Skip to content

Authentication fails for User Assigned Managed Identity #6

Description

@shivatk

Calling AzureCacheForRedis.ConfigureForAzureWithUserAssignedManagedIdentityAsync method fails with "Identity not found" error.

I've tested this code in an Azure managed VM and in an AKS container, and in both cases, the ConfigureForAzureWithUserAssignedManagedIdentityAsync fails with the following error -->

MSAL.NetCore.4.53.0.0.MsalServiceException: 
ErrorCode: managed_identity_request_failed
Microsoft.Identity.Client.MsalServiceException: [Managed Identity] Authentication unavailable. The requested identity has not been assigned to this resource.
Status: BadRequest
Content:
{"error":"invalid_request","error_description":"Identity not found"}

Inside the method call stack, the ImdsManagedIdentitySource.CreateRequest method makes a request to the Azure Instance Metadata Service (IMDS) endpoint -->

GET http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=acca5fbb-b7e4-4009-81f1-37e38fd66d78&mi_res_id={User_Client_ID}HTTP/1.1
Host: 169.254.169.254
Metadata: true
Accept: application/json

Making this same request manually from the VM/Container also fails with "Identity not found". I believe this is because the wrong query parameter is being used in the request. The mi_res_id query param is for the Resource ID and not Client ID. (reference here)

If I change the mi_res_id query param to client_id, the request succeeds, and I get a valid token. Alternatively, if I pass ResourceID of the User Identity instead of the ClientID to the ConfigureForAzureWithUserAssignedManagedIdentityAsync method, connection succeeds.

Looking at ImdsManagedIdentitySource.CreateRequest, ServiceBundle.Config.ManagedIdentityId.IdType is read to determine which query param to use. I'm unsure why ManagedIdentityIdType.ResourceId is being picked up instead of ManagedIdentityIdType.ClientId.


Package Microsoft.Azure.StackExchangeRedis Version 1.1.0

Steps to reproduce:

  1. Create a VM or AKS cluster in Azure.
  2. Create a User Assigned Managed Identity and assign it to the VM/AKS cluster.
  3. Run sample app from this repo and call ConfigureForAzureWithUserAssignedManagedIdentityAsync method with valid Principal ID and Client ID.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions