Python integ tests fail Azure Key Vault auth, need corporate Azure credentials opt-in

XMLWordPrintableJSON

    • Type: Build Failure
    • Resolution: Done
    • Priority: Major - P3
    • None
    • Affects Version/s: None
    • Component/s: pymongocrypt, Tests
    • None
    • Python Drivers
    • Not Needed
    • Hide

      1. What would you like to communicate to the user about this feature?
      2. Would you like the user to see examples of the syntax and/or executable code and its output?
      3. Which versions of the driver/connector does this apply to?

      Show
      1. What would you like to communicate to the user about this feature? 2. Would you like the user to see examples of the syntax and/or executable code and its output? 3. Which versions of the driver/connector does this apply to?
    • None
    • None
    • None
    • None
    • None
    • None

      Name of Failure:

      Azure Key Vault authentication failure (AKV10032: Invalid issuer) breaks test-python-integ on RHEL 8.0

      Link to task:

      https://spruce.corp.mongodb.com/task/libmongocrypt_rhel_80_64_bit_test_python_integ_6a7089c9d353e3000773fc95_26_08_03_12_30_01/logs?execution=0

      Context of when and why the failure occurred:

      The rhel-80-64-bit test-python-integ task started failing on 2026-07-25. Azure Key Vault rejects the OAuth token used in the KMS encryption tests because it was issued by tenant f3df2d46-a754-4564-a74c-65fafbcf943b, which is not in the expected tenant list. This breaks shared test setup and causes failures across all KMS provider test cases (AWS, Azure, GCP, KMIP, local), not just Azure.

      Root cause: drivers-evergreen-tools#794 (DRIVERS-3392, merged 2026-06-24) added new "corporate" Azure credentials (FLE_AZURE_TENANTID_CORPORATE, FLE_AZURE_CLIENTID_CORPORATE, FLE_AZURE_CLIENTSECRET_CORPORATE) as an opt-in, gated behind FLE_AZURE_USE_CORPORATE=YES, to migrate off a deprecated Azure app registration/tenant. pymongocrypt's test scripts never set this opt-in, so they still authenticate with the deprecated tenant. The three tenant IDs the error lists as expected match the corporate tenant set; the rejected tenant is the deprecated one. This indicates the test Key Vault's trusted-issuer policy was tightened around 2026-07-25 to only accept the corporate tenants, breaking any consumer still on deprecated credentials.

      Fix: set export FLE_AZURE_USE_CORPORATE=YES in [bindings/python/.evergreen/integ-test.sh|bindings/python/.evergreen/integ-test.sh], following the same migration other drivers made per specifications#1955.

      Stack trace:

      E {"error":{"code":"Unauthorized","message":"AKV10032: Invalid issuer. Expected one of https://sts.windows.net/c96563a8-841b-4ef9-af16-33548de0c958/, https://sts.windows.net/f8cdef31-a31e-4b4a-93e4-5f571e91255a/, https://sts.windows.net/e2d54eb5-3869-4f70-8578-dee5fc7331f4/, found https://sts.windows.net/f3df2d46-a754-4564-a74c-65fafbcf943b/."}}

pymongocrypt.errors.MongoCryptError.from_status
../libmongocrypt/bindings/python/pymongocrypt/mongocrypt.py:725
pymongo.errors.EncryptionError
pymongo/asynchronous/encryption.py:132

            Assignee:
            Steve Silvester
            Reporter:
            Steve Silvester
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: