The access token expiry UTC time '6/29/2018 8:53:02 PM' is earlier than current UTC time '7/2/2018 9:46:18 PM'.

[vladimir-shcherbakov]

Description

After successful login AzureRm cmdlets throw the excetpion : " The access token expiry UTC time '6/29/2018 8:53:02 PM' is earlier than current UTC time '7/2/2018 9:46:18 PM'."

Script/Steps for Reproduction

PS C:\> Login-AzureRmAccount


Account          : <hidden>@microsoft.com
SubscriptionName : <hidden>
SubscriptionId   : <hidden>
TenantId         : 72f988bf-86f1-41af-91ab-2d7cd011db47
Environment      : AzureCloud

PS C:\> Get-AzureRmSubscription
WARNING: Unable to acquire token for tenant '72f988bf-86f1-41af-91ab-2d7cd011db47'
Get-AzureRmSubscription : The access token expiry UTC time '6/29/2018 8:53:02 PM' is earlier than current UTC time
'7/2/2018 9:46:18 PM'.
At line:1 char:1
+ Get-AzureRmSubscription
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Get-AzureRmSubscription], CloudException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.GetAzureRMSubscriptionCommand

Module Version

PS C:\> Get-Module -Name AzureRM -ListAvailable


    Directory: C:\Program Files\WindowsPowerShell\Modules


ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     6.3.0      AzureRM

Environment Data

PS C:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.17134.112
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17134.112
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Debug Output

[cormacpayne]

@vladimir-shcherbakov are you seeing this issue after restarting your PowerShell session? If so, run Clear-AzureRmContext, open a new session and login again using Connect-AzureRmAccount. If you still see the same error, set $DebugPreference="Continue" and return the result of the cmdlet execution with the debug stream.

[vladimir-shcherbakov]

I opened a new PS terminal and logged in.
Of course, Clear-AzureRmContex solves such an issues.
I added the issue as an yet another sample of token cache related issues.

[edyoung]

Likely related to #6328

[dhmorrison]

I can repo this in the Azure Portal Cloud Shell:

1. Execute a command without parameters
2. Provide input values as the system prompts for required parameters
3. Input a value that is not to the liking of the shell, perhaps it wants a single quoted parameter
4. Profit! I"M HORDING all the single quotes for my own use. lol

cmdlet New-AzResourceGroupDeployment at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
ResourceGroupName: sqlcloneprodrgrp
TemplateFile: azuredeploy.json

BLAM! Errors will be happening as more than one contractor has reported to me...
It would be super awesome if we can eliminate this, as I think we all get the promise of Azure resource group deployments. IMO, it's pretty challenging to get them debugged and sorted out in the best circumstances. Errors (false errors-can an error be true || false?) kind of add insult to injury. Disrupts whatever little bit of flow I'm eking out.

---

cmdlet New-AzResourceGroupDeployment at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
ResourceGroupName: sqlcloneprodrgrp
TemplateFile: azuredeploy.json
New-AzureRmResourceGroupDeployment : The access token expiry UTC time '1/21/2019 11:27:25 PM' is earlier than current UTC time '1/21/2019 11:32:17 PM'
At line:1 char:1
+ New-AzureRmResourceGroupDeployment
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : CloseError: (:) [New-AzResourceGroupDeployment], CloudException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet

---

I posted this in the #6328 as well even though it's closed.

[nyc-rob]

Please see the following link: https://docs.microsoft.com/en-us/azure/cloud-shell/limitations

It states: "Cloud Shell is intended for interactive use cases. As a result, any long-running non-interactive sessions are ended without warning."

This is not very intuitive considering Cloud Shell has an editor to write & save long script files which one would assume you could use for Azure VM deployments. I've had problems with this token expiring at random times. Sometimes 40 minutes after restarting Cloud Shell, sometimes 18 minutes.

The solution is to use Powershell from local PC and sign-in to Azure through the script-pane. Please see: https://www.jgspiers.com/how-to-connect-to-azure-powershell-arm-azuread

[slavizh]

@cormacpayne is there any workaround for this issue? I have tried using connect-AzAccount while still executing new-AzDeploymnet -verbose but seems the command is using the same access token and does not get the latest from the Az context. Either the commands should always get the latest access token to avoid expiration during waiting for results from commands or may be it is good to implement login via connect-AzAccount with refresh token instead of access token so you can renew it.

[cormacpayne]

@slavizh Hey Stanislav, I'm no longer working on the Azure PowerShell team as of a few months ago -- @dingmeng-xue @erich-wang @isra-fel would one of you mind taking a look at this issue?