1

I am using Node js to authenticate into Azure AD to create a Data lake storage account, it logs in but for the account creation it gives the error: code: 'InvalidAuthenticationTokenTenant', message: 'The access token is from the wrong issuer \'https://sts.windows.n et\'. It must match the tenant \'https://sts.windows.net/\' associated with this subs cription.

var msRestAzure = require('ms-rest-azure');
var adlsManagement = require("azure-arm-datalake-store");

msRestAzure.interactiveLogin(function(err, credentials) {

 var accountName = 'testadlsacct';
 var pathToEnumerate = '/myfolder';
  var acccountClient = new adlsManagement.DataLakeStoreAccountClient(credentials, 'dxxxxxxx-dxxx-4xxx-bxxx-5xxxxxxxxx');
 var filesystemClient = new adlsManagement.DataLakeStoreFileSystemClient(credentials);

  var util = require('util');
var resourceGroupName = 'testrg';
var accountName = 'testadlsacct';
var location = 'eastus2';


var accountToCreate = {
  tags: {
    testtag1: 'testvalue1',
    testtag2: 'testvalue2'
  },
  name: accountName,
  location: location
};
var client= new adlsManagement.DataLakeStoreAccountClient(credentials,    'dxxxxxxxx-xxx-xxxx--xxxxxx');
    client.account.create(resourceGroupName, accountName, accountToCreate,     function (err, result, request, response) 
//other code here
});
Matt H
  • 213
  • 1
  • 9
Sushmita singh
  • 11
  • 1
  • 4

1 Answers1

4

Taking a look at how ms-rest-azure's msRestAzure.interactiveLogin function is written, it appears that there's a "domain", or tenant, parameter that you can pass in the event that you are a member of more than one Azure Active Directory (tenant).

You should pass in the tenant that is tied to your subscription. This should be given to you in the full, current error message that you get. The tenant may look like "contoso.com", "contoso.onmicrosoft.com", or it could be a GUID.

This disambiguates your authentication call by explicitly mentioning which directory should be used.

I hope this helps!

Matt H
  • 213
  • 1
  • 9
  • Hi, yes I had to login from the service admin account and then perform the authentication. – Sushmita singh Sep 10 '16 at 07:48
  • 1
    The issue is resolved after passing the tenant id as suggested. However, I now have to invoke interactiveLogin and open the browser twice in order to get the credential needed. Do you have any idea how I can avoid authenticating twice? Thank you. – Nuntipat Narkthong Jan 19 '19 at 13:17