[BUG] az appconfig kv list fails because of unsupported token audience

Abierto
  • ¿Algo no está bien?
#649 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
22/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
azure, shell
Área
authentication, cloud

Línea de trabajo

The payload names no file, test or entry point in this repository; the rejection comes from the Cloud Shell MSI token audience check, which the payload does not show. Reproduce with az account get-access-token --resource https://appconfig.azure.com in Cloud Shell, then compare with the https://azconfig.io audience that succeeds. Done means the audience question is answered or the fix is located, and this is likely a service-side change rather than a contribution here.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug Triage-needed

To Reproduce

In Cloud Shell, use PowerShell with the default sign-in and run:

$ENDPOINT = "https://<store-name>.azconfig.io/"
az appconfig kv list --endpoint $ENDPOINT --auth-mode login

Reading key-values from the same store works in my local Windows CLI.

Image Image

Observed Behavior

Cloud Shell returns error:

A Cloud Shell credential problem occurred. When you report the issue with the error below, please mention the hostname 'SandboxHost-639274817947608900'
Audience https://zhiyuanliang-free.azconfig.io/ is not a supported MSI token audience.
Run the command below to authenticate interactively; additional arguments may be added as needed:
az logout
az login --scope "https://zhiyuanliang-free.azconfig.io//.default"

Expected behavior

The command should list key-values using Cloud Shell’s default sign-in.

Is this specific to Cloud Shell?

Yes. Both Cloud Shell and my local Windows CLI use Azure CLI 2.90.0.

I checked that both sessions use the same account, tenant, subscription, and App Configuration store. The operation succeeds locally but fails in Cloud Shell.

Interface information

https://portal.azure.com
browser

Additional context

This looks related to #477

App Configuration now documents https://appconfig.azure.com as its public-cloud audience. The older shared audience is https://azconfig.io (which was mentioned in #477). The [Azure python SDK 1.8.0 or later](https://github.com/Azure/azure-sdk-for-python/blob/azure-appconfiguration_1.8.0/sdk/appconfiguration/azure-appconfiguration/CHANGELOG.md) uses https://appconfig.azure.com by default in public Azure. The Azure CLI is built on Azure python SDK

PS /home/zhiyuan> az account get-access-token --resource "https://appconfig.azure.com" --query "{tokenType:tokenType,expiresOn:expiresOn}" --output json
A Cloud Shell credential problem occurred. When you report the issue with the error below, please mention the hostname 'SandboxHost-639274922403092917'
Audience https://appconfig.azure.com is not a supported MSI token audience.
Run the command below to authenticate interactively; additional arguments may be added as needed:
az logout
az login --scope "https://appconfig.azure.com/.default"
PS /home/zhiyuan> az account get-access-token --resource "https://azconfig.io" --query "{tokenType:tokenType,expiresOn:expiresOn}" --output json        
{
  "expiresOn": "2026-10-13 15:46:29.000000",
  "tokenType": "Bearer"
}
PS /home/zhiyuan>
Lenguaje dominante
PowerShell
Estrellas
273
Forks
116
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Azure/CloudShell

Todos los issues de Azure/CloudShell

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.