Package related commands return error as they do not recognize the org set as DevHub

[ymata]

Summary

I am trying to migrate from an old version of sfdx-cli to the latest version of @salesforce/cli but the package related commands return an error as they do not recognize the org set as DevHub.
All the commands work correctly except the ones related to packages.

Steps To Reproduce

Run:
sf package list --target-dev-hub MYDEVHUB --verbose

IMPORTANT
The environment where the whole process runs is in a Drone.io pipeline using the Docker image node:latest.

Expected result

As a result, a list of all packages in MYDEVHUB org should be displayed.

Actual result

Error (1): Parsing --target-dev-hub 
	The specified org MYDEVHUB is not a Dev Hub.

System Information

Shell used: bash

Run: sf --version --verbose --json

@salesforce/cli/1.83.4 linux-x64 node-v20.3.1

Additional information

If we run the command to list connected orgs, we can see that the MYDEVHUB org is set to DevHub.
Run:
sf org list
Result:

Non-scratch orgs
==================================================================================================
|     ALIAS      USERNAME                                      ORG ID             CONNECTED STATUS 
| ─── ────────── ───────────────────────────────────────────── ────────────────── ──────────────── 
| (D) MYDEVHUB ******                            00**************Y       Connected        

Diagnostic tests

sf package list --target-dev-hub MYDEVHUB --verbose --dev-debug

=== Running all diagnostics
pass - salesforcedx plugin not installed
pass - no linked plugins
pass - [@salesforce/plugin-source] sourceApiVersion matches apiVersion
pass - using latest or latest-rc CLI version

Update

By logging into Salesforce using the web server flow (sf org login web) the problem goes away.
The problem occurs when logging in using JSON web token (sf org login jwt).
In both cases the output of the sf org list command is the same:

Non-scratch orgs
=========================================================================================
|     ALIAS      USERNAME                             ORG ID             CONNECTED STATUS
| ─── ────────── ──────────────────────────────────── ────────────────── ────────────────
| (D) MYDEVHUB ******                00**************Y         Connected

Org login jwt:
Run:

sf org login jwt --client-id xxxxxxxxxxxxxxx --jwt-key-file hubserver.key --username xxxxxxxxxxxxxxx -r https://login.salesforce.com --alias MYDEVHUB --set-default-dev-hub --json

Result:

{
  "status": 0,
  "result": {
    "accessToken": "xxxxxxxxxxxxxxx",
    "orgId": "00xxxxxxxxxxxxxxxY",
    "loginUrl": "https://login.salesforce.com/",
    "privateKey": "hubserver.key",
    "clientId": "xxxxxxxxxxxxxxx",
    "instanceUrl": "https://xxxxxxxxxxxxxxx",
    "isDevHub": false,
    "username": "xxxxxxxxxxxxxxx"
  },
  "warnings": []
}

The set-default-dev-hub flag is being used, however in the output it can be seen that isDevHub is false.

Org login web:
Run:

sf org login web --set-default-dev-hub --alias MYDEVHUB --json

Result

{
  "status": 0,
  "result": {
    "accessToken": "xxxxxxxxxxxxxxx",
    "instanceUrl": "https://xxxxxxxxxxxxxxx",
    "orgId": "00xxxxxxxxxxxxxxxY",
    "username": "xxxxxxxxxxxxxxx.com",
    "loginUrl": "https://login.salesforce.com",
    "refreshToken": "xxxxxxxxxxxxxxx",
    "clientId": "PlatformCLI",
    "isDevHub": true
  },
  "warnings": []
}

In this case isDevHub is true.

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[github-actions]

Hello @ymata 👋 It looks like you didn't include the full Salesforce CLI version information in your issue.
Please provide the output of version --verbose --json for the CLI you're using (sf or sfdx).

A few more things to check:

• Make sure you've provided detailed steps to reproduce your issue.
  • A repository that clearly demonstrates the bug is ideal.
• Make sure you've installed the latest version of Salesforce CLI. (docs)
  • Better yet, try the rc or nightly versions. (docs)
• Try running the doctor command to diagnose common issues.
• Search GitHub for existing related issues.

Thank you!

