Issuer validation failed. Issuer did not match.

Describe the bug When trying retrieve blob data from the azure storage I get an error

Expected behavior Being authenticated and retrieving data

Actual behavior (include Exception or Stack Trace) Status: 403 (Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.) ErrorCode: AuthenticationFailed

In fiddler I can see: Issuer validation failed. Issuer did not match.

To Reproduce Steps to reproduce the behavior (include a code snippet, screenshot, or any additional information that might help us reproduce the issue)

environment variable: AZURE_USERNAME: {my azure ad account logged into visualstudio that does work for sqlconnections for example}

new BlobServiceClient(new Uri(configuration.GetConnectionString("AzureStorage")), new DefaultAzureCredential());

var container = blobServiceClient.GetBlobContainerClient("apk");
            

            foreach (var blob in container.GetBlobs()) //fails at .GetBlobs()

Environment:

• Name and version of the Library package used:
  • Azure.Identity 1.1.1
  • Azure.Storage.Blobs 12.3.0
• Hosting platform or OS and .NET runtime version (dotnet --info output for .NET Core projects): Windows 10
• IDE and version : [e.g. Visual Studio 16.3]

[danielmackay]

@Expecho - I did not open a new issue, but I managed to solve the issue.

In my case I was using a user who had access to multiple subscriptions/tenants. I had the right user selected in Visual Studio, but I think it was defaulting to the wrong tenant.

I solved this by explicitly using the AzureCliCredential() and Azure CLI to login to the exact tenant. You could probably also do something similar by using EnvironmentCredential()

[danielmackay]

@hirejohnloveland - Try using Azure CLI to login. I’ve found I have a lot more control than when trying to leave the authentication up to visual studio.

By default the Azure CLI will not let you login to an tenant without a subscription (which is common if your tenant is only used for AAD). In that case try logging on with

az login -t myb2ctenant.onmicrosoft.com --allow-no-subscriptions