fabric cli - login with env variables - failed to decode JWT token

[giulio-diluca]

Hello,

With Environment Variables - fabric-cli, i'm trying to login with FAB_TOKEN and FAB_ONELAKE_TOKEN variables as both are required but i receive, when i perform a command ( like fab ls ), the following error

x ls: [AuthenticationFailed] Failed to decode JWT token

Currently i have an automation with Azure Pipelines where i'm able to invoke REST APIs taking the fabric token thanks to a bash function ( get_fabric_access_token ) and this quite work because i do a lot of operations
below the functions that i use also to get the onelake token ( currently i'm not using it around )

get_onelake_access_token(){

  log_func_name "func: ${FUNCNAME[0]}"
  onelake_access_token=$(az account get-access-token --resource "https://storage.azure.com" --query accessToken -o tsv 2>/dev/null)
  if [ -z "$onelake_access_token" ]
  then
      log_error "Failed to obtain access token for Onelake resource."
      exit 1
  else
    log_info "Access token for Onelake resource acquired!"
  fi
}

get_fabric_access_token(){

  log_func_name "func: ${FUNCNAME[0]}"
  fabric_access_token=$(az account get-access-token --resource "$MS_FABRIC_RESOURCE_URL" --query accessToken -o tsv 2>/dev/null)
  if [ -z "$fabric_access_token" ]
  then
      log_error "Failed to obtain access token for Fabric resource."
      exit 1
  else
    log_info "Access token for Fabric resource acquired!"
  fi
}

 
Now, currently i would like to switch to fabric cli in an iterative way, so don't mind about 'why you don't use fab auth login and so on ... '.
i know that fabric_access_token is correct, probably is the onelake that is incorrect
if i put both my access tokens to a jwt token decoder, i'm able to decode them.

anyone have tried this kind of fabric login with env variables?

Regards

[v-hashadapu]

Hi @giulio-diluca , Thank you for reaching out to the Microsoft Fabric Community Forum.

That JWT error usually means one of the tokens is missing, malformed or has the wrong audience. Even if the tokens decode fine in a JWT viewer, the CLI will reject them unless the Fabric token is issued for https://api.fabric.microsoft.com/ and the OneLake token is for https://storage.azure.com/. Both need to be present, valid and properly exported in the same environment where you're running the CLI, otherwise, the tool can’t see them.

Since your Fabric token is working for REST API calls, it's likely fine. The problem might be with the OneLake token, either it's not being set at all or it has the wrong aud value. Also, keep in mind that in Azure Pipelines, each script step runs in isolation. So, if you generate the token in one step and use it in another, it won’t persist unless you explicitly pass it using ##vso[task.setvariable ...]. For a quick check, try generating both tokens and running fab ls in the same script step, if that works, you’ll know it’s an environment visibility issue rather than a token problem.

[giulio-diluca · Accepted solution]

Seems that i found the issue even if i think something is not correct.
for fabric access token i'm using audience 'https://api.fabric.microsoft.com'
for onelake access token i'm using audience 'https://storage.azure.com'

checking this page in fabric cli github repository fabric-cli/src/fabric_cli/core/fab_constant.py at main · microsoft/fabric-cli seems that the fabric access token audience must be: 'https://analysis.windows.net/powerbi/api'

changing the fabric audience to 'https://analysis.windows.net/powerbi/api' seems ok
thanks for the help, i leave the topic open for some days in case somebody want to add something
( i'm not convinced at all ... which can be the result of this audience change? )

Regards