microsoft / microsoft/powerbi-powershell

Connect-PowerBIServiceAccount - Cannot switch tenants. tid in token is incorrect.

Open
#360 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C#
Stars
413
Forks
134
Avg merge
33m
Merged PRs (30d)
1

Description

Hi team,
I am trying to loop through a number of tenancies and perform some actions. I am using service principal accounts to access each tenancy. I am able to authenticate into each tenancy in a separate Powershell session and perform actions successfully. However, when I switch from one tenancy to another within a Powershell session all requests to the newly connected tenancy fail.

Things I have noticed.
When authenticating the response has TenantId as blank, even when a tenant is provided.
I have decoded the JWT Token for each connection and I noticed that the Token for the connection to the second tenant contains the
tenant id of the first tenant in the "tid" attribute.

I believe all requests to the second tenant get a 404 response (due to the incorrect tenant id in token?).

I'm running,
Powershell 5.1 in VSCode (I've also tried Powershell ISE, and Powershell7)
MicrosoftPowerBIMgmt 1.2.1077

Below are the steps to reproduce,
Two separate tenancies and sets of credentials are required.
Connect to tenant 1

PS> $thumbprint = "XXXXXXXX"
PS> $clientID = "XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
PS> $tenantID = "1111111-1111-1111-1111-111111111111"
PS>
PS> Connect-PowerBIServiceAccount -ServicePrincipal -CertificateThumbprint $thumbprint -ApplicationId $clientID -Tenant $tenantID
Environment           : Public
TenantId              :
ClientId              : XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
CertificateThumbprint : XXXXXXXX

PS> Get-PowerBIAccessToken -AsString

Decode this token and note the tenant id in "tid"
Now disconnect from tenant 1 and try to connect to tenant 2

PS> Disconnect-PowerBIServiceAccount
PS>
PS> $thumbprint = "YYYYYYYY"
PS> $clientID = "YYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY"
PS> $tenantID = "2222222-2222-2222-2222-222222222222"
PS> Connect-PowerBIServiceAccount -ServicePrincipal -CertificateThumbprint $thumbprint -ApplicationId $clientID -Tenant $tenantID
Environment           : Public
TenantId              :
ClientId              : YYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY
CertificateThumbprint : YYYYYYYY

PS> Get-PowerBIAccessToken -AsString

Decode this token and note the tenant id in "tid"

Running any cmdlets here should fail

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the sequence using Connect-PowerBIServiceAccount, Disconnect-PowerBIServiceAccount, and Get-PowerBIAccessToken with two tenants and service-principal certificates. Inspect the connection and token-acquisition entry points; done means the second token's tid matches tenant 2 and subsequent Power BI cmdlets succeed.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.