Connect-AzAccount "Value cannot be null" on 2.11.1. #20728
Comments
LainRobertson
added
bug
ghost
added
customer-reported
and removed
needs-triage
|
@LainRobertson, thanks for reporting. We will check this issue in the next week because developer is off. It will be great if you can share error track by executing |
dingmeng-xue
added
Authentication
Accounts
|
Hi, @dingmeng-xue. Thanks for the reply! PS C:\Data\Scripts> $Error[0].exception | fl * -Force
Message : Value cannot be null.
Parameter name: Could not find tenant id for provided tenant domain 'xxxxxxx.onmicrosoft.com'. Please ensure that the provided service principal
'f7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx3c' is found in the provided tenant domain.
ParamName : Could not find tenant id for provided tenant domain 'xxxxxxx.onmicrosoft.com'. Please ensure that the provided service principal
'f7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx3c' is found in the provided tenant domain.
Data : {}
InnerException :
TargetSite : Microsoft.Azure.Commands.Common.Authentication.Models.AzureRmProfile Login(Microsoft.Azure.Commands.Common.Authentication.Abstractions.IAzureAccount,
Microsoft.Azure.Commands.Common.Authentication.Abstractions.IAzureEnvironment, System.String, System.String, System.String, System.Security.SecureString,
Boolean, System.Action`1[System.String], System.String, Boolean, Int32, System.String)
StackTrace : at Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient.Login(IAzureAccount account, IAzureEnvironment environment, String tenantIdOrName, String
subscriptionId, String subscriptionName, SecureString password, Boolean skipValidation, Action`1 promptAction, String name, Boolean shouldPopulateContextList,
Int32 maxContextPopulation, String authScope)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.<>c__DisplayClass127_2.<ExecuteCmdlet>b__5()
at System.Threading.Tasks.Task`1.InnerInvoke()
at System.Threading.Tasks.Task.Execute()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.<>c__DisplayClass127_0.<ExecuteCmdlet>b__1(AzureRmProfile localProfile, RMProfileClient
profileClient, String name)
at Microsoft.Azure.Commands.Profile.Common.AzureContextModificationCmdlet.ModifyContext(Action`2 contextAction)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.SetContextWithOverwritePrompt(Action`3 setContextAction)
at Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
HelpLink :
Source : Microsoft.Azure.PowerShell.Cmdlets.Accounts
HResult : -2147467261 |
|
This exception is thrown when we couldn't find the provided tenant in all the tenants that the account has access to. But it still doesn't make sense because 2.7.6 works. Needs furture investigation. |
|
Hi @msJinLei could you try if we can reproduce this issue by ourselves? |
|
The error message shows that the service principal is not found in the provided tenant. @LainRobertson could you run We would like to check the error log from Thanks |
msJinLei
added
the
needs-author-feedback
|
Here we go. I've uninstall 2.7.6 and re-installed 2.11.1 (using |
ghost
added
needs-team-attention
|
@LainRobertson The workaround is to use tenantId And will further check other things. |
|
Thanks for the response! That said, I might just wait for a future release to fix the issue, as I know the customer won't take having to use a GUID too kindly. There's been enough struggling around GUIDs in this project (between Active Directory and Azure Active Directory) already. Cheers, |
|
The response of "tenant list" API didn't contain domain names (unlike when signing in as a user) {
"value": [
{
"id": "/tenants/c5852f23-3xxx-4xxx-bxxx-51xxxxxxxxxx",
"tenantId": "c5852f23-3xxx-4xxx-bxxx-51xxxxxxxxxx",
"tenantCategory": "Home"
}
]
}which caused the exception. However, the question remains why 2.7.6 could work. Maybe because the API version is different? To resolve the issue, we could either obtain the GUID of the tenant from the authentication result of Azure.Identity, or like Azure CLI, leverage the OpenID well-known configuration document to get the GUID. (Thanks for @jiasli 's suggestion) |
|
@LainRobertson @isra-fel However the previous product code won't report an error when you try to connect Az.Accounts with an valid tenant name or id if it can find a valid tenant for you to login (use a fallback login by design) When the new feature applied, Az.Accounts will filter the input tenant domain with the all tenant domains attached to your account. In your case, the response from the server doesn't return the domains attached to the tenant. And I try with my application Id and find the response is the same. As I observe, service principal account doesn't receive the tenant domain. If it was always true, we should not allow login with domain when using service principal. |
|
@msJinLei Any update on this? |
|
Hi service team, We find the list-tenants response contains less information from service principal account than that listed in the document https://learn.microsoft.com/en-us/rest/api/resources/tenants/list?tabs=HTTP. Could you help to take a look at the issue? |
msJinLei
added
ARM
Service Attention
|
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @josephkwchan, @jennyhunter-msft. Issue DetailsDescriptionHi, folks. Using Connect-AzAccount from Az.Accounts version 2.7.6 with a certificate works, where it fails under version 2.11.1. In my case, the certificate is stored in the user profile (Cert:\CurrentUser\My), not the computer profile (Cert:\LocalMachine\My.) I'm not a fan of guessing, but it "feels" like 2.11.1 is perhaps only checking the computer store. Regardless, I've backdated to the working 2.7.6 as I don't currently have the time to investigate it - or any in-between versions - further. Failure under 2.11.1: Success under module 2.7.6: Cheers, Edited for a grammatical correction and to sanitise the failure screenshot. Issue script & Debug outputConnect-AzAccount -Tenant $Tenant -ApplicationId $AppId -CertificateThumbprint $Thumbprint -ServicePrincipal;Environment dataPS C:\Data\Scripts> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.19041.2364
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.2364
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1Module versionsThe two versions listed in the brief: 2.7.6 (working) and 2.11.1 (not working.)Error outputPS C:\Data\Scripts> Connect-AzAccount -Tenant $Tenant -ApplicationId $AppId -CertificateThumbprint $Thumbprint -ServicePrincipal;
Connect-AzAccount : Value cannot be null.
