Cannot Use Azure Service Token Provider - azure

I have an Azure Function which attempts to use AzureServiceTokenProvider, but an exception is thrown when calling GetAccessTokenAsync.
var tokenProvider = new AzureServiceTokenProvider();
var result = await tokenProvider.GetAccessTokenAsync("https://database.windows.net/");
This exception is thrown when Managed Identities is turned off.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. An attempt was made to access a socket in a way forbidden by its access permissions.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command, operable program or batch file.
This exception is thrown when Managed Identities is turned on.
[Error] Executed 'MyFunction' (Failed, Id=89446c8d-6d74-44e3-ae97-73ac31cbdb6b)
An attempt was made to access a socket in a way forbidden by its access permissions.

Error is coming after enabling Managed identity because your DB is not allowing function app.
You Can Fix this by
1. Go to Azure Database in Azure Portal
2. Click on IAM
3. Adding Role
4. Search for your function app
5. save everything
6. Re-Run the Function app

Related

Getting token to access Azure keyvault fails with Operation Cancelled message

We're trying to access a secret from Azure keyvault.
The code tries to get an access token that will then be used to retrieve the secret from the keyvault.
private async Task<string> GetAccessToken(string authority, string resource, string scope)
{
...
return this.useGlobalMsiRunAs ?
await tokenProviderGlobal.Value.KeyVaultTokenCallback(authority, resource, scope) :
await tokenProvider.Value.KeyVaultTokenCallback(authority, resource, scope);
}
useGlobalMsiRunAs is set to false and the code calls tokenProvider.Value.KeyVaultTokenCallback(...).
The above call fails with Access token could not be acquired. The operation was canceled
---> Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net//xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. The operation was canceled.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net//xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net//xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired.
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthResultAsyncImpl(String resource, String authority, CancellationToken cancellationToken)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.<get_KeyVaultTokenCallback>b__12_0(String authority, String resource, String scope)
at abc.xyz.Common.Service.AzureKeyVaultAccess.GetAccessToken(String authority, String resource, String scope) in d:\dbs\el\manb\private\ClientCenter\MT\Source\Common\ClientCenter.Common.NetStandard\Service\AzureKeyVaultAccess.cs:line 472
at Microsoft.Azure.KeyVault.KeyVaultCredential.PostAuthenticate(HttpResponseMessage response)
at Microsoft.Azure.KeyVault.KeyVaultCredential.ProcessHttpRequestAsync(HttpRequestMessage request, CancellationToken cancellationToken)
at Microsoft.Azure.KeyVault.KeyVaultClient.GetSecretWithHttpMessagesAsync(String vaultBaseUrl, String secretName, String secretVersion, Dictionary`2 customHeaders, CancellationToken cancellationToken)
at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetSecretAsync(IKeyVaultClient operations, String vaultBaseUrl, String secretName, CancellationToken cancellationToken)
--- End of inner exception stack trace ---
We are using a managed identity, so the answer in this question didn't help.
Can someone please give some leads as to what could be wrong here?
You can use either system-assigned or user-assigned managed identity for your AKS Cluster’s Agent pool
Once you assign the system-assigned or user-assigned managed identity for your AKS Cluster’s Agent pool, you can add the access policy in your key vault with read access to the secrets
Then you would be able to access Azure Key vault secrets from your AKS cluster
Your code can use a managed identity to request access tokens for services that support Azure AD authentication. Azure takes care of rolling the credentials that are used by the service instance
To access key vault using system-assigned managed identity, you can use DefaultAzureCredential() class
If you are using user-assigned managed identity, you can use ManagedIdentityCredential() class
Reference: c# - How to use user-assigned managed identity to access Key Vault for Function App Config in Azure - Stack Overflow

Azure Container Instance Managed (User Assigned) Identity not able to fetch Keyvault secrets

Created a User Assigned Managed Identity Azure Resource
I deployed the Container Group with User Managed Identity as shown below:
Provided access to User Identity for a given Keyvault
Now when I am trying to access the keyvault using the following C# code, its throwing exception:
Exception
Error loading KV settings:: One or more errors occurred. (Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxxx. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxx. Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxx. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxx. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired.
)
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.
ID: f4bb823e-1c72-5777-bdd6-e89942c4f470
Version Independent ID: eb046e79-f39c-dcca-fbd4-519c0a320201
Content: Enable managed identity in container group - Azure Container Instances
Content Source: articles/container-instances/container-instances-managed-identity.md
Service: container-instances
GitHub Login: #macolso
Microsoft Alias: macolso
Here is recent error in container logs:
Startup Exception occurred: ManagedIdentityCredential authentication
failed: 'R' is an invalid start of a value. LineNumber: 0 |
BytePositionInLine: 0.
Putting a delay of 10 seconds before accessing keyvault solved the problem. but still randomly failing with the following error:
"ManagedIdentityCredential authentication failed: 'R' is an invalid start of a value. LineNumber: 0 | BytePositionInLine: 0."

