AKV10032: Invalid issuer error for listing of key vault secrets from nondefault tenant subscription

[t3mi]

Describe the bug

Command Name
az keyvault secret list

Errors:

AKV10032: Invalid issuer. Expected one of https://sts.windows.net/<nondefault tenant>/, found https://sts.windows.net/<default tenant>/.

To Reproduce:

Steps to reproduce the behavior.

• az login // login with one tenant
• az login // login with second tenant
• az account list // verify multiple subscriptions exist with different tenants
• az keyvault secret list --subscription <subscription from nondefault tenant> --vault-name {} --query '[].id'

Expected Behavior

Secret ids are printed.

Environment Summary

Windows-10-10.0.18362-SP0
Python 3.6.6
Shell: powershell.exe

azure-cli 2.0.80

Additional Context

• az account list

[
  {
    "cloudName": "AzureCloud",
    "id": "<default subscription>",
    "isDefault": true,
    "name": "Visual Studio Enterprise with MSDN",
    "state": "Enabled",
    "tenantId": "<default tenant>",
    "user": {
      "name": "<email>",
      "type": "user"
    }
  },
  {
    "cloudName": "AzureCloud",
    "id": "<subscription from nondefault tenant>",
    "isDefault": false,
    "name": "Visual Studio Enterprise",
    "state": "Enabled",
    "tenantId": "<nondefault tenant>",
    "user": {
      "name": "<email>",
      "type": "user"
    }
  }
]

[jsntcy]

@bim-msft, please help take a look, thanks.

[t3mi]

Any updates on this?

[bim-msft]

@t3mi This is a cross-tenants issue, I believe it's similar with #7607 , the parameter --subscription seems broken now as we are facing some complicated cross-tenants problems, please avoid using this parameter as a workaround. For more info, please refer to: #7902

[jjnwu]

Our deployment is blocked due to the same error code

2020-03-12T19:23:08.4378500Z Operation Info:
2020-03-12T19:23:08.4386094Z Start Time: 03/12/2020 19:22:40
2020-03-12T19:23:08.4392880Z End Time: 03/12/2020 19:22:40
2020-03-12T19:23:08.4439932Z Error Reason: Error in 'payloadProperties' for extension 'Microsoft.Azure.Portal.HostingService/DeployPortalExtension'. Error Message: Rollout action failed. Please check the help link for more information.
2020-03-12T19:23:08.4442589Z AKV10032: Invalid issuer. Expected one of ....

[yungezz]

the scenario in keyvault requires global --subscription works well for cross-tenant scenarios firstly.