Intermittent ManagedIdentityCredential authentication failure

• Package Name: @azure/identity
• Package Version: 1.2.3
• Package Name: @azure/service-bus
• Package Version: 7.0.3
• Operating system: Ubuntu 20.04.2. LTS
• nodejs
  • version: v12.18.2
• typescript
  • version: 4.1.5

Describe the bug (I do not know that this is an actual bug.) I frequently see ‘ManagedIdentityCredential authentication failures’ when using DefaultAzureCredential on my laptop. This behavior is highly intermittent and I don’t know how to debug it.

To Reproduce Steps to reproduce the behavior:

1. Login with az login.
2. Use DefaultAzureCredential to try to establish an Azure auth identity.
3. Use this identity credential to establish a ServiceBusClient and a ServiceBusReceiver. Then do a subscribe on this receiver.
4. Then, maybe half of the time, I get the following error:

ManagedIdentityCredential authentication failed.(status code undefined).
More details:
request to http://169.254.169.254/metadata/identity/oauth2/token?resource=https%3A%2F%2Fvault.azure.net&api-version=2018-02-01 failed, reason: connect EHOSTUNREACH 169.254.169.254:80

Comments

1. I don’t know why it’s trying to connect to http://169.254.169.254 from my laptop!
2. I don’t know why this is intermittent. If I run the same code multiple times, I can’t determine a pattern or factor why it fails or succeeds.
3. I don’t know how to get any more debugging information than the error message from above.

[ewh]

Hi @sadasant. I finally got around to testing this issue today (testing with the alpha release package you mentioned earlier). It appeared to completely address the issue! Thanks so much for your help with this!

I’ll upgrade to 1.2.4 now!

[ewh]

Hi @sadasant. Your reply responsiveness is AMAZING!

AzureCliCredential will try to run a command with the Azure CLI and if the command fails it will assume this credential is unavailable… I’m hoping that calling out to Azure CLI and failing would hopefully not be much more expensive than a couple seconds maybe? If it’s less than a couple seconds to fail the call to the CLI (and it only happens once per process instance), that should be totally fine.

I am definitely willing to try the alpha package tomorrow. However, I’m not sure I can confirm if the alpha package fixes anything because my underlying issue with DefaultAzureCredential (ManagedIdentityCredential network failure) is intermittent – because I don’t really know what’s causing it, I don’t really know if the alpha package fixes it. The problem goes from happening almost every time I try to use DefaultAzureCredential to not appearing for a couple of days.

Yes, I think I have only hit this problem locally on my dev machine. DefaultAzureCredential seems to be working fine in our Azure App Services.