search

microsoft / PowerPlatform-DataverseServiceClient

Code Replica for Microsoft.PowerPlatform.Dataverse.Client and supporting nuget packages.
MIT License
279 stars 50 forks source link

Unable to cache Entra access token in Azure App Service #471

Open s-ryan opened 2 days ago

s-ryan commented 2 days ago

Hi,

I'm a senior developer with Wakefield Council in the north of England.

We have implemented a self service web application portal for Wakefield residents that enables them to raise service requests in our Dynamics 365 CRM. The portal application is hosted in an Azure app service and is registered with our Entra ID instance

We have been intermittently seeing an issue where the following Exception is raised at the point the portal attempts to connect to CRM

'Your app has been throttled by AAD due to too many requests. To avoid this, cache your tokens see https://aka.ms/msal-net-throttling'

we are using the Microsoft.PowerPlatform.Dataverse.Client.ServiceClient to connect.

This is our connection string:

"AuthType=OAuth;Url=[our dynamics instance];Username=[xxxx];Password=[xxxxx];AppId=[xxxx];LoginPrompt=Never;useUniqueInstance=false;TokenCacheStorePath=C:\home\data\jobs\continuous\MyAccountTokenCache\token.dat"

Caching of access tokens is working fine on our development machines and we cannot replicate the throttling issue. The file path and token.dat file are being created automatically at the point we first connect to CRM.

However in our Azure environments the file path isn't being created and the token.dat file isn't being written to. We have manually created the necessary file structure using Kudu but the token.dat file still doesn't get written to. Therefore we are encountering the throttling issue.

Any help that you can give would be greatly appreciated.

Regards

Shaun

MattB-msft commented 1 day ago

@s-ryan In this scenario, you should consider using Applicaiton Users (client id/secret/cert/managed identity) vs a Named User, the auth flow is cleaner and it uses a memory cache system on the host vs file system cache.

Depending on your volume you may want to use asp.net's built in MSAL integration. In that case you would use a custom token provider for Dataverse ServiceClient,

If you want to use Managed identity You can either use the extension we provide for AzAuth, or you can build one up on your own based on MSAL.
You can find a code example of a custom auth provider here: https://github.com/microsoft/PowerPlatform-DataverseServiceClient/blob/master/src/GeneralTools/DataverseClient/Extensions/Microsoft.PowerPlatform.Dataverse.Client.AzAuth/AzAuth.cs