Calling AzureCacheForRedis.ConfigureForAzureWithUserAssignedManagedIdentityAsync method fails with "Identity not found" error.
I've tested this code in an Azure managed VM and in an AKS container, and in both cases, the ConfigureForAzureWithUserAssignedManagedIdentityAsync fails with the following error -->
MSAL.NetCore.4.53.0.0.MsalServiceException:
ErrorCode: managed_identity_request_failed
Microsoft.Identity.Client.MsalServiceException: [Managed Identity] Authentication unavailable. The requested identity has not been assigned to this resource.
Status: BadRequest
Content:
{"error":"invalid_request","error_description":"Identity not found"}
Inside the method call stack, the ImdsManagedIdentitySource.CreateRequest method makes a request to the Azure Instance Metadata Service (IMDS) endpoint -->
GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=acca5fbb-b7e4-4009-81f1-37e38fd66d78&mi_res_id={User_Client_ID}HTTP/1.1
Host: 169.254.169.254
Metadata: true
Accept: application/json
Making this same request manually from the VM/Container also fails with "Identity not found". I believe this is because the wrong query parameter is being used in the request. The mi_res_id query param is for the Resource ID and not Client ID. (reference here)
If I change the mi_res_id query param to client_id, the request succeeds, and I get a valid token. Alternatively, if I pass ResourceID of the User Identity instead of the ClientID to the ConfigureForAzureWithUserAssignedManagedIdentityAsync method, connection succeeds.
Looking at ImdsManagedIdentitySource.CreateRequest, ServiceBundle.Config.ManagedIdentityId.IdType is read to determine which query param to use. I'm unsure why ManagedIdentityIdType.ResourceId is being picked up instead of ManagedIdentityIdType.ClientId.
Package Microsoft.Azure.StackExchangeRedis Version 1.1.0
Steps to reproduce:
- Create a VM or AKS cluster in Azure.
- Create a User Assigned Managed Identity and assign it to the VM/AKS cluster.
- Run sample app from this repo and call ConfigureForAzureWithUserAssignedManagedIdentityAsync method with valid Principal ID and Client ID.
Calling AzureCacheForRedis.ConfigureForAzureWithUserAssignedManagedIdentityAsync method fails with "Identity not found" error.
I've tested this code in an Azure managed VM and in an AKS container, and in both cases, the ConfigureForAzureWithUserAssignedManagedIdentityAsync fails with the following error -->
Inside the method call stack, the ImdsManagedIdentitySource.CreateRequest method makes a request to the Azure Instance Metadata Service (IMDS) endpoint -->
Making this same request manually from the VM/Container also fails with "Identity not found". I believe this is because the wrong query parameter is being used in the request. The mi_res_id query param is for the Resource ID and not Client ID. (reference here)
If I change the mi_res_id query param to client_id, the request succeeds, and I get a valid token. Alternatively, if I pass ResourceID of the User Identity instead of the ClientID to the ConfigureForAzureWithUserAssignedManagedIdentityAsync method, connection succeeds.
Looking at ImdsManagedIdentitySource.CreateRequest, ServiceBundle.Config.ManagedIdentityId.IdType is read to determine which query param to use. I'm unsure why ManagedIdentityIdType.ResourceId is being picked up instead of ManagedIdentityIdType.ClientId.
Package Microsoft.Azure.StackExchangeRedis Version 1.1.0
Steps to reproduce: