[BUG]Azure.Identity 1.13.2 breaks ManagedIdentityCredential in AzureML #49174
Assignees
Labels
Azure.Identity
Client
This issue points to a problem in the data-plane of the library.
customer-reported
Issues that are reported by GitHub users external to the Azure organization.
needs-team-attention
Workflow: This issue needs attention from Azure service team or SDK team
question
The issue doesn't require a change to the product in order to be resolved. Most issues start as that
Comments
github-actions
bot
added
Azure.Identity
Client
|
Hello @eugencutic. I'm an AI assistant for the azure-sdk-for-net repository. I have some suggestions that you can try out while the team gets back to you. • The error appears to indicate that the Managed Identity endpoint is not returning the expected token payload (status code 404) in the AzureML environment. The team will get back to you shortly, hopefully this helps in the meantime. |
github-project-automation
bot
moved this to Untriaged
in Azure Identity SDK Improvements
|
Hi @eugencutic For console output, you would just need to add the following line to your program. using AzureEventSourceListener listener = AzureEventSourceListener.CreateTraceLogger();If you need to log the output somewhere other than the console, this can be done as described in these docs. For example: using AzureEventSourceListener listener = new AzureEventSourceListener(
(args, message) => myLogger.Log("[{0:HH:mm:ss:fff}][{1}] {2}", DateTimeOffset.Now, args.Level, message),
level: EventLevel.Verbose); |
christothes
added
the
needs-author-feedback
github-actions
bot
removed
the
needs-team-attention
|
Hi @eugencutic. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue. |
|
Ran it with the line mentioned but the output seems to be the same: Just for reference, the exact code that generated this output is: using Azure.Core;
using Azure.Core.Diagnostics;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using AzureEventSourceListener listener = AzureEventSourceListener.CreateTraceLogger();
TokenCredential tokenCredential = new ManagedIdentityCredential("b29183f9-a548-4062-a211-7bc1c4c825d4");
var secretClient = new SecretClient(new Uri("https://local-tools-kv.vault.azure.net/"), tokenCredential);
var secret = secretClient.GetSecret("app-insights-connection-string");
Console.WriteLine($"Got secret"); |
github-actions
bot
added
needs-team-attention
|
Hi @eugencutic - |
christothes
added
the
needs-author-feedback
github-actions
bot
removed
the
needs-team-attention
|
Hi @eugencutic. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue. |
|
Hi @christothes using Azure.Core;
using Azure.Core.Diagnostics;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
AzureEventSourceListener listener = AzureEventSourceListener.CreateTraceLogger();
try
{
TokenCredential tokenCredential = new ManagedIdentityCredential("b29183f9-a548-4062-a211-7bc1c4c825d4");
var secretClient = new SecretClient(new Uri("https://local-tools-kv.vault.azure.net/"), tokenCredential);
var secret = secretClient.GetSecret("app-insights-connection-string");
Console.WriteLine($"Got secret");
}
finally
{
System.Diagnostics.Trace.Flush();
}But it is still showing the exact same output as above. |
github-actions
bot
added
needs-team-attention
|
@eugencutic - It should be: AzureEventSourceListener listener = AzureEventSourceListener.CreateConsoleLogger();So sorry for the confusion! |
|
@christothes I see the inner message actually shows a BadRequest response. |
|
This could be related to AzureAD/microsoft-authentication-library-for-dotnet#5167 I will investigate a bit further. |
|
I am not sure if this is the same issue. @Robbie-Microsoft - can you pls have investigate? |
|
Hi @christothes @bgavrilMS |
|
@eugencutic Can you tell us the API-version that your ML environment uses? Is it 2017-09-01? Or is it 2019? |
|
Can you guide me for finding that out? It's not clear where I could check it. |
|
Sorry, I'm still waiting to chat with @gladjohn about this issue. Are you able to use the Azure CLI? If so, could you try the command |
|
Tried to run az version in the same environment, but seems like the Azure CLI is not installed. Let me know if you need me to install it and run other commands. I can install latest to the docker image if needed. |
|
@eugencutic I've just spoken with @gladjohn. We already published a fix for this bug, in our most recent release. Azure Identity for .NET may have not yet integrated the latest MSAL.NET version. You should be able to reference MSAL.NET's latest version directly and that should fix your issue. This is a temporary workaround. We'll work with Azure Identity for .NET to get a new release out as soon as possible. Please try this and let us know if it works. |
|
Tried to explicitly install MSAL.NET at 4.70.1: <Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net9.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Azure.Identity" Version="1.14.0-beta.2" />
<PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.6.0" />
<PackageReference Include="Microsoft.Identity.Client" Version="4.70.1" />
</ItemGroup>
</Project>But still not working. This is the latest console output: Looks to me like it is still trying to use MSAL at 4.69.1 anyway. |
|
According to the logs, you're still on the old version. Are you on .net classic? If so, you'll need to update bindingRedirect. |
|
I am on dotnet9, a clean rebuild did the trick 😄 |
github-project-automation
bot
moved this from Untriaged
to Done
in Azure Identity SDK Improvements
|
@christothes, do you have an ETA for when you can publish a new version of Azure-Identity-for-net that includes the latest version of MSAL.NET? |
|
It will be early May. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Library name and version
Azure.Identity 1.13.2
Describe the bug
We have a dotnet 9 console app project used as a Component in AzureML.
It was using Azure.Identity 1.11.4 to authenticate with ManagedIdentityCredential(clientId) and retrieve a secret from a KeyVault.
Code snippet:
This was running on an AzureML compute cluster which has a managed identity assigned.
After updating to Azure.Identity 1.13.2, the same code, same compute cluster and identity cannot obtain a token anymore.
Error:
Had already tried to update to Azure.Identity 1.14.0-beta, and we are seeing the same error.
Expected behavior
Expected that Azure.Identity 1.13.2 to be able to obtain tokens using ManagedIdentityCredential with a client id.
Actual behavior
After updating to Azure.Identity 1.13.2, ManagedIdentityCredential authentication fails.
Reproduction Steps
Tried to strip down the project and test just the identity part individually, so I created a separate dotnet 9 console app project with just Program.cs and the code below:
Running it against the same compute cluster and identity results in the same error as described above.
Environment
The problem appeared on an AzureML component running in an environment that uses the following Docker context:
The stripped-down project we used to replicate and debugged was run on the context above, and then we also tried to run it on a fresh environment with the following context:
On the new environment we still saw the same error.
The text was updated successfully, but these errors were encountered: