`ManagedIdentityCredential` hangs indefinity when using keyvault

• Package Name: @azure/keyvault-secrets
• Package Version: 2.1.0
• Operating system: MacOS M1
• nodejs
  • version: v16.16.0

Describe the bug Using ManagedIdentityCredential with @azure/keyvault-secrets hangs when managed identity not available.
I want to use DefaultAzureCredential because my laptop uses AzureCliCredential and our cloud environments use ManagedIdentityCredential However, I can not use DefaultAzureCredential because it tries to use ManagedIdentityCredential first which hangs.

To Reproduce Steps to reproduce the behavior:

1. Ensure your laptop does not have any ManagedIdentityCredential: rm ~/.azure
2. Use the example found in the documentation here to try out keyvault.
3. Notice process hangs when trying to run the script.

Expected behavior The script should run correctly.

Additional context I opened up Wireshark and the socket remains open with keep-alives

Workaround My current workaround is to create my own ChainedTokenCredential which has AzureCliCredential listed before ManagedIdentityCredential

const providers = [AzureCliCredential, ManagedIdentityCredential]

class Credentials extends ChainedTokenCredential {
  constructor(options) {
    super(...providers.map(ctor => new ctor(options)))
    this.UnavailableMessage =
      'Credentials => failed to retrieve a token from the included credentials. To troubleshoot, visit https://aka.ms/azsdk/js/identity/defaultazurecredential/troubleshoot.'
  }
}

[cveld]

Out of curiosity, from a node module library engineering perspective, how did you manage to support two versions of @azure/identity from within 4.6.0? Is it as simple as that the interface between the two versions are compatible? And you set the dependency version range accordingly; allowing for two major version ranges?

With 3.0.0 our local experience runs smooth again. With version 2.1.0, ManagedIdentityCredential was trying to reach out to the token endpoint but failed with a timeout: ManagedIdentityCredential: Authentication failed. Message connect ETIMEDOUT 169.254.169.254:80

With 3.0.0 it is apparently able to detect way quicker that the endpoint is not there and fails way more quickly. I wonder how this logic goes.

[timovv]

Hi @anandkumarpatel. It looks like this issue slipped through the cracks, sorry about that! I think you might be running into the same problem described in #23017. Are you able to upgrade to the new @azure/identity 3.0.0 (and the 4.6.0 version of @azure/keyvault-secrets for good measure) and see if the problem persists? The new release of Identity includes a fix which will hopefully fix the hang.