ERROR: OIDC ADO - Could not find access token, check if the environment variable 'SYSTEM_ACCESSTOKEN' exists and has valid data.

[arrerezai]

Hi,

I am experiencing this error message occasionally.
Mostly, the pipeline works fine and finishes in a success, but every now and then, I face this issue.
The AzGovViz scripts are difficult to dig into so if you happen to know how to fix the issue, please let me know.

[kaiaschulz]

Hi Arash Rezai (@arrerezai),
you need to define the variable the SYSTEM_ACCESSTOKEN environment variable as described here: https://github.com/JulianHayward/AzAPICall?tab=readme-ov-file#azure-devops

As well, we tried to explain the problem within the error message itself and referred to the Microsoft related documentation which is also within the error message: https://learn.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=yaml#systemaccesstoken

I think this information is as well needed in the README to be related product which rely on the AzAPICall-module like this and the AzADServicePrincipalInsights.

[arrerezai]

Hi kaiaschulz ,
Thanks for the answer. However, isn't that what is already done here:
https://github.com/Azure/Azure-Governance-Visualizer/blob/master/.azuredevops/pipelines/AzGovViz.pipeline.yml#L106
From what I can tell, that line is already there for that particular reason, which despite being proposed as a solution, doesn't fix the problem at hand. Or maybe I am getting it wrong?
The strange thing about this error message is that it is coming occasionally (i.e. not all the time). Attached is an image of the runs from the last few days:

Any other ideas?

Also, do not ask me why there are four runs indicating they were all run on the 14th and none from the 15th while in reality, there were two each day, just as it is supposed to be according to the cronjob of every 12th hour.

[kaiaschulz]

Hey Arash Rezai (@arrerezai) ,
I saw some similar behaviors in my pipelines that parallel pipelines builds where running on the same commit. Not sure were this is coming from.

The error occurs if the related action of an token will be handled after the token expired (10 minutes lifetime) and need a new token.
It could be that some of the actions within the runs are before the expiration time other shortly after.

The SYSTEM_ACCESSTOKEN will be defined for the PowerShell@2-task but I am not sure if it then can be used in AzurePowerShell@5.
Regarding to this, I would recommend to add as well the SYSTEM_ACCESSTOKEN to your AzurePowerShell@5-task.

[arrerezai]

Hi kaiaschulz ,
It so turns out we managed to find out what is actually causing the problem.
You are totally right when stating that the expiration time of the token is 10 minutes.
However, here is where the interesting part comes in:

System.Accesstoken is a PAT token generated for the service identity “Project Collection Build Service (account)”. This token is valid for 48 hours. However if you have mentioned a job timeout, then its valid for jobTimeout + JobcancellationTimeout + 5 minutes of grace period for any system delays.
Source: What is the scope of the token in $(System.AccessToken) in Azure DevOps pipelines

Since we've got:
jobTimeout = timeoutInMinutes = 0 in AzGovViz.pipeline.yml ("When 0 is specified, the maximum limit is used")
JobcancellationTimeout = cancelTimeoutInMinutes = not set in code = 5 ("When not specified, the default is 5 minutes.")
Then doing the math leads to 0 + 5 + 5 = 10 minutes
Review: Specify jobs in your pipeline - Timeouts

Therefore, we rather need to define the jobTimeout, i.e. the timeoutInMinutes to something greater than 0 for the total calculation of the token validity not dying on us. I changed it to 120 in my own repo and stress tested it, and I can verify it is working as expected now :-)