter "${{ inputs.tests-filter }}" --verbosity minimal --logger trx --results-directory src/TestAutomation/TestResults --settings:src/Krukowskid.Tests.Common/Krukowskid.Tests.Common.Configuration/cicd.runsettings | tee src/TestAutomation/TestResults/runtestsoutput.log
            fi
            # capture dotnet test exit status, different from tee
            exitcode=${PIPESTATUS[0]}
            if [ $exitcode == 0 ]
            then
                echo -e "${green}Running tests succeeded after $counter attempts.${reset}"
                exit 0
            fi
            filter=$(cat src/TestAutomation/TestResults/runtestsoutput.log | grep -o -P '(?<=\sFailed\s)\w*'| grep -v -x 'Krukowskid' | awk 'BEGIN { ORS="|" } { print("Name=" $0) }' | grep -o -P '.*(?=\|$)')
            ((counter++))
        done
        exit $exitcode

    - name: List Files
      if: always()
      run: ls src -lR > src/TestAutomation/TestResults/post-tests-files.txt
    
    - name: 📈 Generate Github Report
      uses: dorny/test-reporter@v1
      if: always()
      with:
        name: ${{ inputs.report-name }} Test Execution Report
        path: 'src/TestAutomation/TestResults/*.trx'
        reporter: 'dotnet-trx'
        list-suites: 'all'
        fail-on-error: 'false'

    - name: Find Allure Reports
      if:  ${{ always() && inputs.allure-reports == true }} 
      shell: bash
      run: |        
        find src -type d -name "allure-results"        

    - name: Copy Allure Reports
      if:  ${{ always() && inputs.allure-reports == true }} 
      shell: bash
      run: |        
        find src -type d -name "allure-results" -exec cp -r -v {}/. src/TestAutomation/TestResults/AllureReports \;
              
    - name: 📈 Upload Allure Reports
      uses: unickq/send-to-allure-docker-service-action@v1
      if:  ${{ always() && github.ref_name == 'main' && inputs.allure-reports == true }} 
      continue-on-error: true
      with:
        allure_results: src/TestAutomation/TestResults/AllureReports
        project_id: ${{ inputs.allure-project-id }}
        auth: true
        generate: true       

    - name: Upload additional reports
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: ${{ inputs.report-name }}TestReports
        path: |
          src/TestAutomation
          src/**/TestResults
          src/**/bin/**/allureConfig.json
          src/**/bin/**/appSettings.*.json

[YanaXu]

Hi @krukowskid , From the description of this issue, I see the error is thrown from Azure CLI. But in the steps of "reusable workflow definition", I can't tell which step throws the exception. Could you answer these questions for the further analysis?

• This error is thrown from one of the Azure CLI cmd, right?
• Could you provide the screenshot of the workflow run? (an example of the screenshot)
• Is ubuntu-latest-8core32ram a self-hosted runner?
• Do you konw which version of Azure CLI you're using for ubuntu-latest-8core32ram?
• Have your tried the latest Azure CLI version?

[krukowskid]

• This error is thrown from one of the Azure CLI cmd, right?

Its thrown in dotnet tests (🧪 Run tests for specified filter and rerun failed step) that are using DefaultAzureCredential()

• Could you provide the screenshot of the workflow run?

• Is ubuntu-latest-8core32ram a self-hosted runner?

Its github hosted (large) runner., same problem on ubuntu-latest

• Do you konw which version of Azure CLI you're using for ubuntu-latest-8core32ram?

same as on ubuntu-latest

• Have your tried the latest Azure CLI version?

on the day i was creating an issue 1.4.6 was the latest. I will try with 1.5.0

[YanaXu]

@krukowskid,
Azure Login Action works for Azure CLI and Azure PowerShell. But in your workflow file, Run tests for specified filter and rerun failed only call dotnet commands. Do you mean the error is thrown for your c# source code? Have you checked the code if they run the auth independently without Azure CLI？