Unable to use MSI on Ubuntu

This is autogenerated. Please review and update as needed.

Describe the bug

Hi,

I’m following this guide: https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication-managed-identity#example-2-access-with-a-system-assigned-identity on a MSI enabled HDInsight cluster.

I have written my own python code to access AKV today, so I know MSI works on this machine. However, the CLI to auth into ACR is broken.

Command Name az login

Errors:

Traceback (most recent call last):
python3.6/site-packages/knack/cli.py, ln 215, in invoke
    cmd_result = self.invocation.execute(args)
cli/core/commands/__init__.py, ln 654, in execute
    raise ex
cli/core/commands/__init__.py, ln 718, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
cli/core/commands/__init__.py, ln 711, in _run_job
    six.reraise(*sys.exc_info())
lib/python3.6/site-packages/six.py, ln 703, in reraise
    raise value
...
python3.6/site-packages/msrestazure/azure_active_directory.py, ln 600, in set_token
    token_entry = self._vm_msi.get_token(self.resource)
python3.6/site-packages/msrestazure/azure_active_directory.py, ln 649, in get_token
    token_entry = self._retrieve_token_from_imds_with_retry(resource)
python3.6/site-packages/msrestazure/azure_active_directory.py, ln 704, in _retrieve_token_from_imds_with_retry
    raise HTTPError(request=result.request, response=result.raw)
requests.exceptions.HTTPError

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here…
• az login --identity

Expected Behavior

I should able to authenticate as the machine.

Environment Summary

Linux-4.15.0-1089-azure-x86_64-with-debian-stretch-sid
Python 3.6.10
Installer: DEB

azure-cli 2.8.0

Additional Context

[anduran]

@cpdohert I need to make an important distinction. My issue was with an HDI cluster, which nodes do use Ubuntu. But these cases are completely separate, because [as I learned afterwards] HDI implements MSI in an unorthodox way.

Long story short, after talking with a CSS I understood what the issue was and accepted that at least for HDI this wouldn’t work and moved to other alternatives for auth.

I don’t really know about VMs case, as it sounds like it should work so I will let @jiasli answer that one, just wanted to be clear that from the HDI support side, I consider this one closed 😃

[jiasli]

I will improve the error message in the Azure Identity Integration process.

@anduran, thank you for letting us know the root cause. I will also take that as a future reference.

@cpdohert, meanwhile, if you are still facing issue getting an access token with Azure CLI or curl. You may reach out to customer support to troubleshoot on the machine-side.