fix: SAM certificate provisioning in authentication load

Set SetFromProfile earlier to prevent re-entrancy when Update-CIPPSAMCertificate calls Get-GraphToken. Add logic to provision a missing SAM certificate during authentication initialization, with improved error handling and logging. The weekly token update will retry if provisioning fails.

Author: JohnDuprey

Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1

@@ -26,24 +26,40 @@ function Get-CIPPAuthentication {
                 Set-Item -Path env:$_ -Value (Get-CippKeyVaultSecret -VaultName $keyvaultname -Name $_ -AsPlainText -ErrorAction Stop) -Force
             }
         }
-        # Preload the SAM certificate PFX alongside the other credentials. Non-fatal: the
-        # certificate does not exist until first bootstrap (setup wizard or weekly timer).
+        # Set before certificate handling: Update-CIPPSAMCertificate goes through
+        # Get-GraphToken, which re-enters this function when SetFromProfile is unset
+        $env:SetFromProfile = $true
+
+        # Preload the SAM certificate PFX alongside the other credentials, provisioning it
+        # when it does not exist yet. Non-fatal: auth must succeed even when certificate
+        # handling fails; the weekly token update retries provisioning.
         try {
             if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') {
                 if ($Secret.SAMCertificate) {
                     $env:SAMCertificate = $Secret.SAMCertificate
                 }
             } else {
-                $SAMCertificate = Get-CippKeyVaultSecret -VaultName $keyvaultname -Name 'SAMCertificate' -AsPlainText -ErrorAction Stop
-                if ($SAMCertificate) {
-                    $env:SAMCertificate = $SAMCertificate
+                try {
+                    $SAMCertificate = Get-CippKeyVaultSecret -VaultName $keyvaultname -Name 'SAMCertificate' -AsPlainText -ErrorAction Stop
+                    if ($SAMCertificate) {
+                        $env:SAMCertificate = $SAMCertificate
+                    }
+                } catch {
+                    Write-Information "SAM certificate not found in storage: $($_.Exception.Message)"
                 }
             }
+
+            if (-not $env:SAMCertificate) {
+                # First run on this instance: provision the certificate now.
+                # Set-CIPPSAMCertificate refreshes $env:SAMCertificate on success.
+                Write-Information 'No SAM certificate found, provisioning one now'
+                $CertResult = Update-CIPPSAMCertificate -ErrorAction Stop
+                Write-LogMessage -message "Provisioned SAM certificate during authentication load. Thumbprint: $($CertResult.Thumbprint), storage mode: $($CertResult.StorageMode)" -Sev 'Info' -API 'CIPP Authentication'
+            }
         } catch {
-            Write-Information "SAM certificate not preloaded (not created yet?): $($_.Exception.Message)"
+            Write-LogMessage -message 'Could not preload or provision the SAM certificate. It will be retried by the weekly token update.' -Sev 'Warning' -API 'CIPP Authentication' -LogData (Get-CippException -Exception $_)
         }
 
-        $env:SetFromProfile = $true
         Write-LogMessage -message 'Reloaded authentication data from KeyVault' -Sev 'debug' -API 'CIPP Authentication'
 
         return $true