{"record":{"id":"a880d1eb38412eea","repo":"opentofu/opentofu","slug":"json-error-for-azure-subscription-w","errorCode":null,"errorMessage":"json error for azure subscription: %w","messagePattern":"json error for azure subscription: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/azure/auth/cli_auth.go","lineNumber":98,"sourceCode":"\ntype Subscription struct {\n\tId        string `json:\"id\"`\n\tName      string `json:\"name\"`\n\tIsDefault bool   `json:\"isDefault\"`\n}\n\n// getCliAzureSubscriptionID obtains the subscription ID currently active in the\n// Azure profile. This assumes the user has the Azure CLI installed on their machine.\nfunc getCliAzureSubscriptionID(ctx context.Context) (string, error) {\n\trawSubscription, err := getCurrentSubscriptionInfo(ctx)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tvar subscription Subscription\n\terr = json.Unmarshal(rawSubscription, &subscription)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"json error for azure subscription: %w\", err)\n\t}\n\n\treturn subscription.Id, nil\n}\n\n// getCurrentSubscriptionInfo is adapted from azure-sdk-for-go's CLI token retrieval\nfunc getCurrentSubscriptionInfo(ctx context.Context) ([]byte, error) {\n\tcliCmd := exec.CommandContext(ctx, \"az\", \"account\", \"show\", \"-o\", \"json\")\n\tvar stderr bytes.Buffer\n\tcliCmd.Stderr = &stderr\n\n\tstdout, err := cliCmd.Output()\n\tif err != nil {\n\t\tmsg := stderr.String()\n\t\treturn nil, fmt.Errorf(\"error getting subscription info: error: %w\\nmore information: %s\", err, msg)\n\t}\n\n\treturn stdout, nil","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/opentofu/opentofu/blob/3561785c48c1ce615e7c50261bd351f26053efa2/internal/backend/remote-state/azure/auth/cli_auth.go#L80-L116","documentation":"The Azure client-certificate/CLI auth path runs `az account show -o json` and unmarshals its stdout into a Subscription struct. If the command succeeded but its output is not valid JSON of the expected shape, json.Unmarshal fails and is wrapped as \"json error for azure subscription\".","triggerScenarios":"az CLI emitting non-JSON noise into stdout (extension banners, warnings, locale-specific text), a very old/new azure-cli printing a different shape, or output polluted by shell profile echo lines.","commonSituations":"azure-cli extensions or preview versions printing notices; CI images with older az versions; environments where az account show succeeds but streams warnings to stdout instead of stderr.","solutions":["Run `az account show -o json` in the same environment and inspect the raw output for non-JSON lines","Upgrade azure-cli to a current stable version (`az upgrade`)","Disable/remove extensions that print banners into stdout","Re-authenticate with `az login` if the profile data is stale or corrupt"],"exampleFix":"# before: extensions pollute stdout\naz extension add --name connectedk8s  # prints a banner on every command\n# after: quiet output, valid JSON only\naz extension remove --name connectedk8s\naz account show -o json | jq .id","handlingStrategy":"try-catch","validationCode":"# pre-flight: output must be valid JSON\naz account show -o json | jq -e .id >/dev/null || echo \"az output not JSON - fix CLI environment\"","typeGuard":null,"tryCatchPattern":"if err := json.Unmarshal(raw, &subscription); err != nil {\n    // retry once after az upgrade / re-login before giving up\n}","preventionTips":["Pin a stable azure-cli version in CI images","Keep azure-cli extensions minimal; remove ones that print banners to stdout","Validate `az account show -o json | jq .` in a pre-flight CI step"],"tags":["azure","auth","cli","json"],"backgroundTag":null,"analyzedSha":"3561785c48c1ce615e7c50261bd351f26053efa2","analyzedAt":"2026-08-15T23:27:16.226Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}