[BUG] az appconfig kv list fails because of unsupported token audience

Aperta
  • Qualcosa non va?
#649 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
22/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
azure, shell
Ambito
authentication, cloud

Direzione di ricerca

The payload names no file, test or entry point in this repository; the rejection comes from the Cloud Shell MSI token audience check, which the payload does not show. Reproduce with az account get-access-token --resource https://appconfig.azure.com in Cloud Shell, then compare with the https://azconfig.io audience that succeeds. Done means the audience question is answered or the fix is located, and this is likely a service-side change rather than a contribution here.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug Triage-needed

To Reproduce

In Cloud Shell, use PowerShell with the default sign-in and run:

$ENDPOINT = "https://<store-name>.azconfig.io/"
az appconfig kv list --endpoint $ENDPOINT --auth-mode login

Reading key-values from the same store works in my local Windows CLI.

Image Image

Observed Behavior

Cloud Shell returns error:

A Cloud Shell credential problem occurred. When you report the issue with the error below, please mention the hostname 'SandboxHost-639274817947608900'
Audience https://zhiyuanliang-free.azconfig.io/ is not a supported MSI token audience.
Run the command below to authenticate interactively; additional arguments may be added as needed:
az logout
az login --scope "https://zhiyuanliang-free.azconfig.io//.default"

Expected behavior

The command should list key-values using Cloud Shell’s default sign-in.

Is this specific to Cloud Shell?

Yes. Both Cloud Shell and my local Windows CLI use Azure CLI 2.90.0.

I checked that both sessions use the same account, tenant, subscription, and App Configuration store. The operation succeeds locally but fails in Cloud Shell.

Interface information

https://portal.azure.com
browser

Additional context

This looks related to #477

App Configuration now documents https://appconfig.azure.com as its public-cloud audience. The older shared audience is https://azconfig.io (which was mentioned in #477). The [Azure python SDK 1.8.0 or later](https://github.com/Azure/azure-sdk-for-python/blob/azure-appconfiguration_1.8.0/sdk/appconfiguration/azure-appconfiguration/CHANGELOG.md) uses https://appconfig.azure.com by default in public Azure. The Azure CLI is built on Azure python SDK

PS /home/zhiyuan> az account get-access-token --resource "https://appconfig.azure.com" --query "{tokenType:tokenType,expiresOn:expiresOn}" --output json
A Cloud Shell credential problem occurred. When you report the issue with the error below, please mention the hostname 'SandboxHost-639274922403092917'
Audience https://appconfig.azure.com is not a supported MSI token audience.
Run the command below to authenticate interactively; additional arguments may be added as needed:
az logout
az login --scope "https://appconfig.azure.com/.default"
PS /home/zhiyuan> az account get-access-token --resource "https://azconfig.io" --query "{tokenType:tokenType,expiresOn:expiresOn}" --output json        
{
  "expiresOn": "2026-10-13 15:46:29.000000",
  "tokenType": "Bearer"
}
PS /home/zhiyuan>
Lingua principale
PowerShell
Stelle
273
Fork
116
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Azure/CloudShell

Tutte le issue di Azure/CloudShell

Issue simili

Altre issue su Security

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.