I am running my applictaion from Azure VM and trying to connect with KeyVault. But I am getting below exception
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired.
Exception for Visual Studio token provider Microsoft.Asal.TokenService.exe : TS003: Error, TS001: This account 'username' needs re-authentication. Please go to Tools->Azure Services Authentication, and re-authenticate the account you want to use.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/1e465dc8-5f36-4ab9-9a49-57cbfdcfdf9a. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,
operable program or batch file.
I have checked the prerequisite such as -
1. created the KeyVault in the same resource group of the VM and added 2 secrets.
2. checked that the VM is registered in Active Directory and that it has a system assigned identity.
3. added access policy allowing read and list secrets to the VM.
Here is the code, What I am missing
public void ConfigureServices(IServiceCollection services)
{
services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
var azureServiceTokenProvider = new AzureServiceTokenProvider();
var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
var secret = keyVaultClient.GetSecretAsync($"https://vaultname.vault.azure.net/Secrets/connString").Result.Value;
Errors are indicating authentication issue, so 2 things to validate in order;
Confirm the VM can query Azure Metadata service
Invoke-RestMethod -Headers #{"Metadata"="true"} -URI "http://169.254.169.254/metadata/instance/compute/vmId?api-version=2017-08-01&format=text" -Method get`
If above query is successful then check the Identity API on the metadata service but if it fails then there is a communication issue between VM and Azure environment.
Confirm the VM can query the Identity API of Azure Metadata service
Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -Headers #{Metadata="true"}
If above query is successful then there is nothing wrong with MSI.
The problem was with the nuget version on Microsoft.Azure.Services.AppAuthentication. Version 1.0.3 solves this.
I'm using nuget package Azure.Identity version 1.3 and got the same issue TS003, TS001, so I tried to downgrade version to 1.2.2 and it works
In my case it was visual studio authentication issue, if your password has expired since you connected Azure stuff form visual studio, you need to re authenticate.
Related
I am trying to get the access token of the service principal using the following code.
$authUrl = "https://login.windows.net/" + $tenantid + "/oauth2/token/"
$body = #{
grant_type = "client_credentials"
client_id = $serviceprincipalid
resource = "https://management.azure.com/"
client_secret = $serviceprincipalkey
};
$response = Invoke-RestMethod –Uri $authUrl –Method POST –Body $body
Write-Host $response
Write-Output $response.access_token
##vso[task.setvariable variable=myToken;]$response.access_token
The above code is working perfectly at my local machine's PowerShell but it is giving the following error when I am running the same code base in the Azure DevOps pipeline.
ClientSecretCredential authentication failed: A configuration issue is preventing
authentication - check the error message from the server for details. You can modify the
configuration in the application registration portal. See https://aka.ms/msal-net-invalid-
client for details. Original exception: AADSTS7000222: The provided client secret keys are
expired. Visit the Azure Portal to create new keys for your app, or consider using certificate
credentials for added security: https://learn.microsoft.com/azure/active-
directory/develop/active-directory-certificate-credentials
Trace ID: 98787ui7-e8ae-4712-b8b5-7678u8765rt5
Correlation ID: yhjnbv43-56sy-9ksy-b8b5-mj876yu78i90
Timestamp: 2021-03-16 12:32:28Z
There was an error with the service principal used for the deployment.`
I checked the secret keys, but the secret keys not expired, it's expiry date is already set for the year 2022. And if it would expire then the code should not have worked at my local machine's PowerShell.
Does anyone have any idea? please let me know to resolve this issue.
Well, actually the error was not caused by the script above, per my test, it works fine in devops.
If you use the Azure PowerShell task, it will let you configure a service connection to use, when you run the task, it will connect Azure powershell with the service principal configured in the service connection automatically. The error was caused by the expired secret of the service principal configured in the service connection, not the one in your script.
I can also reproduce your issue on my side.
To solve this issue, please follow the steps below.
1.Navigate to the Azure PowerShell task, check which service connection you used.
2.Navigate to the Project Settings in devops -> Service connections -> find the one you used -> click it -> Manage Service Principal.
Then it will open the related AD App page, just create a new secret and service connection, use it in the Azure Powershell task, follow the same steps I have mentioned here.
3.After configuration, test it again, it will work fine.
Created a User Assigned Managed Identity Azure Resource
I deployed the Container Group with User Managed Identity as shown below:
Provided access to User Identity for a given Keyvault
Now when I am trying to access the keyvault using the following C# code, its throwing exception:
Exception
Error loading KV settings:: One or more errors occurred. (Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxxx. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxx. Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxx. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/xxxxxxxx. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired.
)
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.
ID: f4bb823e-1c72-5777-bdd6-e89942c4f470
Version Independent ID: eb046e79-f39c-dcca-fbd4-519c0a320201
Content: Enable managed identity in container group - Azure Container Instances
Content Source: articles/container-instances/container-instances-managed-identity.md
Service: container-instances
GitHub Login: #macolso
Microsoft Alias: macolso
Here is recent error in container logs:
Startup Exception occurred: ManagedIdentityCredential authentication
failed: 'R' is an invalid start of a value. LineNumber: 0 |
BytePositionInLine: 0.
