microsoft / microsoft/powerbi-powershell
Connect-PowerBIServiceAccount - Cannot switch tenants. tid in token is incorrect.
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 413
- Forks
- 134
- Avg merge
- 33m
- Merged PRs (30d)
- 1
Description
Hi team,
I am trying to loop through a number of tenancies and perform some actions. I am using service principal accounts to access each tenancy. I am able to authenticate into each tenancy in a separate Powershell session and perform actions successfully. However, when I switch from one tenancy to another within a Powershell session all requests to the newly connected tenancy fail.
Things I have noticed.
When authenticating the response has TenantId as blank, even when a tenant is provided.
I have decoded the JWT Token for each connection and I noticed that the Token for the connection to the second tenant contains the
tenant id of the first tenant in the "tid" attribute.
I believe all requests to the second tenant get a 404 response (due to the incorrect tenant id in token?).
I'm running,
Powershell 5.1 in VSCode (I've also tried Powershell ISE, and Powershell7)
MicrosoftPowerBIMgmt 1.2.1077
Below are the steps to reproduce,
Two separate tenancies and sets of credentials are required.
Connect to tenant 1
PS> $thumbprint = "XXXXXXXX"
PS> $clientID = "XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
PS> $tenantID = "1111111-1111-1111-1111-111111111111"
PS>
PS> Connect-PowerBIServiceAccount -ServicePrincipal -CertificateThumbprint $thumbprint -ApplicationId $clientID -Tenant $tenantID
Environment : Public
TenantId :
ClientId : XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
CertificateThumbprint : XXXXXXXX
PS> Get-PowerBIAccessToken -AsString
Decode this token and note the tenant id in "tid"
Now disconnect from tenant 1 and try to connect to tenant 2
PS> Disconnect-PowerBIServiceAccount
PS>
PS> $thumbprint = "YYYYYYYY"
PS> $clientID = "YYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY"
PS> $tenantID = "2222222-2222-2222-2222-222222222222"
PS> Connect-PowerBIServiceAccount -ServicePrincipal -CertificateThumbprint $thumbprint -ApplicationId $clientID -Tenant $tenantID
Environment : Public
TenantId :
ClientId : YYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY
CertificateThumbprint : YYYYYYYY
PS> Get-PowerBIAccessToken -AsString
Decode this token and note the tenant id in "tid"
Running any cmdlets here should fail
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the sequence using Connect-PowerBIServiceAccount, Disconnect-PowerBIServiceAccount, and Get-PowerBIAccessToken with two tenants and service-principal certificates. Inspect the connection and token-acquisition entry points; done means the second token's tid matches tenant 2 and subsequent Power BI cmdlets succeed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100