search

Azure / Microsoft.Azure.StackExchangeRedis

Azure-specific wrapper for the StackExchange.Redis client library
MIT License
17 stars 14 forks source link

ConfigureForAzureWithUserAssignedManagedIdentityAsync() not working with Microsoft.Identity.Client 4.54.1 #18

Closed mirjana1211 closed 1 year ago

mirjana1211 commented 1 year ago

I am connecting to Redis from Azure AppService using user assigned identity. After adding Azure.Identity (1.10.0) nuget package to the same project, I have started receiving the following error when calling ConfigureForAzureWithUserAssignedManagedIdentityAsync:

System.MissingMethodException: 'Method not found: 'Microsoft.Identity.Client.ManagedIdentityApplicationBuilder Microsoft.Identity.Client.ManagedIdentityApplicationBuilder.Create(System.String)'.'

I could verify that the issue does not occur witht and older version of Microsoft.IdentityClient. In my case, the installation of Azure.Identity raised the version of Microsoft.Identity.Client from 4.53.0 to 4.54.1.

mcraiha commented 1 year ago

Same happens with ConfigureForAzureWithSystemAssignedManagedIdentityAsync, but at least in my case Azure.Identity (1.9.0) works correctly.

lsannicolas commented 1 year ago

It looks like this is caused by a method change in the update as you mentioned from 4.53.0 to 4.54.1. See more here (https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.managedidentityapplicationbuilder.create?view=msal-dotnet-latest#definition). We should be updating this with the next release to make sure it works with Microsoft.Identity.Client 4.,54.1

tompazourek commented 1 year ago

This issue has been already fixed long time ago on Jun 1, 2023 in https://github.com/Azure/Microsoft.Azure.StackExchangeRedis/pull/7.

What's missing is to release it. The currently latest 1.1.0 from May does NOT YET include this change.

tompazourek commented 1 year ago

@philon-msft Can you please release the latest version of this package that includes #7?

tompazourek commented 1 year ago

A month has passed, and still nothing has changed. This is now a more serious issue as there's a CVE in Azure.Identity (https://github.com/advisories/GHSA-5mfx-4wcx-rv27) which also relates to these package versions...

tompazourek commented 1 year ago

All that needs to happen is to take the current code that's already master since June and release it as package 1.1.1 or 1.2.0.

Maybe @lsannicolas can help with this?

The CVE in Azure.Identity forces an update of "Microsoft.Identity.Client" to version incompatible with "Microsoft.Azure.StackExchangeRedis".

sigurdmwahl commented 1 year ago

I am also experiencing this issue and waiting for this to be resolved.

philon-msft commented 1 year ago

The new release v2.0.0 uses the latest Microsoft.Identity.Client package. Please give it a try and let us know if you still see any issues.