Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[BUG] Since 2 days our pipeline can not get secrets from the keyvault because not the defined TenantId is used

See original GitHub issue

Library name and version

Azure.Extensions.AspNetCore.Configuration.Secrets 1.2.2

Describe the bug

Since 2 days our pipeline can not get secrets from the keyvault because not the defined TenantId is used. Before it has worked for one year without problems.

Azure Devops Pipeline running with the correct service principal to connect but the following error occured

`Azure.RequestFailedException: Service request failed. Status: 401 (Unauthorized)

Content: {“error”:{“code”:“Unauthorized”,“message”:“AKV10032: Invalid issuer. Expected one of https://sts.windows.net/cfd26b50-fb8f-44cf-87b2-d5df3d15d884/, https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/, https://sts.windows.net/e2d54eb5-3869-4f70-8578-dee5fc7331f4/, found https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/.”}}`

Used service principal is in the right TenantID

##[debug]b270df00-2259-4d37-8fd1-45b09abb963d auth param tenantid = cfd26b50-fb8f-44cf-87b2-d5df3d15d884

Works locally with own Azure account.

Expected behavior

DefaultTenantId which is configured should be used

Actual behavior

https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/ TenantId is used in Azure pipeline

Reproduction Steps

` internal static class RealTestConfiguration { private static string DefaultTenantId => “cfd26b50-fb8f-44cf-87b2-d5df3d15d884”;

    public static IConfiguration GetDefaultConfiguration()
    {
        var azureCredentialOptions = new DefaultAzureCredentialOptions
        {
            SharedTokenCacheTenantId = DefaultTenantId,
            VisualStudioTenantId = DefaultTenantId,
            VisualStudioCodeTenantId = DefaultTenantId,
            InteractiveBrowserTenantId = DefaultTenantId
        };

        return new ConfigurationBuilder()
                     .AddInMemoryCollection(TestConfiguration.DefaultOptions)
                     .AddAzureKeyVault(new Uri($"https://xyz.vault.azure.net/"), new DefaultAzureCredential(azureCredentialOptions))
                     .Build();
    }
}`

Run in pipeline

 - task: AzureCLI@1
displayName: iTest
inputs:
  failOnStandardError: true
  azureSubscription: add subscription here
  scriptLocation: inlineScript
  inlineScript: |
    dotnet test ./test/iTests/iTests.csproj --configuration $(BuildConfiguration)