Putting a delay of 10 seconds before accessing keyvault solved the problem. but still randomly failing with the following error:
"ManagedIdentityCredential authentication failed: 'R' is an invalid start of a value. LineNumber: 0 | BytePositionInLine: 0."
I have an Azure Function which attempts to use AzureServiceTokenProvider, but an exception is thrown when calling GetAccessTokenAsync.
var tokenProvider = new AzureServiceTokenProvider();
var result = await tokenProvider.GetAccessTokenAsync("https://database.windows.net/");
This exception is thrown when Managed Identities is turned off.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. An attempt was made to access a socket in a way forbidden by its access permissions.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command, operable program or batch file.
This exception is thrown when Managed Identities is turned on.
[Error] Executed 'MyFunction' (Failed, Id=89446c8d-6d74-44e3-ae97-73ac31cbdb6b)
An attempt was made to access a socket in a way forbidden by its access permissions.
Error is coming after enabling Managed identity because your DB is not allowing function app.
You Can Fix this by
1. Go to Azure Database in Azure Portal
2. Click on IAM
3. Adding Role
4. Search for your function app
5. save everything
6. Re-Run the Function app
I have a docker image containing an ASP.NET Core app that uses Azure Key vault to access things like connection strings. When I run the image locally, I get this error:
Unhandled Exception: Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/[guid]. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/[guid]. Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/[guid]. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connection String: [No connection string specified], Resource: https://vault.azure.net, Authority: https://login.windows.net/[guid]. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. /bin/bash: az: No such file or directory
From what I understand, it first tries to get the access token as a managed service identity. As it's not running in the Azure cloud, it can't do this and tries to get it through visual studio connected service. As this won't be on the docker image, it tries using the Azure CLI, but this isn't installed on the docker image.
So I need to install the Azure CLI into the docker image. How is this done, given that the base image of the Dockerfile is FROM microsoft/dotnet:2.1-aspnetcore-runtime?
Is this base image an Alpine OS image, so do I need to look at installing Azure CLI with Alpine?
Assuming I have Azure CLI installed, is there a way to access Key vault without storing any credentials in Dockerfile source code or passing them to the container through plain text?
More generally, what is the best approach here.
My current solution is to use an environment variable with the access token.
Get the key and store in environment variable (after you did an az login and set the correct subscription):
$Env:ACCESS_TOKEN=(az account get-access-token --resource=https://vault.azure.net | ConvertFrom-Json).accessToken
The we add that environment variable in Visual Studio:
Change the code to:
config.AddEnvironmentVariables();
KeyVaultClient keyVaultClient;
var accessToken = Environment.GetEnvironmentVariable("ACCESS_TOKEN");
if (accessToken != null)
{
keyVaultClient = new KeyVaultClient(
async (string a, string r, string s) => accessToken);
}
else
{
var azureServiceTokenProvider = new AzureServiceTokenProvider();
keyVaultClient = new KeyVaultClient(
new KeyVaultClient.AuthenticationCallback(
azureServiceTokenProvider.KeyVaultTokenCallback));
}
config.AddAzureKeyVault(
$"https://{builtConfig["KeyVaultName"]}.vault.azure.net/",
keyVaultClient,
new DefaultKeyVaultSecretManager());
Solution (not for production use)
A possible Solution to your Problem is to generate a Service Principal (SP) and grant this Service Principal access to the key vault (via RBAC or IAM). Microsoft Documentation on creating a SP
Using the credentials of the SP as client-id and client-secret (Random example) you can then log into the vault and retrieve the secrets.
Concerns
with this approach, you will introduce secrets into the code (propably the exact reason why you use the key vault). I suppose the local docker image is for development use only. Therefore I would recommend creating a Keyvault just for development (and access it using SP) while using a separate Kevault for Production where one of the established, secret-less authentication schemes is used.
You must make sure that the key vault allows access from outside the azure cloud (see the access policies on portal.azure.com)
In an attempt to simplify and automate E. Staal's answer, I came up with this:
Update your .gitignore file, by adding the following line to the bottom of it:
appsettings.local.json
Right click on the project in Solution Explorer, and click on Properties; in the Build Events tab, find the Pre-build event command line text box and add the following code:
cd /d "$(ProjectDir)"
if exist "appsettings.local.json" del "appsettings.local.json"
if "$(ConfigurationName)" == "Debug" (
az account get-access-token --resource=https://vault.azure.net > appsettings.local.json
)
In your launchSettings.json (or using the Visual Editor under project settings) configure the following values:
{
"profiles": {
// ...
