Azure / Azure/azure-workload-identity
azwi cannot work in sovereign cloud
- Dominant language
- Go
- Stars
- 337
- Forks
- 122
- Avg merge
- 1h 7m
- Merged PRs (30d)
- 3
Description
**Describe the bug**
Cannot use azwi in sovereign cloud
**Steps To Reproduce**
$ azwi version
Version: v0.13.0
GitCommit: 46c5137
$ azwi serviceaccount create phase app --aad-application-name "${APPLICATION_NAME}" --azure-env --debug
INFO[0000] No subscription provided, using selected subscription from Azure CLI: <>
DEBU[0000] Resolving tenantID for subscriptionID: <>
DEBU[0001] Getting application with display name=<>
Error: failed to run phase aad-application: failed to get AAD application: code: InvalidAuthenticationToken, message: Access token validation failure. Invalid audience.
**Expected behavior**
it should work well as global cloud
**Logs**
**Environment**
**Additional context**
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported `azwi serviceaccount create` command with `--azure-env` set to a sovereign cloud and review the debug output around AAD application lookup. Trace how azwi selects the cloud and obtains the access token. Done means the same service-account creation flow works in a sovereign cloud without the Invalid audience error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100