SFDX commands failing with "Destination URL not reset. The URL returned from login must be set"

[leonicolas]

Summary

SFDX commands using the auth token as username are failing with the "Destination URL not reset. The URL returned from login must be set" error.

The error started to happen on the sfdx-cli version 7.150.0
The same issue happens on amd64 and arm64 architectures

Steps To Reproduce:

1. Get the authorization token from any sandbox org you are logged in
2. Run any SFDX command using the authorization token as the user name

Expected result

sfdx-cli version 7.149.1

$ sfdx config:set -g instanceUrl='https://[org-name].sandbox.my.salesforce.com'
=== Set Config
 Name          Value                                                Success 
───────────────────────────
 instanceUrl https://[org-name].sandbox.my.salesforce.com true  


$ sfdx force:data:soql:query -q "SELECT Id FROM Contact LIMIT 1" -u '[authorization token]'
ID
──────────────────
0030b0000225BgOAAU
Total number of records retrieved: 1.
Querying Data... done

Actual result

sfdx-cli version 7.150.0 and newer versions

$ sfdx config:set -g instanceUrl='https://[org-name].sandbox.my.salesforce.com'
=== Set Config
 Name          Value                                                Success 
───────────────────────────
 instanceUrl https://[org-name].sandbox.my.salesforce.com true  


$ sfdx force:data:soql:query -q "SELECT Id FROM Contact LIMIT 1" -u '[authorization token]'
Querying Data... done
ERROR running force:data:soql:query:  Destination URL not reset. The URL returned from login must be set

Using the SFDX_INSTANCE_URL environment variable:

$ SFDX_INSTANCE_URL=https://[org-name].sandbox.my.salesforce.com sfdx force:data:soql:query -q "SELECT Id FROM Contact LIMIT 1" -u '[authorization token]'
Querying Data... done
ERROR running force:data:soql:query:  Destination URL not reset. The URL returned from login must be set

System Information

{
"cliVersion": "sfdx-cli/7.153.1",
"architecture": "darwin-arm64",
"nodeVersion": "node-v16.15.1",
"pluginVersions": [
"@oclif/plugin-autocomplete 0.3.0 (core)",
"@oclif/plugin-commands 1.3.0 (core)",
"@oclif/plugin-help 3.3.1 (core)",
"@oclif/plugin-not-found 1.2.6 (core)",
"@oclif/plugin-plugins 1.10.11 (core)",
"@oclif/plugin-update 1.5.0 (core)",
"@oclif/plugin-warn-if-update-available 1.7.3 (core)",
"@oclif/plugin-which 1.0.4 (core)",
"@salesforce/lwc-dev-server 2.11.0",
"@salesforce/sfdx-plugin-lwc-test 0.1.7 (core)",
"alias 2.0.1 (core)",
"apex 0.13.0 (core)",
"auth 2.0.3 (core)",
"community 1.1.5 (core)",
"config 1.4.7 (core)",
"custom-metadata 1.1.0 (core)",
"data 2.0.2 (core)",
"generator 2.0.1 (core)",
"info 2.0.1 (core)",
"limits 2.0.1 (core)",
"org 1.13.2 (core)",
"salesforce-alm 54.4.0 (core)",
"schema 2.1.1 (core)",
"sfdx-cli 7.153.1 (core)",
"sfdx-devops 0.4.6",
"sfdx-heber 0.0.2",
"sfdx-typegen 0.6.2",
"shane-sfdx-plugins 4.43.0",
"├─ @mshanemc/plugin-streaming 1.1.7",
"└─ @mshanemc/sfdx-sosl 1.1.0",
"signups 1.1.2 (core)",
"source 1.10.2 (core)",
"telemetry 2.0.0 (core)",
"templates 54.8.0 (core)",
"trust 1.1.0 (core)",
"user 2.0.2 (core)"
],
"osVersion": "Darwin 21.4.0"
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[WillieRuemmele]

Hi @leonicolas 👋

I was able to have it work on 7.149.1 and it failed on 7.154.0. Thanks for reporting this bug

UPDATE: I found a workaround for now, if you use your sandbox name, instead of auth token, it'll work

[leonicolas]

Thank you @WillieRuemmele

Unfortunately, I can't use the sandbox user name because it is an entirely automated process. It is running inside a docker container and there are no authenticated ORGs. I'm using the 7.149.1 version while we don't have a solution for the issue.

Maybe sfdx auth:jwt:grant can be used as a workaround. I will test this approach.

I will also take a look at the source code and try to understand what was the regression and submit a PR.

[WillieRuemmele]

Thanks, sorry the workaround isn't applicable.

I'm sure it's related to this PR, and I've confirmed it's broken for other commands, running on sfdx-core v3
ERROR running force:limits:recordcounts:display: Destination URL not reset. The URL returned from login must be set

I'm not sure if it's an issue with the v3 branch of sfdx-core, or if it's coming from jsforce v2

it's only reproducible in the shipped CLI, if I run the commands from the local version of each plugin it passes 😞

[carlosabella]

Hi all ... somehow in 7.152.0 works in my local machine.

[leonicolas]

Are you currently authenticated to the org ( sfdx force:org:list )?
The error happens in non-authenticated orgs.

By the way, it's working fine on the 7.154.0 version. Thank you @WillieRuemmele

[shetzel]

Fixed in 7.154.0

[alecdorner]

Is anyone else experiencing this exact issue with sf commands now? We are creating a CI/CD pipeline using access tokens we retrieve ourselves for security reasons, and we're experiencing this exact issue when trying to use it.

[shetzel]

@alecdorner is sfdx auth url not an option? https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_url.htm
Is the packaging plugin (or whatever plugin hosts the failing commands) the latest version? You can check with sf plugins --core