"Docker": {
"commandName": "Docker",
"environmentVariables": {
"DOTNET_ENVIRONMENT": "Development",
"AZURE_TENANT_ID": "<YOUR-AZURE-TENANT-ID-HERE>"
}
}
}
}
In your Program.cs file find the CreateHostBuilder method and update the ConfigureAppConfiguration block accordingly -- here is mine as an example:
Host.CreateDefaultBuilder(args).ConfigureAppConfiguration
(
(ctx, cfg) =>
{
if (ctx.HostingEnvironment.IsDevelopment())
{
cfg.AddJsonFile("appsettings.local.json", true);
}
var builtConfig = cfg.Build();
var keyVault = builtConfig["KeyVault"];
if (!string.IsNullOrWhiteSpace(keyVault))
{
var accessToken = builtConfig["accessToken"];
cfg.AddAzureKeyVault
(
$"https://{keyVault}.vault.azure.net/",
new KeyVaultClient
(
string.IsNullOrWhiteSpace(accessToken)
? new KeyVaultClient.AuthenticationCallback
(
new AzureServiceTokenProvider().KeyVaultTokenCallback
)
: (x, y, z) => Task.FromResult(accessToken)
),
new DefaultKeyVaultSecretManager()
);
}
}
)
If this still doesn't work, verify that az login has been performed and that az account get-access-token --resource=https://vault.azure.net works correctly for you.
Although there's some time since you make this question, another option, suitable for production environments, would be using an x509 certificate.
Microsoft has this article explaining how to do this. You can use self-signed certificates or any other valid SSL certificate. That depends on your needs.
This is because your docker container is running as root user and the user registered in key vault is some other user (yourusername#yourcmpany.com)
We are unable to query a sql database in azure from an Azure App Service when using a user assigned managed identity (it works fine if we use a system assigned managed identity)
The application is a .net core 2.2 web api application.
We have a user assigned identity set up for an Azure App Service.
This identity has been set up as the ad sql admin by using the following command:
az sql server ad-admin create --resource-group iactests --server iactestsql --object-id -u iactestmanagedIdentity
The token is generated like this:
services.AddDbContext<SchoolContext>(options => options.UseSqlServer(new
SqlConnection
{
ConnectionString = configuration.GetConnectionString("SchoolContext"),
AccessToken = isDevelopmentEnvironment ? null : new AzureServiceTokenProvider().GetAccessTokenAsync("https://database.windows.net/").Result
}), ServiceLifetime.Scoped);
This is the error we get:
Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. MSI ResponseCode: BadRequest, Response:
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio Token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https://database.windows.net/, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,
operable program or batch file.
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthResultAsyncImpl(String authority, String resource, String scope)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAuthenticationResultAsync(String resource, String tenantId)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsync(String resource, String tenantId)
--- End of inner exception stack trace ---
If we use a system assign identity and configure the sql ad admin to be said identity, it works fine
Any ideas?
Thanks in advance
The AppAuthentication library now supports specifying user-assigned identities for Azure VMs and App Services as of the 1.2.0-preview2 release.
To use a user-assigned identity, you will need to set an AppAuthentication connection string of the format:
RunAs=App;AppId={ClientId of user-assigned identity}
The AppAuthentication connection string can be set as an argument passed to the AzureServiceTokenProvider constructor or specified in the AzureServicesAuthConnectionString environment variable. For more information on AppAuthentication connection strings, see here.
It looks like AzureServiceTokenProvider does not support user assigned managed identities, at least at this point. AzureServiceTokenProvder is a wrapper over the local HTTP endpoint that provides tokens to the application.
I was looking into this, and appears that you must provide the clientId of the user assigned managed identity to the endpoint to get a token. And AzureServiceTokenProvider doesn't have a way to do that (at least that I could figure out).
User assigned managed identities adds the ability to have multiple User assigned managed identities for an application. So the API to get a token needs to specify which MSI you want, the system-assigned MSI, or one of the user-assigned MSIs. The way the HTTP endpoint does this is that it uses the system-assigned MSI unless you specify a clientId.
In any case, you can hit the token endpoint directly, and provide the clientId of the user-assigned MSI like this:
public async Task<String> GetToken(string resource, string clientId = null)
{
var endpoint = System.Environment.GetEnvironmentVariable("MSI_ENDPOINT", EnvironmentVariableTarget.Process);
var secret = System.Environment.GetEnvironmentVariable("MSI_SECRET", EnvironmentVariableTarget.Process);
if (string.IsNullOrEmpty(endpoint))
{
throw new InvalidOperationException("MSI_ENDPOINT environment variable not set");
}
if (string.IsNullOrEmpty(secret))
{
throw new InvalidOperationException("MSI_SECRET environment variable not set");
}
Uri uri;
if (clientId == null)
{
uri = new Uri($"{endpoint}?resource={resource}&api-version=2017-09-01");
}
else
{
uri = new Uri($"{endpoint}?resource={resource}&api-version=2017-09-01&clientid={clientId}");
}
// get token from MSI
var tokenRequest = new HttpRequestMessage()
{
RequestUri = uri,
Method = HttpMethod.Get
};
tokenRequest.Headers.Add("secret", secret);
var httpClient = new HttpClient();
var response = await httpClient.SendAsync(tokenRequest);
var body = await response.Content.ReadAsStringAsync();
var result = JObject.Parse(body);
string token = result["access_token"].ToString();
return token;
}