Azure-cli: AKV10032: Invalid issuer error for listing of key vault secrets from nondefault tenant subscription

[t3mi]

Describe the bug

Command Name
az keyvault secret list

Errors:

AKV10032: Invalid issuer. Expected one of https://sts.windows.net/<nondefault tenant>/, found https://sts.windows.net/<default tenant>/.

To Reproduce:

Steps to reproduce the behavior.

• az login // login with one tenant
• az login // login with second tenant
• az account list // verify multiple subscriptions exist with different tenants
• az keyvault secret list --subscription <subscription from nondefault tenant> --vault-name {} --query '[].id'

Expected Behavior

Secret ids are printed.

Environment Summary

Windows-10-10.0.18362-SP0
Python 3.6.6
Shell: powershell.exe

azure-cli 2.0.80

Additional Context

• az account list

[
  {
    "cloudName": "AzureCloud",
    "id": "<default subscription>",
    "isDefault": true,
    "name": "Visual Studio Enterprise with MSDN",
    "state": "Enabled",
    "tenantId": "<default tenant>",
    "user": {
      "name": "<email>",
      "type": "user"
    }
  },
  {
    "cloudName": "AzureCloud",
    "id": "<subscription from nondefault tenant>",
    "isDefault": false,
    "name": "Visual Studio Enterprise",
    "state": "Enabled",
    "tenantId": "<nondefault tenant>",
    "user": {
      "name": "<email>",
      "type": "user"
    }
  }
]

[jsntcy]

@bim-msft, please help take a look, thanks.

[t3mi]

Any updates on this?

[bim-msft]

@t3mi This is a cross-tenants issue, I believe it's similar with #7607 , the parameter --subscription seems broken now as we are facing some complicated cross-tenants problems, please avoid using this parameter as a workaround. For more info, please refer to: #7902

[jjnwu]

Our deployment is blocked due to the same error code

2020-03-12T19:23:08.4378500Z Operation Info:
2020-03-12T19:23:08.4386094Z Start Time: 03/12/2020 19:22:40
2020-03-12T19:23:08.4392880Z End Time: 03/12/2020 19:22:40
2020-03-12T19:23:08.4439932Z Error Reason: Error in 'payloadProperties' for extension 'Microsoft.Azure.Portal.HostingService/DeployPortalExtension'. Error Message: Rollout action failed. Please check the help link for more information.
2020-03-12T19:23:08.4442589Z AKV10032: Invalid issuer. Expected one of ....

[yungezz]

the scenario in keyvault requires global --subscription works well for cross-tenant scenarios firstly.

[t3mi]

@yungezz please mark this as a bug There is a key and it's not working properly, it's not a feature request.

[bendubuisson]

I have experienced the same bug with secret set with the subscription flag

[bendubuisson]

That being said, if you set the sub as default just before, it works, so:

az account set --subscription {SubID}
az keyvault secret list --vault-name myVault

[juniwang]

az keyvault storage list --vault-name <Vault Name> doesn't work. Neither with --subscription <sub> nor without --subscription works.

Azure cli version: 2.0.75

[dosani]

@t3mi This is a cross-tenants issue, I believe it's similar with #7607 , the parameter --subscription seems broken now as we are facing some complicated cross-tenants problems, please avoid using this parameter as a workaround. For more info, please refer to: #7902

any update? we are also running into this issue while attempting cross tenant key access. tried both with and without subscription parameter.

[MikePennington]

I am receiving this error even on the _default_ subscription.

az account show
{
  "environmentName": "AzureCloud",
  "homeTenantId": "REDACTED",
  "id": "REDACTED",
  "isDefault": true,
  "managedByTenants": [
    {
      "tenantId": "REDACTED"
    }
  ],
  "name": "Enterprise Dev/Test",
  "state": "Enabled",
  "tenantId": "REDACTED",
  "user": {
    "name": "REDACTED",
    "type": "user"
  }
}

az keyvault secret list --vault-name keyvault-test
AKV10032: Invalid issuer. Expected one of https://sts.windows.net/ab8cb611-0add-432b-9975-ae87e1ebe6f7/, https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/, https://sts.windows.net/e2d54eb5-3869-4f70-8578-dee5fc7331f4/, found https://sts.windows.net/71fdf23f-162c-4ca1-a83b-7a68e8b5ea85/.

The keyvault-test keyvault is in the default subscription listed above. I am certain that this used to work.

az version
{
  "azure-cli": "2.11.1",
  "azure-cli-core": "2.11.1",
  "azure-cli-telemetry": "1.0.5",
  "extensions": {}
}

[c0dezer019]

The day a bug becomes a feature request. (I can confirm this bug, it is still on-going)