Parameter name: Could not find tenant id for provided tenant domain 'xxxxxxx.onmicrosoft.com'. Please ensure that the provided service principal
'f7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx3c' is found in the provided tenant domain.
At line:1 char:1
+ Connect-AzAccount -Tenant $Tenant -ApplicationId $AppId -CertificateT ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Connect-AzAccount], ArgumentNullException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand
PS C:\Data\Scripts> $Error[0].exception | fl *
Value cannot be null.
Parameter name: Could not find tenant id for provided tenant domain 'xxxxxxx.onmicrosoft.com'. Please ensure that the provided service principal
'f7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx3c' is found in the provided tenant domain.
|
|
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @LizMS, @cbrooksmsft. Issue DetailsDescriptionHi, folks. Using Connect-AzAccount from Az.Accounts version 2.7.6 with a certificate works, where it fails under version 2.11.1. In my case, the certificate is stored in the user profile (Cert:\CurrentUser\My), not the computer profile (Cert:\LocalMachine\My.) I'm not a fan of guessing, but it "feels" like 2.11.1 is perhaps only checking the computer store. Regardless, I've backdated to the working 2.7.6 as I don't currently have the time to investigate it - or any in-between versions - further. Failure under 2.11.1: Success under module 2.7.6: Cheers, Edited for a grammatical correction and to sanitise the failure screenshot. Issue script & Debug outputConnect-AzAccount -Tenant $Tenant -ApplicationId $AppId -CertificateThumbprint $Thumbprint -ServicePrincipal;Environment dataPS C:\Data\Scripts> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.19041.2364
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.2364
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1Module versionsThe two versions listed in the brief: 2.7.6 (working) and 2.11.1 (not working.)Error outputPS C:\Data\Scripts> Connect-AzAccount -Tenant $Tenant -ApplicationId $AppId -CertificateThumbprint $Thumbprint -ServicePrincipal;
Connect-AzAccount : Value cannot be null.
Parameter name: Could not find tenant id for provided tenant domain 'xxxxxxx.onmicrosoft.com'. Please ensure that the provided service principal
'f7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx3c' is found in the provided tenant domain.
At line:1 char:1
+ Connect-AzAccount -Tenant $Tenant -ApplicationId $AppId -CertificateT ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Connect-AzAccount], ArgumentNullException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand
PS C:\Data\Scripts> $Error[0].exception | fl *
Value cannot be null.
Parameter name: Could not find tenant id for provided tenant domain 'xxxxxxx.onmicrosoft.com'. Please ensure that the provided service principal
'f7xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx3c' is found in the provided tenant domain.
|
Description
Hi, folks.
Using Connect-AzAccount from Az.Accounts version 2.7.6 with a certificate works, where it fails under version 2.11.1.
In my case, the certificate is stored in the user profile (Cert:\CurrentUser\My), not the computer profile (Cert:\LocalMachine\My.)
I'm not a fan of guessing, but it "feels" like 2.11.1 is perhaps only checking the computer store. Regardless, I've backdated to the working 2.7.6 as I don't currently have the time to investigate it - or any in-between versions - further.
Failure under 2.11.1:
Success under module 2.7.6:
Cheers,
Lain
Edited for a grammatical correction and to sanitise the failure screenshot.
Issue script & Debug output
Environment data
Module versions
Error output
The text was updated successfully, but these errors were encountered: