Upgrade from 1.19 to 2.x - "msg": "Find the key vault secret got exception, exception as The current credential is not configured to acquire tokens for tenant xxx. about azure

[Poil]

Same issue with latest ansible version

ansible [core 2.16.6]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.11/dist-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.11.2 (main, Mar 13 2023, 12:18:29) [GCC 12.2.0] (/usr/bin/python3)
  jinja version = 3.1.3
  libyaml = True

[Poil]

If I patch site-packages/azure/identity/_internal/utils.py with self._additionally_allowed_tenants = additionally_allowed_tenants or ['*'] it works

It looks like that the tenant is not passed to the identity library, I don't find why

[Fred-sun]

@Poil I switched the version test and did not encounter the problem you mentioned, but according to the error log, I encountered an error when obtaining authorization. Could you please provide the version of 'azure-identity'?

[Poil]

Hi,

I installed all the requirements from your requirements-azure.txt of collection v2.3.0

$ pip freeze |grep identi
azure-identity==1.14.0

[Fred-sun]

You use 'az login' or credential files?

[Fred-sun]

Return value for local execution：

TASK [debug] ****************************************************************************************************
ok: [localhost] => {
    "facts": {
        "changed": false,
        "failed": false,
        "secrets": [
            {
                "attributes": {
                    "created": "2024-04-24T07:36:11+00:00",
                    "enabled": true,
                    "expires": "2030-03-04T04:05:06+00:00",
                    "not_before": "2000-01-02T01:02:03+00:00",
                    "recovery_level": "Recoverable+Purgeable",
                    "updated": "2024-04-24T07:36:11+00:00"
                },
                "content_type": "Content Type Secret",
                "secret": "mysecret",
                "sid": "xxxxxxxxxxxxxxxxxxx",
                "tags": {
                    "delete": "on-exit",
                    "testing": "test"
                },
                "version": "543a295656dd42d1b394fb174d32c2f4"
            }
        ]
    }
}

[Poil]

We passed the parameter

    azure.azcollection.azure_rm_keyvaultsecret_info:
          client_id: "{{ AZURE_CLIENT_ID }}"
          secret: "{{ AZURE_SECRET }}"
          subscription_id: "{{ AZURE_SUBSCRIPTION_ID }}"
          tenant: "{{ AZURE_TENANT }}"
          vault_uri: "{{ AZURE_KEYVAULT_URI }}"
          name: "{{ item }}"

perhaps I'm wrong but it looks like keyvault module don't use the tenant_id passed if I grep in the python module, it looks like to be extracted from the kv url ? self.tenant_id = uri_path.split("/")[0] or None

[Poil]

When using azure cli to auth it works

[Fred-sun]

I can git the secret through the parameters! It works!

[Fred-sun]

@Poil Are you use multi-tenant to authentication? is the tenant you configured in the parameters consistent with the tenant in you 'az account show'? According to the error, it is the case of tenant. Thank you !

[Fred-sun]

kindly ping!

[Poil]

Hi,

Sorry I'm in holidays :)

We use a service principal, so not multi tenant

Regards

[Fred-sun]

@Poil I am testing locally, and only if you use the wrong tenant id will you encounter such an error, When you come back from your vacation, could you please check and confirm? Thank you!

[Fred-sun]

@Poil In addition, Do you manage resources under different subscription ids?

[Fred-sun]

@Poil What version of Azure. azcollection do you have installed? Thank you!