Scoutsuite: Issue running Scout on an Azure instance in a cross-tenant scenario

[x4v13r64]

When executing Scout on an Azure instances with service principal authentication, when attempting to run it against a separate tenant/subscription, the following error is returned:

python3 Scout.py  --provider azure --azure-service-principal --tenant XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX --client-id xxxxxxxxxx --client-secret xxxxxxxxxxx  --subscription xxxxxxxxxxxxxxxxxxxxxxx 

Fetching Storage Accounts config...
    storage_accounts
Azure Error: InvalidAuthenticationTokenTenant
Message: The access token is from the wrong issuer 'https://sts.windows.net/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/'. It must match the tenant 'https://sts.windows.net/YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.

[tsai0009]

I have the same issue. Have you found a solution?

[x4v13r64]

@tsai0009 there hasn't been further work on this issue as we couldn't reproduce. If you're willing to do so it should be easier to implement a fix.

Could you post full --debug output and/or provide the errors file? If you don't want to post it here you can send it to [email protected].

[tsai0009]

@j4v here is one of the error messages. It reoccurs like 5 times. I am able to get it sort of to work when providing a tenant id but I still get these errors. My guess is that my account is only a 'contributor'

2019-10-31 08:50:08 blah scout[13712] ERROR network.py L41: Failed to retrieve network interfaces: Azure Error: InvalidAuthenticationTokenTenant
Message: The access token is from the wrong issuer 'https://sts.windows.net/blahblah/'. It must match the tenant 'https://sts.windows.net/blahblah/' ass
ociated with this subscription. Please use the authority (URL) 'https://login.windows.net/blahblah' to get the token. Note, if the subscription is transferred to another tenant the
re is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.
Traceback (most recent call last):
  File "C:\Users\tsai\PycharmProjects\Azure-CIS\ScoutSuite\ScoutSuite\providers\azure\facade\network.py", line 41, in get_network_interfaces
    lambda: list(self._client.network_interfaces.list_all())
  File "C:\Users\tsai\PycharmProjects\Azure-CIS\ScoutSuite\ScoutSuite\providers\utils.py", line 24, in run_concurrently
    return await run_function_concurrently(function)
  File "C:\Users\tsai\AppData\Local\Programs\Python\Python37-32\lib\concurrent\futures\thread.py", line 57, in run
    result = self.fn(*self.args, **self.kwargs)
  File "C:\Users\tsai\PycharmProjects\Azure-CIS\ScoutSuite\ScoutSuite\providers\azure\facade\network.py", line 41, in <lambda>
    lambda: list(self._client.network_interfaces.list_all())
  File "C:\Users\tsai\PycharmProjects\Azure-CIS\venv\lib\site-packages\msrest\paging.py", line 143, in __next__
    self.advance_page()
  File "C:\Users\tsai\PycharmProjects\Azure-CIS\venv\lib\site-packages\msrest\paging.py", line 129, in advance_page
    self._response = self._get_next(self.next_link)
  File "C:\Users\tsai\PycharmProjects\Azure-CIS\venv\lib\site-packages\azure\mgmt\network\v2019_09_01\operations\_network_interfaces_operations.py", line 422, in internal_paging
    raise exp
msrestazure.azure_exceptions.CloudError: Azure Error: InvalidAuthenticationTokenTenant
Message: The access token is from the wrong issuer 'https://sts.windows.net/blahblah'. It must match the tenant 'https://sts.windows.net/blahblah/' ass
ociated with this subscription. Please use the authority (URL) 'https://login.windows.net/blahblah' to get the token. Note, if the subscription is transferred to another tenant the
re is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later

[x4v13r64]

@tsai0009 thanks, what's the specific authentication method/parameters that you are using? i.e. is this with a service principal or a user account?

[tsai0009]

@j4v I use --user-account

[the-exodus]

Have you tried using the azure-cli to authenticate, and use the -cli method?

[tsai0009]

@the-exodus on further investigating I need to use --service-principal as I need to evaluate single environments versus a whole user account. The cli method did work however. Now I'm just trying to figure out how to use credentials like client secret that would work with my account.

[x4v13r64]

@tsai0009 I'm a bit confused now... is there / what is the issue?

[the-exodus]

@the-exodus on further investigating I need to use --service-principal as I need to evaluate single environments versus a whole user account. The cli method did work however. Now I'm just trying to figure out how to use credentials like client secret that would work with my account.

You're likely looking for an RBAC client-secret file. Try using the CLI to generate one, az ad sp create-for-rbac --sdk-auth > mycredentials and launch Scout with --azure-file-auth.

@j4v I think this is a matter of misunderstanding the Azure access control models.

[x4v13r64]

Thanks @the-exodus, closing.