[WillieRuemmele]

Hi @ymata - this is an interesting one... can you try sf auth logout and then try reauthenticating to the devhub org and trying it again?

[ymata]

Thanks @WillieRuemmele. I tried this command (sf org logout --all --no-prompt) to log out of all orgs and then authenticate again to DevHub, but again I get the same error.

[daniellsamonte]

Just to iterate the issue, when logging in using jwt with the --set-default-dev-hub tag, we get the IsDevHub = false

{
  "status": 0,
  "result": {
    "accessToken": "xxxxxxxxxxxxxx",
    "orgId": "xxxxxxxxxxxxxx",
    "loginUrl": "https://login.salesforce.com/",
    "privateKey": "xxxxxxxxxxxxxx",
    "clientId": "xxxxxxxxxxxxxx",
    "instanceUrl": "xxxxxxxxxxxxxx",
    "isDevHub": false,
    "username": "xxxxxxxxxxxxxx"
  },
  "warnings": []
}

on sf org list here is what it looks like for that org:
{
"accessToken": "xxxxxxxxxxxxxx",
"orgId": "xxxxxxxxxxxxxx",
"loginUrl": "https://login.salesforce.com/",xxxxxxxxxxxxxx",
"clientId": "xxxxxxxxxxxxxx",
"instanceUrl": "xxxxxxxxxxxxxx",
"isDevHub": false,
"username": "xxxxxxxxxxxxxx",
"instanceApiVersion": "58.0",
"instanceApiVersionLastRetrieved": "6/26/2023, 9:58:40 AM",
"alias": "xxxxxxxxxxxxxx",
"isDefaultDevHubUsername": true,
"isDefaultUsername": false,
"lastUsed": "2023-06-26T08:59:30.414Z",
"connectedStatus": "Connected",
"defaultMarker": "(D)"
}

As you can see the isDevHub flag is false, but is set to isDefaultDevHubUsername = true

Im using the same version of sfdx as @ymata
Running the sf doctor gave the following results:

=== Running all diagnostics

pass - salesforcedx plugin not installed
pass - no linked plugins
pass - [@salesforce/plugin-source] sourceApiVersion matches apiVersion
warn - [@salesforce/plugin-source] sourceApiVersion matches default target org max apiVersion
pass - using latest or latest-rc CLI version
=== Suggestions

  * Check https://github.com/forcedotcom/cli/issues for CLI issues posted by the community.
  * Check http://status.salesforce.com for general Salesforce availability and performance.
  * The sourceApiVersion in sfdx-project.json doesn't match the max apiVersion of the default target org. As a result, you're not using the latest features available in API version 57.0. The version mismatch isn't a problem, as long as it's the behavior you actually want.

Could you please assist?

[WillieRuemmele]

Interesting, we might not be correctly identifying DevHubs... that property should be set in ~/.sfdx/<org username>.json, can you try changing the "isDevHub" property to true and trying the command again?

[ymata]

Hi @WillieRuemmele
The source of the problem is related to the user's profile. In our CI/CD process, we have always used a user with the standard Minimum Access profile and a Permission Set to grant access to the Connected App and it always worked correctly.
Changing the user profile to a custom one with more permissions, the authentication works correctly. The isDevHub flag is set correctly.
We have not yet been able to determine what permissions would prevent it from working with the Minimum Access profile.

[github-actions]

This issue has not received a response in 7 days. It will auto-close in 7 days unless a response is posted.

[shetzel]

@ymata - Just to confirm, the key to reproducing this is to first create a user in the devhub org using the Minimum Access profile and grant permission to the connected app. Then with that user you do the devhub auth and packaging commands?

[mshanemc]

@ymata the auth process sets the isDevHub field by querying the org to see if it has any ScratchOrgInfo objects associated with it. https://github.com/forcedotcom/sfdx-core/blob/f4250e227d7657a458113493201b4c4c76d3a050/src/org/org.ts#L549-L550

If you modify your profile (or, preferable, create a permissions set that allows the user to read from the ScratchOrgInfo object) it should clear up the issue. You'd need more permissions that that if you intend to use the hub to create/delete scratch orgs, but if you're just using it for 2GP

Alternatively, you can manually set isDevHub to true.