Azure / Azure/azure-workload-identity

azwi cannot work in sovereign cloud

Open
#566 2 comments 0 reactions 0 assignees View on GitHub
azwi bug
Dominant language
Go
Stars
337
Forks
122
Avg merge
1h 7m
Merged PRs (30d)
3

Description

**Describe the bug**
Cannot use azwi in sovereign cloud

**Steps To Reproduce**
$ azwi version
Version: v0.13.0
GitCommit: 46c5137
$ azwi serviceaccount create phase app --aad-application-name "${APPLICATION_NAME}" --azure-env --debug
INFO[0000] No subscription provided, using selected subscription from Azure CLI: <>
DEBU[0000] Resolving tenantID for subscriptionID: <>
DEBU[0001] Getting application with display name=<>
Error: failed to run phase aad-application: failed to get AAD application: code: InvalidAuthenticationToken, message: Access token validation failure. Invalid audience.

**Expected behavior**
it should work well as global cloud

**Logs**

**Environment**

**Additional context**

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the reported `azwi serviceaccount create` command with `--azure-env` set to a sovereign cloud and review the debug output around AAD application lookup. Trace how azwi selects the cloud and obtains the access token. Done means the same service-account creation flow works in a sovereign cloud without the Invalid audience error.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.