Error provisioning Azure AppConfiguration, wrong tenant id

[MarcoGaribaldi]

When I start my application I get the following Azure AppConfiguration error:

Error provisioning azureappconfig.
Azure.RequestFailedException: The access token is from the wrong issuer
... (skip) ...
Status: 401 (Unauthorized)
ErrorCode: InvalidAuthenticationTokenTenant

Apparently, my application sends the wrong tenant id, not sure why. There is nothing in the Aspire documentation that says the tenant id must be added to the configuration, but to overcome the problem I have added my Azure tenant id to the appsettings.json file (edited for privacy)

"Azure": {
"SubscriptionId": "",
"TenantId": "",
"AllowResourceGroupCreation": false,
"ResourceGroup": "NameOfGroup",
"Location": "location"
}

My Program.cs calls a method to configure AppConfiguration the following way:

public static IResourceBuilder<AzureAppConfigurationResource> AddAzureAppConfiguration(this IDistributedApplicationBuilder builder)
{
	return builder.AddAzureAppConfiguration(AspireConstants.AzureAppConfig);
}

The problem is that I do not know how to configure AppConfiguration with the correct credentials. So, I tried a different approach I have found somewhere:

public static IResourceBuilder<AzureAppConfigurationResource> AddAzureAppConfiguration(this IDistributedApplicationBuilder builder)
{
	var tenantId = builder.Configuration["Azure:TenantId"];
	var authorityHost = new Uri($"https://login.windows.net/{tenantId}");
	var defaultCredentials = new DefaultAzureCredential(new DefaultAzureCredentialOptions
	{
		AuthorityHost = authorityHost
	});

	var configBuilder = new ConfigurationBuilder()
		.AddConfiguration(builder.Configuration);

	var environment = builder.Environment.EnvironmentName;

	var service = configBuilder.AddAzureAppConfiguration(options =>
	{
		var connectionString = builder.Configuration["ConnectionStrings:azureappconfig"];
		ArgumentException.ThrowIfNullOrEmpty(connectionString);

		options.Connect(connectionString)
			.Select(KeyFilter.Any) // Load default settings
			.Select(KeyFilter.Any, environment) // Load environment-specific settings
			.ConfigureKeyVault(kv =>
			{
				kv.SetCredential(defaultCredentials);
			});
	});

	return service;
}

The method AddAzureAppConfiguration is part of the Microsoft.Extensions.Configuration.AzureAppConfiguration library. This doesn't work. An additional problem is that this AddAzureAppConfiguration returns IConfigurationBuilder, while I need IResourceBuilder.

Any idea on how to resolve this issue?

[davidfowl]

The problem is that I do not know how to configure AppConfiguration with the correct credentials. So, I tried a different approach I have found somewhere:

That approch doesn't look like it'll help with aspire. Can you share more information about what application is throwing the error? Does the dashboard load and show errors? Which errors and what resource does it come from? Can you share?

[MarcoGaribaldi]

Sure. Sorry for not being more specific. I hoped the information I provided was enough.

I have attached a screenshot of the dashboard.

And here is the error I get from the log.

Provisioning azureappconfig...
Error provisioning azureappconfig.
Azure.RequestFailedException: The access token is from the wrong issuer 'https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-xxxxxxxxxxxx/';. It must match the tenant 'https://sts.windows.net/ef156c47-9839-44b7-868c-yyyyyyyyyyyy/'; associated with this subscription. Please use the authority (URL) 'https://login.windows.net/ef156c47-9839-44b7-868c-yyyyyyyyyyyy'; to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.
Status: 401 (Unauthorized)
ErrorCode: InvalidAuthenticationTokenTenant

I am not sure why the wrong tenant id was sent. I have two Azure accounts but I don't use the other one.

This is my Program.cs

using Ginger.AppHost.Extensions;

var builder = DistributedApplication.CreateBuilder(args);

// Services
// ==================================================
var appConfig = builder.AddAzureAppConfiguration();
var keyVault = builder.AddAzureKeyVault();
var messaging = builder.AddRabbitMq();
var keyCloak = builder.AddKeyCloak();
var sqlServer = builder.AddSqlServer();
var postgres = builder.AddPostgres();
var redis = builder.AddRedis();
var seq = builder.AddSeq();

var customerApi = builder.AddCustomerService(sqlServer, redis, messaging, keyVault, seq);

// Event Bus
// ==================================================
var messagingApi = builder.AddEventBusService(postgres, keyVault, seq);

await builder.Build().RunAsync().ConfigureAwait(false);

There are several services that I have not activated for the moment that I have removed.
This is how Azure AppConfiguration is launched:

public static IResourceBuilder<AzureAppConfigurationResource> AddAzureAppConfiguration(this IDistributedApplicationBuilder builder)
{
	return builder.AddAzureAppConfiguration(AspireConstants.AzureAppConfig);
}

The value of the constant is just a key to the connection string:

public const string AzureAppConfig = "azureappconfig";

The connection string is what I found in the Azure AppConfig settings.

[MarcoGaribaldi]

Update:
it turns out that my Azure account was no longer the resource owner. it's all working now.