Get-AzureRmSubscription repeats subscription per tenantid when using AccessToken connection #6521
Comments
|
FYI for anyone that can't wait for the resolution to this, the workaround is:
Also this issue somehow breaks |
|
After debugging the code, the key issue here is that there are multiple places that the code iterates the list of Tenants that the user has access to and re-uses a single Access Token to call the management API for each of the tenants. Which results in repeated values for each tenant. Access Tokens are inherently Tenant Specific -- If you login using an Access Token, the code should only use the TenantId associated with that Access Token (either through a required parameter, or embedded in the Access Token JWT tid claim) |
|
@tylerd |
|
The TenantId GUID for "microsoft.onmicrosoft.com" |
|
|
|
Where are you using Also, it looks like you were able to run |
$token = Get-ADALAccessToken -AuthorityName $authorityName -ClientId $clientId -ResourceId $azEnv.ActiveDirectoryServiceEndpointResourceId -RedirectUri $redirectUri |
|
Ok … that does not really address the issue of the Access Token being re-used for Tenants other than the one generating the token. |
|
Sorry, clicked the wrong button and closed. |
|
Did you try Clear-AzureRmContext -Scope CurrentUser? |
|
Yes |
|
@tylerd |
|
Just realized. This causes an issue in the Cloud Shell also. |
|
A PR has been opened #6621 |
|
So, I think the root cause here was a clash in keys in the context #6489, which is slated for a fix in this release. When this is fixed, we will ensure that this particular scenario is covered. |
|
I will send a full debug output tomorrow but I did verify this bug still exists on cloud shell. I could verify it on my Android phone ??
Simply by opening Cloud PowerShell Shell and executing Get-AzureRMSubscription
Keep in mind this is an issue when the AAD user exists in multiple AAD Directories (using AAD B2B)
|
|
Debug Output using AzureRM 6.5.0 |
|
Linking the relevant PR here: #6621. Once we are finished with the NetStandard conversion we will revisit this issue and assign it to a milestone. |
|
Tested release 6.8.1 -- no longer an issue |
Description
Executing
Get-AzureRmSubscriptionresults in repeat subscriptions per Tenant.Interestingly, the Subscriptions listed are only under the Microsoft Tenant. There are other subscriptions under the other Tenants that are not listed (even though the TenantIds are listed)
Script/Steps for Reproduction
Generate Access Token to access Azure Management API.
Get all Subscriptions
Module Version
Environment Data
Debug Output
Full Debug Output Attached:
debugoutput.txt
The text was updated successfully, but these errors were encountered: