fix: environment drift check compares issuer host only, not full URL

The iss claim includes the tenant ID (e.g., https://sts.windows.net/{tid}/),
so switching tenants falsely triggered the environment mismatch error
instead of the tenant mismatch error. Now stores and compares only the
issuer hostname (e.g., sts.windows.net vs sts.chinacloudapi.cn).

Also reordered drift checks: tenant first (most common), then
environment, then principal.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: Shira Sassoon

src/fabric_cli/core/fab_auth.py

@@ -471,9 +471,11 @@ def set_azure_cli(self, tenant_id=None):
 
         # Set identity_type after tenant to survive any logout triggered by tenant change
         auth_props: dict = {con.IDENTITY_TYPE: "azure_cli"}
-        # Store OID and issuer for drift detection (immutable, no PII)
+        # Store OID and issuer host for drift detection (immutable, no PII)
         auth_props[con.FAB_AZURE_CLI_PRINCIPAL_ID] = claims["oid"]
-        auth_props[con.FAB_AZURE_CLI_ISSUER] = claims["iss"]
+        from urllib.parse import urlparse
+
+        auth_props[con.FAB_AZURE_CLI_ISSUER] = urlparse(claims["iss"]).hostname
         self._set_auth_properties(auth_props)
 
     @staticmethod
@@ -527,15 +529,7 @@ def _acquire_token_from_azure_cli(self, scope: list[str]) -> dict:
                     status_code=con.ERROR_AUTHENTICATION_FAILED,
                 )
 
-            # Environment drift check (issuer encodes cloud: public vs sovereign)
-            stored_issuer = self._auth_info.get(con.FAB_AZURE_CLI_ISSUER)
-            if stored_issuer and claims["iss"] != stored_issuer:
-                raise FabricCLIError(
-                        ErrorMessages.Auth.azure_cli_environment_mismatch(),
-                        status_code=con.ERROR_AUTHENTICATION_FAILED,
-                    )
-
-            # Tenant drift check
+            # Tenant drift check (most common drift scenario)
             if stored_tenant and claims["tid"] != stored_tenant:
                 raise FabricCLIError(
                     ErrorMessages.Auth.azure_cli_tenant_mismatch(
@@ -544,6 +538,19 @@ def _acquire_token_from_azure_cli(self, scope: list[str]) -> dict:
                     status_code=con.ERROR_AUTHENTICATION_FAILED,
                 )
 
+            # Environment drift check (issuer host encodes cloud: public vs sovereign)
+            # Stored value is already a hostname; extract host from current token's iss
+            stored_issuer_host = self._auth_info.get(con.FAB_AZURE_CLI_ISSUER)
+            if stored_issuer_host:
+                from urllib.parse import urlparse
+
+                current_host = urlparse(claims["iss"]).hostname
+                if stored_issuer_host != current_host:
+                    raise FabricCLIError(
+                        ErrorMessages.Auth.azure_cli_environment_mismatch(),
+                        status_code=con.ERROR_AUTHENTICATION_FAILED,
+                    )
+
             # Principal drift check (OID-based)
             stored_principal = self._auth_info.get(con.FAB_AZURE_CLI_PRINCIPAL_ID)
             if stored_principal and claims["oid"] != stored_principal:

tests/test_core/test_fab_auth_azure_cli.py

@@ -542,7 +542,7 @@ def test_login_stores_oid_and_issuer_for_drift_detection(self, mock_credential_c
         auth.set_access_mode("azure_cli")
         auth.set_azure_cli()
         assert auth._auth_info.get(con.FAB_AZURE_CLI_PRINCIPAL_ID) == "user-oid-123"
-        assert auth._auth_info.get(con.FAB_AZURE_CLI_ISSUER) == "https://sts.windows.net/t1/"
+        assert auth._auth_info.get(con.FAB_AZURE_CLI_ISSUER) == "sts.windows.net"
 
     @patch("fabric_cli.core.fab_auth.AzureCliCredential")
     def test_re_login_updates_tenant_and_oid(self, mock_credential_class, temp_dir_fixture):