RestError: AKV10032: Invalid issuer

• Package Name: @azure/keyvault-secrets, @azure/identity
• Package Version: ^4.1.0, ^1.2.0
• Operating system: windows 10
• nodejs
  • version: 14.15.3
• browser
  • name/version:
• typescript
  • version: 3.9.6
• Is the bug related to documentation in
  • README.md
  • source code documentation
  • SDK API docs on https://docs.microsoft.com

Describe the bug similar to the bug: https://github.com/Azure/azure-sdk-for-js/issues/12539 I was following the docs how to reading key-valut in NodeJs+TS https://docs.microsoft.com/en-gb/javascript/api/overview/azure/keyvault-keys-readme?view=azure-node-latest

To Reproduce Steps to reproduce the behavior:

1. follow - https://docs.microsoft.com/en-gb/javascript/api/overview/azure/keyvault-keys-readme?view=azure-node-latest - ‘Getting a key’ section
2. run

const { DefaultAzureCredential } = require("@azure/identity");
const { KeyClient } = require("@azure/keyvault-keys");

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

async function main() {
  const latestKey = await client.getKey(keyName);
  console.log(`Latest version of the key ${keyName}: `, latestKey);
  const specificKey = await client.getKey(keyName, { version: latestKey.properties.version! });
  console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);
}

main(); 

I did follow the hints from bug https://github.com/Azure/azure-sdk-for-js/issues/12539

1. this works for me fine - I’m able to get secrets:

az login
az account set --subscription SUBSCRIPTION_ID
az keyvault secret list --vault-name KEY_VAULT_NAME

1. I did change to use the ClientSecretCredential but the same result:

(node:13300) UnhandledPromiseRejectionWarning: RestError: AKV10032: Invalid issuer. Expected one of https://sts.windows.net/72f988bf..., https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/, https://sts.windows.net/e2d54eb5..., https://sts.windows.net/33e01921-4d64-4f8c-a055-5bdaffd5e33d/, https://sts.windows.net/975f013f..., found https://sts.windows.net/e46bc88e....

I have noticed that the found issuer match the tenantId I have provided but none of the expected issuers is in my subscription.

Expected behavior Login and display KV details

Screenshots If applicable, add screenshots to help explain your problem.

Additional context Add any other context about the problem here.

[RomanDvorsky]

Hi,

I have uncommented the code I did use the 1st time and all works fine. Even the device credentials approach works fine now - I have no clue what has happened and what is different now 😦

So thx for your time and I’m going to investigate what has been changed

Regards, R.

[sadasant]

@deepakhb2 hello, I’m Daniel! I’ll be doing my best to help you.

Do you mind describing how is your Azure App Registration configured? What permissions does it have? how have you assigned permissions to those app registrations though your key vault?