[AppConfiguration] 403 when using DefaultAzureCredential or VisualStudioCodeCredential with App Configuration

• Package Name: app-configuration
• Package Version: 1.1.0
• Operating system: Windows 10
• nodejs
  • version: 12.16.0
• typescript
  • version: 4.0.5

Describe the bug With VSCode with the Azure Account extension described here I’m trying to access App Configuration, but I’m getting a 403 error when attempting to read a configuration key.

RestError:  
 {
  "name": "RestError",
  "statusCode": 403,
  "request": {
    "streamResponseBody": false,
    "url": "https://[app-config-name].azconfig.io/kv/inf%2FcdnUrl?api-version=1.0",
    "method": "GET",
    "headers": {
      "_headersMap": {
        "content-type": "application/json; charset=utf-8",
        "user-agent": "azsdk-js-app-configuration/1.1.0 core-http/1.2.0 Node/v12.16.0 OS/(x64-Windows_NT-10.0.18362)",
        "x-ms-client-request-id": "[clientid]",
        "authorization": "REDACTED",
        "cookie": "REDACTED"
      }
    },
    "withCredentials": false,
    "timeout": 0,
    "requestId": "b3acfdcf-748b-4ca1-a926-278359bbd592"
  },
  "details": {},
  "message": ""
}

To Reproduce Steps to reproduce the behavior:

1. With the following dependencies:

    "@azure/app-configuration": "^1.1.0",
    "@azure/identity": "^1.1.0",
    "@azure/keyvault-secrets": "^4.1.0",
    "dotenv": "^8.2.0"

1. When I run this code:

import { VisualStudioCodeCredential, DefaultAzureCredential } from "@azure/identity"
import { AppConfigurationClient } from "@azure/app-configuration"
import { SecretClient } from "@azure/keyvault-secrets"

const credentials = new DefaultAzureCredential()

const client = new SecretClient(process.env.KV_ENDPOINT!, credentials)
console.log(await client.getSecret("test-secret")) // Works

const appConfigClientSecret = new AppConfigurationClient(process.env.CONNECTION_STRING!)
console.log(await appConfigClientSecret.getConfigurationSetting({ key: "inf/cdnUrl" })) // Works
	
const appConfigClient = new AppConfigurationClient(process.env.APPCONFIG_ENDPOINT!, credentials)
console.log(await appConfigClient.getConfigurationSetting({ key: "inf/cdnUrl" })) // Fails with 403:

The first two calls (Key Vault and App Configuration with connection string) works.

Expected behavior The call to:

appConfigClient.getConfigurationSetting({ key: "inf/cdnUrl" })

should work with DefaultAzureCredential like the Key Vault call does.

Additional context Originally there was a problem with the Azure Account extension. It was addressed here: https://github.com/microsoft/vscode-azure-account/issues/234

[rudfoss]

I did a retest and here are the results. This time I waited for at least 10 minutes in an attempt to ensure the role assignments were updated.

Role	Access config via API	Access config via portal	Access to resource via portal
Owner	❌	✔	✔
Reader	❌	❌	✔
App Configuration Data Reader	✔	❌	❌
App Configuration Data Owner	✔	❌	❌

Based on this it seems that the Owner role is not sufficient to read data via the API, but it is enough to read through the portal which I find strange. Shouldn’t the roles grant the same access regardless of the method used for access?

In any case since this now seems to work for App Configuration roles I’ll set up our assignments to reflect this so that developers can work with it.

Since I’m not sure if this is a bug or not I’m fine with closing this issue. But maybe some clarity on the Owner and Reader roles could be added to the documentation?

[chradek]

Apologies for the delayed response here. I reached out to the service team to let them know the page on roles could use some clarification so am closing the issue here on our side.

This comment summarizes the access behavior working in the portal vs the API very well.