Azure App Service error HTTP Error 502.5 - ANCM Out-Of-Process Startup Failure

I'm facing issue "HTTP Error 502.5 - ANCM Out-Of-Process Startup Failure" while deploying web api to azure app service. Actually I have 2 deployment slots Prod and Staging.
Earlier we deployed web api to prod slot and it is working fine.
Now we created staging slot and deployed same webapi to staging slot.
In staging slot we are getting issue.
When I check eventlog.xml in kudu, I found below errors.
Description: The process was terminated due to an unhandled
exception. Exception Info:
Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException:
Parameters: Connection String: [No connection string specified],
Resource: https://vault.azure.net, Exception Message: Tried the
following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified],
Resource: https://vault.azure.net, Exception Message: Tried to get
token using Managed Service Identity. Unable to connect to the Managed
Service Identity (MSI) endpoint. Please check that you are running on
an Azure resource that has MSI setup. Parameters: Connection String:
[No connection string specified], Resource: https://vault.azure.net,
Exception Message: Tried to get token using Visual Studio. Access
token could not be acquired. Visual Studio Token provider file not
found at
"D:\local\LocalAppData.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified],
Resource: https://vault.azure.net, Exception Message: Tried to get
token using Azure CLI. Access token could not be acquired. 'az' is not
recognized as an internal or external command,operable program or
batch file.
at
Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsyncImpl(String
authority, String resource, String scope) at
Microsoft.Azure.KeyVault.KeyVaultCredential.PostAuthenticate(HttpResponseMessage
response) at
Microsoft.Azure.KeyVault.KeyVaultCredential.ProcessHttpRequestAsync(HttpRequestMessage
request, CancellationToken cancellationToken) at
Microsoft.Azure.KeyVault.KeyVaultClient.GetSecretsWithHttpMessagesAsync(String
vaultBaseUrl, Nullable1 maxresults, Dictionary2 customHeaders,
CancellationToken cancellationToken) at
Microsoft.Azure.KeyVault.KeyVaultClientExtensions.GetSecretsAsync(IKeyVaultClient
operations, String vaultBaseUrl, Nullable1 maxresults,
CancellationToken cancellationToken) at
Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.LoadAsync()
at
Microsoft.Extensions.Configuration.AzureKeyVault.AzureKeyVaultConfigurationProvider.Load()
at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList1
providers) at
Microsoft.Extensions.Configuration.ConfigurationBuilder.Build() at
Microsoft.AspNetCore.Hosting.WebHostBuilder.BuildCommonServices(AggregateException&
hostingStartupErrors) at
Microsoft.AspNetCore.Hosting.WebHostBuilder.Build() at
MDHvNextAPI.Program.Main(String[] args) in ...
According to your error message, you have a managed identity assigned to your production environment which is used to access Azure Key Vault in order to get some secret.
When creating a new deployment slot you need to create another managed identity and grant access to it on Key Vault.
In summary: The managed identity is not shared between deployment slots.

Exception while connecting to KeyVault from Azure VM

I am running my applictaion from Azure VM and trying to connect with KeyVault. But I am getting below exception
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired.
Exception for Visual Studio token provider Microsoft.Asal.TokenService.exe : TS003: Error, TS001: This account 'username' needs re-authentication. Please go to Tools->Azure Services Authentication, and re-authenticate the account you want to use.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,
operable program or batch file.
I have checked the prerequisite such as -
1. created the KeyVault in the same resource group of the VM and added 2 secrets.
2. checked that the VM is registered in Active Directory and that it has a system assigned identity.
3. added access policy allowing read and list secrets to the VM.
Here is the code, What I am missing
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
var secret = keyVaultClient.GetSecretAsync($"https://vaultname.vault.azure.net/Secrets/connString").Result.Value;
Errors are indicating authentication issue, so 2 things to validate in order;
Confirm the VM can query Azure Metadata service
Invoke-RestMethod -Headers #{"Metadata"="true"} -URI "http://169.254.169.254/metadata/instance/compute/vmId?api-version=2017-08-01&format=text" -Method get`
If above query is successful then check the Identity API on the metadata service but if it fails then there is a communication issue between VM and Azure environment.
Confirm the VM can query the Identity API of Azure Metadata service
Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -Headers #{Metadata="true"}
If above query is successful then there is nothing wrong with MSI.
The problem was with the nuget version on Microsoft.Azure.Services.AppAuthentication. Version 1.0.3 solves this.
I'm using nuget package Azure.Identity version 1.3 and got the same issue TS003, TS001, so I tried to downgrade version to 1.2.2 and it works
In my case it was visual studio authentication issue, if your password has expired since you connected Azure stuff form visual studio, you need to re authenticate.

