Closed richardissimo closed 1 month ago
Thank you for your feedback. Tagging and routing to the team member best able to assist.
Hi @richardissimo -
Based on the exception information, it seems that your local environment has a proxy or some other service that is responding to the IMDS endpoint request (http://169.254.169.254/metadata/identity/oauth2/token
). In scenarios like this, I'm afraid your best option is to add some conditional code to your application for excluding managed identity. For example:
var options = new DefaultAzureCredentialOptions();
if (null != Environment.GetEnvironmentVariable("EXCLUDE_MANAGED_IDENTITY"))
{
options.ExcludeManagedIdentityCredential = true;
}
This environment variable would only be defined on local development environments, so the managed identity will be detected when the code is deployed.
Hi @richardissimo. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.
I can certainly do that as a workaround; but isn't the point that regardless of the cause of this particular error, none of the strategies which fail should be able to steal the limelight from a strategy which works?
In fact, I've realised that the deja vu I've been having is real. Here's a very similar issue I posted a couple of years ago, even down to the 403 status of a ManagedIdentity strategy blocking other approaches from working... https://github.com/Azure/azure-sdk-for-net/issues/32061 ...and that one led to a change.
Hi @richardissimo - You are correct that we should be able to detect scenarios where the response is clearly not json and treat it as a CredentialUnavailableException, which would skip the managed identity credential in the chain. We'll consider this for a future release.
tracking with #45184
Library name and version
Azure.Identity 1.12.0
Describe the bug
I'm working with an Azure Storage Account, via
Azure.Storage.Blobs
, and usingDefaultAzureCredential
as my credentials. The program is crashing out when trying the ManagedIdentityCredential alternative, and if I set theExcludeManagedIdentityCredential = true
option, then the code works properly.My understanding of
DefaultAzureCredential
is that it would try all of the alternative approaches, until they have all failed, and only then explain why each approach failed (because if any of them worked, then the failures don't matter)... so I think this might be a bug.Expected behavior
The exception shown above is coming from the ManagedIdentity option, which will not work because I'm on-premise, so I am expecting that approach to fail. However, one of the other approaches will work (as proven if I uncomment the commented line). My expectation is that the failure of that approach should not be allowed to crash the application, because one of the other approaches works. I cannot put the
ExcludeManagedIdentityCredential = true
code in the real code, because once deployed, that will be running in Azure as a managed identity, so will actually require that approach.Actual behavior
If I run that code as shown in Repro Steps (either debugging from Visual Studio, or by running the EXE; but both are on my machine, which is a physical computer rather than something in the cloud), it fails with the exception below, on the final line of the program. However, if I uncomment the commented line, the code succeeds, which implies that one of the other credentials used by DefaultAzureCredential worked - so I don't think it should be complaining when the ManagedIdentity approach fails.
Exception
Reproduction Steps
I have an MCVE which repeats the problem for me, although it may be a problem for others to repeat, because I suspect the reason that the Managed Identity approach is failing, is because it's being blocked by my employer's web gateway blocking the URL that it's trying to contact (see the exception).
Project File
Program.cs
Environment
.NET SDK: Version: 8.0.300 Commit: 326f6e68b2 Workload version: 8.0.300-manifests.5273bb1c MSBuild version: 17.10.4+10fbfbf2e
Runtime Environment: OS Name: Windows OS Version: 10.0.19045 OS Platform: Windows RID: win-x64 Base Path: C:\Program Files\dotnet\sdk\8.0.300\
.NET workloads installed: [aspire] Installation Source: VS 17.10.35004.147 Manifest Version: 8.0.0/8.0.100 Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.aspire\8.0.0\WorkloadManifest.json Install Type: FileBased
Host: Version: 8.0.5 Architecture: x64 Commit: 087e15321b
.NET SDKs installed: 5.0.408 [C:\Program Files\dotnet\sdk] 6.0.423 [C:\Program Files\dotnet\sdk] 8.0.300 [C:\Program Files\dotnet\sdk]
.NET runtimes installed: Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 6.0.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 6.0.31 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 7.0.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.AspNetCore.App 8.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 6.0.31 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 7.0.19 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.NETCore.App 8.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.30 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 6.0.31 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 7.0.19 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App] Microsoft.WindowsDesktop.App 8.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Other architectures found: x86 [C:\Program Files (x86)\dotnet] registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]
Environment variables: Not set
global.json file: Not found