Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

@azure/arm-subscriptions SubscriptionClient `subscriptions.list` fails in AzureGovernment

See original GitHub issue

Package Name: @azure/arm-subscriptions
Package Version: 5.0.1
Operating system: Linux
nodejs
- version: v16.18.0
browser
- name/version:
typescript
- version:
Is the bug related to documentation in
- README.md
- source code documentation
- SDK API docs on https://docs.microsoft.com

Describe the bug Attempting to list subscriptions using the SubscriptionClient type fails when accessing it from AzureGovernment

To Reproduce Steps to reproduce the behavior:

Create a ClientSecretCredential like so:

const credential = new ClientSecretCredential(
  process.env.AZURE_AD_TENANT_ID,
  process.env.AZURE_AD_CLIENT_ID,
  process.env.AZURE_AD_CLIENT_SECRET,
  {
    authorityHost: AzureAuthorityHosts.AzureGovernment,
  }
);

Create the subscription client like so:

const subClient = new SubscriptionClient(credential, { endpoint: "https://management.usgovcloudapi.net" });

List the subscriptions

const subscriptionList = subClient.subscriptions.list();

Expected behavior The function completes successfully and subscriptions are successfully listed.

Screenshots If applicable, add screenshots to help explain your problem.

Additional context What actually happens is the following error is thrown:

error - RestError: {"error":{"code":"InvalidAuthenticationTokenAudience","message":"The access token has been obtained for wrong audience or resource 'https://management.azure.com'. It should exactly match with one of the allowed audiences 'https://management.core.usgovcloudapi.net/','https://management.core.usgovcloudapi.net','https://management.usgovcloudapi.net/','https://management.usgovcloudapi.net'."}}
 {
  "name": "RestError",
  "statusCode": 401,
  "request": {
    "url": "https://management.usgovcloudapi.net/subscriptions?api-version=2016-06-01",
    "headers": {
      "accept": "application/json",
      "accept-encoding": "gzip,deflate",
      "user-agent": "azsdk-js-arm-subscriptions/5.0.1 core-rest-pipeline/1.9.2 Node/v16.18.0 OS/(x64-Linux-6.0.6-artix1-1)",
      "x-ms-client-request-id": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
      "authorization": "REDACTED"
    },
    "method": "GET",
    "timeout": 0,
    "disableKeepAlive": false,
    "streamResponseStatusCodes": {},
    "withCredentials": false,
    "requestId": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "allowInsecureConnection": false,
    "enableBrowserStreams": false
  },
  "details": {},
  "page": "/",
  "message": "{\"error\":{\"code\":\"InvalidAuthenticationTokenAudience\",\"message\":\"The access token has been obtained for wrong audience or resource 'https://management.azure.com'. It should exactly match with one of the allowed audiences 'https://management.core.usgovcloudapi.net/','https://management.core.usgovcloudapi.net','https://management.usgovcloudapi.net/','https://management.usgovcloudapi.net'.\"}}"
}

I found a similar issue here #18042

Issue Analytics

State:
Created a year ago
Comments:5 (4 by maintainers)

Top GitHub Comments

1reaction

qiaozhacommented, Nov 4, 2022

Actually, we don’t have such document yet, For this specific issue, we are working on issue #23134 so that customer only need to pass endpoint in the government cloud like the way you did before. I will keep this thread posted once it’s resolved.

0reactions

kazrael2119commented, Nov 14, 2022

released here:https://www.npmjs.com/package/@azure/arm-subscriptions/v/5.1.0

Top Results From Across the Web

azure/arm-subscriptions package

Error response indicates that the service is not able to process the incoming request. The reason is provided in the error message.

Azure Python SDK - connecting to USGov with CLI ...

go to microsoft.com/deviceloginus (usgov device login) and put in code; shell is authenticated; az account list shows all of my subscriptions ...

azure/arm-subscriptions

A generated SDK for SubscriptionClient. ... Start using @azure/arm-subscriptions in your project by running `npm i @azure/arm-subscriptions` ...

@azure/arm-subscriptions - NET

Azure SubscriptionClient SDK for JavaScript ... This package contains an isomorphic SDK for SubscriptionClient. Currently supported environments. Node.js version ...