[BUG] Cross-tenant operations are not working properly
- Lingua principale
- PowerShell
- Stelle
- 273
- Fork
- 117
- Merge medio
- 1h
- PR unite (30g)
- 2
Descrizione
## To Reproduce
Be logged into a tenant where the user has cross-tenant access to a subscription on another tenant.
1 Login tenant from remote VNET
az login --tenant "xxxxx"
2 Displays the expected sub for the remote VNET
az account list -o table
3 Context for hub subscription
az account set --subscription "xxx"
4 Connect vnet to hub
az network vhub connection create --resource-group "abc" --name "vnet-name" --vhub-name "xyz" --remote-vnet "/subscriptions/xxxx/resourceGroups/abc/providers/Microsoft.Network/virtualNetworks/test-vnet"
## Observed Behavior

(LinkedAuthorizationFailed) The client has permission to perform action 'Microsoft.Network/virtualNetworks/peer/action' on scope '/subscriptions/xxx/resourceGroups/abc/providers/Microsoft.Network/virtualHubs/xyz/hubVirtualNetworkConnections/vnet-name', however the current tenant 'xxxxx' is not authorized to access linked subscription 'xxxxxx'.
Code: LinkedAuthorizationFailed
Message: The client has permission to perform action 'Microsoft.Network/virtualNetworks/peer/action' on scope '/subscriptions/xxxxx/resourceGroups/abc/providers/Microsoft.Network/virtualHubs/xyz/hubVirtualNetworkConnections/vnet-name', however the current tenant 'xxxx' is not authorized to access linked subscription 'xxxxx'.
## Expected behavior
`az network vhub` connection create command to run successfully.
## Is this specific to Cloud Shell?
Yes. This is working locally. Issue appears in both Cloud Shell bash and powershell.
## Interface information
portal.azure.com
## Additional context
Add any other context about the problem here.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Direzione di ricerca
Inizia riproducendo la sequenza az login, az account list, az account set e az network vhub connection create in Cloud Shell bash e PowerShell, quindi confrontala con un'esecuzione locale. Il lavoro è completato quando il comando di creazione della connessione vhub tra tenant per la VNET remota ha esito positivo invece di restituire LinkedAuthorizationFailed.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- azure, bash, powershell
- Ambito
- authentication, authorization, cli, cloud
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 35/100