.NetCore 2.2 API fails to get token from AAD when using User Assigned Identity

We are unable to query a sql database in azure from an Azure App Service when using a user assigned managed identity (it works fine if we use a system assigned managed identity)
The application is a .net core 2.2 web api application.
We have a user assigned identity set up for an Azure App Service.
This identity has been set up as the ad sql admin by using the following command:
az sql server ad-admin create --resource-group iactests --server iactestsql --object-id -u iactestmanagedIdentity
The token is generated like this:
services.AddDbContext<SchoolContext>(options => options.UseSqlServer(new
SqlConnection
{
ConnectionString = configuration.GetConnectionString("SchoolContext"),
AccessToken = isDevelopmentEnvironment ? null : new AzureServiceTokenProvider().GetAccessTokenAsync("https://database.windows.net/").Result
}), ServiceLifetime.Scoped);
This is the error we get:
Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. MSI ResponseCode: BadRequest, Response:
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,
operable program or batch file.
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthResultAsyncImpl(String authority, String resource, String scope)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthenticationResultAsync(String resource, String tenantId)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsync(String resource, String tenantId)
--- End of inner exception stack trace ---
If we use a system assign identity and configure the sql ad admin to be said identity, it works fine
Any ideas?
Thanks in advance
The AppAuthentication library now supports specifying user-assigned identities for Azure VMs and App Services as of the 1.2.0-preview2 release.
To use a user-assigned identity, you will need to set an AppAuthentication connection string of the format:
RunAs=App;AppId={ClientId of user-assigned identity}
The AppAuthentication connection string can be set as an argument passed to the AzureServiceTokenProvider constructor or specified in the AzureServicesAuthConnectionString environment variable. For more information on AppAuthentication connection strings, see here.
It looks like AzureServiceTokenProvider does not support user assigned managed identities, at least at this point. AzureServiceTokenProvder is a wrapper over the local HTTP endpoint that provides tokens to the application.
I was looking into this, and appears that you must provide the clientId of the user assigned managed identity to the endpoint to get a token. And AzureServiceTokenProvider doesn't have a way to do that (at least that I could figure out).
User assigned managed identities adds the ability to have multiple User assigned managed identities for an application. So the API to get a token needs to specify which MSI you want, the system-assigned MSI, or one of the user-assigned MSIs. The way the HTTP endpoint does this is that it uses the system-assigned MSI unless you specify a clientId.
In any case, you can hit the token endpoint directly, and provide the clientId of the user-assigned MSI like this:
public async Task<String> GetToken(string resource, string clientId = null)
{
var endpoint = System.Environment.GetEnvironmentVariable("MSI_ENDPOINT", EnvironmentVariableTarget.Process);
var secret = System.Environment.GetEnvironmentVariable("MSI_SECRET", EnvironmentVariableTarget.Process);
if (string.IsNullOrEmpty(endpoint))
{
throw new InvalidOperationException("MSI_ENDPOINT environment variable not set");
}
if (string.IsNullOrEmpty(secret))
{
throw new InvalidOperationException("MSI_SECRET environment variable not set");
}
Uri uri;
if (clientId == null)
{
uri = new Uri($"{endpoint}?resource={resource}&api-version=2017-09-01");
}
else
{
uri = new Uri($"{endpoint}?resource={resource}&api-version=2017-09-01&clientid={clientId}");
}
// get token from MSI
var tokenRequest = new HttpRequestMessage()
{
RequestUri = uri,
Method = HttpMethod.Get
};
tokenRequest.Headers.Add("secret", secret);
var httpClient = new HttpClient();
var response = await httpClient.SendAsync(tokenRequest);
var body = await response.Content.ReadAsStringAsync();
var result = JObject.Parse(body);
string token = result["access_token"].ToString();
return token;
}

Resources