fix: never show one az account's subscriptions under another #3

2026-10-11T09:41:58+02:00

keb commented

2026-10-11 09:41:58 +02:00

With two az accounts, signing in to one could make the other account's group list the first one's subscriptions.

Why: az can't be told which user to get a token for, so each account is pinned with --subscription, using one of its subscriptions. The pin was chosen once at start. But az's profile has one entry per subscription, tagged with the account that signed in to it last. Signing in to another account that also sees the pinned subscription moves it there, and from then on the first account's token requests silently returned the other account's token. That's what happened here: the in-app sign-in as one account re-tagged the other account's default subscription.

Fix:

The pin is looked up in az's profile for every new token (only when the in-memory token cache misses), so it follows az's current mapping. An account with no subscriptions left in az gets "sign in as …".
A token az issues for another of the signed-in users (by its upn/unique_name/preferred_username/email claim) is refused with "az gave a token for X, not Y: sign in as Y again", which shows as the usual sign-in prompt. Only a match against another known user is refused, so tokens without those claims (service principals) or with unusual guest names aren't turned away.

Tests cover the subscription moving between users, a refused token, a user gone from az, and the claim matching. I also checked against two real az accounts (one signed in, one expired): the signed-in account lists its subscriptions, and the expired one shows the sign-in error.

🤖 Generated with Claude Code

With two az accounts, signing in to one could make the other account's group list the first one's subscriptions. **Why:** az can't be told which user to get a token for, so each account is pinned with `--subscription`, using one of its subscriptions. The pin was chosen once at start. But az's profile has one entry per subscription, tagged with the account that signed in to it last. Signing in to another account that also sees the pinned subscription moves it there, and from then on the first account's token requests silently returned the other account's token. That's what happened here: the in-app sign-in as one account re-tagged the other account's default subscription. **Fix:** - The pin is looked up in az's profile for every new token (only when the in-memory token cache misses), so it follows az's current mapping. An account with no subscriptions left in az gets "sign in as …". - A token az issues for **another of the signed-in users** (by its `upn`/`unique_name`/`preferred_username`/`email` claim) is refused with "az gave a token for X, not Y: sign in as Y again", which shows as the usual sign-in prompt. Only a match against another known user is refused, so tokens without those claims (service principals) or with unusual guest names aren't turned away. Tests cover the subscription moving between users, a refused token, a user gone from az, and the claim matching. I also checked against two real az accounts (one signed in, one expired): the signed-in account lists its subscriptions, and the expired one shows the sign-in error. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

keb added 1 commit 2026-10-11 09:41:58 +02:00

fix: never show one az account's subscriptions under another

CI / Checks (pull_request) Successful in 23s

Details

PR title / Conventional title (pull_request) Successful in 1s

Details

57e545f1ab

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

keb added 1 commit 2026-10-11 09:55:35 +02:00

Merge branch 'main' into fix/azure-account-pin

CI / Checks (pull_request) Successful in 23s

Details

PR title / Conventional title (pull_request) Successful in 2s

Details

527d0de880

keb merged commit 87d98d038d into main

2026-10-11 09:55:43 +02:00

keb deleted branch fix/azure-account-pin

2026-10-11 09:55:43 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: keb/lazysecrets#3