"The access token is from the wrong issuer" error

[medikoo]

I was trying to deploy service, I was successfully deploying a week ago, but now after re-login to Azure (and applying workaround for #250) it crashes for me with:

Error --------------------------------------------------
 
  Error: The access token is from the wrong issuer 'https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/'. It must match the tenant 'https://sts.windows.net/300fcec5-c972-4d1d-ba67-72e81a4ff23e/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/300fcec5-c972-4d1d-ba67-72e81a4ff23e' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.
      at new RestError (/Users/medikoo/npm-packages/serverless-azure-functions/node_modules/@azure/ms-rest-js/lib/restError.ts:18:5)
      at /Users/medikoo/npm-packages/serverless-azure-functions/node_modules/@azure/ms-rest-js/lib/policies/deserializationPolicy.ts:117:27
      at processTicksAndRejections (internal/process/task_queues.js:85:5)
      at ResourceService.deployResourceGroup (/Users/medikoo/npm-packages/serverless-azure-functions/lib/services/resourceService.js:111:12)
      at AzureDeployPlugin.deploy (/Users/medikoo/npm-packages/serverless-azure-functions/lib/plugins/deploy/azureDeployPlugin.js:102:5)

[tbarlow12]

This seams like an azure issue... Did your subscription change somehow? Maybe flipped from Free Trial to Pay-as-you-go?

[medikoo]

Did your subscription change somehow? Maybe flipped from Free Trial to Pay-as-you-go?

It's Pay-as-you-go, same as it was when it worked for me.

I've also run az login and az ad sp create-for-rbac --name medikoo to refresh things (and updated env var with new password), but it didn't help

[nkelly75]

I experienced similar (first time trying serverless framework with my azure subscription). Note: I have an active PAYG subscription (previously I had a Free subscription that expired). If I have no subscriptionId in my serverless.yml then "sls deploy" seems to pick up the Free subscrtiption: Error: Authentication returned an empty list of subscriptions

If I explicitly set the subscriptionId (to the active PAYG sub) I get the error posted by @medikoo above.

Note: the service principal approach setting environment variables as described under 'Advanced Authentication' in the readme works.

[amit12cool]

Any solution for this?

[LukePammant]

Hey I know this is an old issue but I'm stuck on it as well. How can I get serverless to reset the Azure credentials? It doesn't appear to be using my credentials that I set via az login. Also how can I force SLS to use the --tenantId=<id> flag when logging in?

[LukePammant]

I'll answer my own question above after I did some digging:

The problem:

When you first run sls deploy it will perform an interactive authentication against Azure even if you have already performed a az login. The problem is that you cannot select the tenant that you want to issue an access token for. serverless will then cache your Azure credentials in the ~/.azure/slsTokenCache.json and not ask you to log in again.

The quick (hacky) fix:

If you are able to successfully login via az login you can copy your correct access token from the file ~/.azure/accessTokens.json and overwrite the entry in the ~/.azure/slsTokenCache.json.

You can verify that you have the correct access token for the tenant in one of two ways:

1. The tenantId will be at the end of the _authority property in the accessTokens.json file.
   • i.e. "_authority": "https://login.microsoftonline.com/b0142f8e-51df-4058-9d63-4919e1b1d46d"
2. If the tenantId isn't in the _authority you can copy the accessToken property into a JWT parser like https://jwt.io and see the "tid" value of the access token. This is the tenantId.

Once I overwrote the entry in the slsTokenCache.json with the one from the accessTokens.json I was able to deploy successfully.

[jinman]

I have the same issue and unable to fix it. I am able to login with az login but unable to see the an file like ~/.azure/accessTokens.json. I do have ~/.azure/msal_token_cache.json. any other hacks?

[2usatish]

I also didnt have ~/.azure/accessTokens.json but had ~/.azure/msal_token_cache.json. replacing entry in the slsTokenCache.json with the token from msal_token_cache.json worked for me.