azure-cli: AKV10032: Invalid issuer error for listing of key vault secrets from nondefault tenant subscription

A solution I’ve found for both Core/Classic .NET frameworks was to set an AZURE_TENANT_ID env var or set the value via credential options:

var o = new DefaultAzureCredentialOptions();
o.VisualStudioTenantId = preConfig["AzureTenantId"];
configurationBuilder.AddAzureKeyVault(new Uri(preConfig["KeyVaultName"]), new DefaultAzureCredential(o));

.NET Classic MicrosoftConfigurationBuilders don’t seem to accept options, though. https://github.com/aspnet/MicrosoftConfigurationBuilders/blob/main/src/Azure/AzureKeyVaultConfigBuilder.cs#L93 Env var was the only option that worked…

I have the same issue, it works when i use the sdk3

var azureServiceTokenProvider = new AzureServiceTokenProvider();
                       var keyVaultClient = new KeyVaultClient(
                           new KeyVaultClient.AuthenticationCallback(
                               azureServiceTokenProvider.KeyVaultTokenCallback));
                       builder.AddAzureKeyVault(
                           keyVaultEndpoint, keyVaultClient, new DefaultKeyVaultSecretManager());

But this one doesn’t work : client = new SecretClient(new Uri(kvUri), new DefaultAzureCredential());

@yungezz please mark this as a bug There is a key and it’s not working properly, it’s not a feature request.

I am receiving this error even on the default subscription.

az account show
{
  "environmentName": "AzureCloud",
  "homeTenantId": "REDACTED",
  "id": "REDACTED",
  "isDefault": true,
  "managedByTenants": [
    {
      "tenantId": "REDACTED"
    }
  ],
  "name": "Enterprise Dev/Test",
  "state": "Enabled",
  "tenantId": "REDACTED",
  "user": {
    "name": "REDACTED",
    "type": "user"
  }
}

az keyvault secret list --vault-name keyvault-test
AKV10032: Invalid issuer. Expected one of https://sts.windows.net/ab8cb611-0add-432b-9975-ae87e1ebe6f7/, https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/, https://sts.windows.net/e2d54eb5-3869-4f70-8578-dee5fc7331f4/, found https://sts.windows.net/71fdf23f-162c-4ca1-a83b-7a68e8b5ea85/.

The keyvault-test keyvault is in the default subscription listed above. I am certain that this used to work.

az version
{
  "azure-cli": "2.11.1",
  "azure-cli-core": "2.11.1",
  "azure-cli-telemetry": "1.0.5",
  "extensions": {}
}

That being said, if you set the sub as default just before, it works, so:

az account set --subscription {SubID}
az keyvault secret list --vault-name myVault

I don’t get this error in powershell with AZ CLI (e.g. listing the secrets from the keyvault). I get this error running code from Visual Studio: .AddAzureKeyVault(keyVaultUri, new DefaultAzureCredential(true)) (browser window popping up) and the same error with: .AddAzureKeyVault(keyVaultUri, new SharedTokenCacheCredential("my.email@company.com"))

I have logged in and out in VS (2019), the Azure Service Authentication under Tools > Options looks good

It’s working when using the old nuget (Microsoft.Extensions.Configuration.AzureKeyVault 3.1.14) - without supplying any credentials.

Maybe I should add that I have multiple accounts on Azure Portal, but only logged in to the one referred to above I also have multiple subscriptions

az keyvault storage list --vault-name <Vault Name> doesn’t work. Neither with --subscription <sub> nor without --subscription works.

Azure cli version: 2.0.75

For the people running into this even when the subscription ID is set correctly, you should check the --vault-name for typos. You may be trying to talk to the wrong Key Vault (that’s what happened in my case).

The day a bug becomes a feature request. (I can confirm this bug, it is still on-going)

Can confirm this also happens with InteractiveBrowserCredential. Trying to access a keyvault with my work account which is permitted in azure to access the keyvault. Pretty sure the keyvault I am trying to access resides in a non-default azure subscription.

Our deployment is blocked due to the same error code

2020-03-12T19:23:08.4378500Z Operation Info: 2020-03-12T19:23:08.4386094Z Start Time: 03/12/2020 19:22:40 2020-03-12T19:23:08.4392880Z End Time: 03/12/2020 19:22:40 2020-03-12T19:23:08.4439932Z Error Reason: Error in ‘payloadProperties’ for extension ‘Microsoft.Azure.Portal.HostingService/DeployPortalExtension’. Error Message: Rollout action failed. Please check the help link for more information. 2020-03-12T19:23:08.4442589Z AKV10032: Invalid issuer. Expected one of …

@t3mi This is a cross-tenants issue, I believe it’s similar with #7607 , the parameter --subscription seems broken now as we are facing some complicated cross-tenants problems, please avoid using this parameter as a workaround. For more info, please refer to: #7902