[BUG] DefaultAzureCredential throws exceptions when run in container

Create a console app.

New up a DAC

var cred = new DefaultAzureCredential();

Call a client, like blob client.

Create Dockerfile

FROM mcr.microsoft.com/dotnet/core/sdk:3.1 AS build
WORKDIR /src
COPY . .
RUN dotnet publish "Services/QueueService/QueueService.csproj" -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/core/runtime:3.1 AS base
RUN apt-get update -y && apt-get install python3 python3-distutils python3-pip -y && pip3 install azure-cli
ENV PATH /root/.local/bin/:$PATH

WORKDIR /app
COPY --from=build /app/publish .
ENTRYPOINT ["dotnet", "QueueService.dll"]

Run with docker-compose up

# Please refer https://aka.ms/HTTPSinContainer on how to setup an https developer certificate for your ASP .NET Core service.
version: "3.8"

services:
  azsdkdemoqueueservice:
    image: azsdkdemoqueueservice
    volumes: 
        - "${HOME}/.azure:/root/.azure"
    build:
      context: .
      dockerfile: Services/QueueService/Dockerfile

You will get this error:

Attaching to net_azsdkdemoqueueservice_1, net_azsdkdemoapi_1, net_azsdkdemowebapp_1
azsdkdemoqueueservice_1  | Unhandled exception. Azure.Identity.AuthenticationFailedException: DefaultAzureCredential authentication failed.
azsdkdemoqueueservice_1  |  ---> Azure.Identity.AuthenticationFailedException: SharedTokenCacheCredential authentication failed.
azsdkdemoqueueservice_1  |  ---> System.ArgumentNullException: Value cannot be null. (Parameter 'attributeValue1')
azsdkdemoqueueservice_1  |    at Microsoft.Identity.Client.Extensions.Msal.CacheAccessorLinux..ctor(String cacheFilePath, String keyringCollection, String keyringSchemaName, String keyringSecretLabel, String attributeKey1, String attributeValue1, String attributeKey2, String attributeValue2, TraceSourceLogger logger)
azsdkdemoqueueservice_1  |    at Microsoft.Identity.Client.Extensions.Msal.MsalCacheStorage.Create(StorageCreationProperties creationProperties, TraceSource logger)
azsdkdemoqueueservice_1  |    at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper..ctor(StorageCreationProperties storageCreationProperties, TraceSource logger, HashSet`1 knownAccountIds, FileSystemWatcher cacheWatcher)
azsdkdemoqueueservice_1  |    at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper.CreateAsync(StorageCreationProperties storageCreationProperties, TraceSource logger)
azsdkdemoqueueservice_1  |    at Azure.Identity.MsalPublicClient.InitializeAsync()
azsdkdemoqueueservice_1  |    at Azure.Identity.MsalPublicClient.EnsureInitializedAsync(Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Identity.MsalPublicClient.GetAccountsAsync()
azsdkdemoqueueservice_1  |    at Azure.Identity.SharedTokenCacheCredential.GetAccountAsync()
azsdkdemoqueueservice_1  |    at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    --- End of inner exception stack trace ---
azsdkdemoqueueservice_1  |    at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
azsdkdemoqueueservice_1  |    at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.SharedTokenCacheCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    --- End of inner exception stack trace ---
azsdkdemoqueueservice_1  |    at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)
azsdkdemoqueueservice_1  |    at Azure.Storage.Queues.QueueRestClient.Queue.CreateAsync(ClientDiagnostics clientDiagnostics, HttpPipeline pipeline, Uri resourceUri, String version, Nullable`1 timeout, IDictionary`2 metadata, String requestId, Boolean async, String operationName, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Storage.Queues.QueueClient.CreateInternal(IDictionary`2 metadata, Boolean async, CancellationToken cancellationToken, String operationName)
azsdkdemoqueueservice_1  |    at Azure.Storage.Queues.QueueClient.CreateIfNotExistsInternal(IDictionary`2 metadata, Boolean async, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Storage.Queues.QueueClient.CreateIfNotExistsAsync(IDictionary`2 metadata, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at QueueService.Program.Main(String[] args) in /src/Services/QueueService/Program.cs:line 31
azsdkdemoqueueservice_1  |    at QueueService.Program.<Main>(String[] args)

Based on the exception it looks like we are not gracefully handling the case where shared token cache is not found.

If I exclude SharedTokenCacheCred I get this

Attaching to net_azsdkdemoqueueservice_1, net_azsdkdemoapi_1, net_azsdkdemowebapp_1
azsdkdemoqueueservice_1  | Unhandled exception. Azure.Identity.AuthenticationFailedException: DefaultAzureCredential authentication failed.
azsdkdemoqueueservice_1  |  ---> Azure.Identity.AuthenticationFailedException: VisualStudioCodeCredential authentication failed.
azsdkdemoqueueservice_1  |  ---> System.DllNotFoundException: Unable to load shared library 'libsecret-1.so.0' or one of its dependencies. In order to help diagnose loading problems, consider settig the LD_DEBUG environment variable: liblibsecret-1.so.0: cannot open shared object file: No such file or directory
azsdkdemoqueueservice_1  |    at Azure.Identity.LinuxNativeMethods.Imports.secret_schema_new(String name, Int32 flags, String attribute1, Int32 attribute1Type, String attribute2, Int32 attribute2Tye, IntPtr end)
azsdkdemoqueueservice_1  |    at Azure.Identity.LinuxNativeMethods.secret_schema_new(String name, SecretSchemaFlags flags, String attribute1, SecretSchemaAttributeType attribute1Type, String attribte2, SecretSchemaAttributeType attribute2Type)
azsdkdemoqueueservice_1  |    at Azure.Identity.LinuxVisualStudioCodeAdapter.GetLibsecretSchema()
azsdkdemoqueueservice_1  |    at Azure.Identity.LinuxVisualStudioCodeAdapter.GetCredentials(String serviceName, String accountName)
azsdkdemoqueueservice_1  |    at Azure.Identity.VisualStudioCodeCredential.GetTokenImplAsync(TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    --- End of inner exception stack trace ---
azsdkdemoqueueservice_1  |    at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
azsdkdemoqueueservice_1  |    at Azure.Identity.VisualStudioCodeCredential.GetTokenImplAsync(TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.VisualStudioCodeCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    --- End of inner exception stack trace ---
azsdkdemoqueueservice_1  |    at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)
azsdkdemoqueueservice_1  |    at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline)

I don’t see an option to Exclude Visual Studio Credential

We need to:

1. Go through each credential and make sure we throw cred not available exceptions, not authentication failed exceptions
2. Write integration tests that test with Azure.Identity scenarios in containers.

azsdke2e

[jongio]

@MaxCrank Apologies for the lost time. Please build your own credential chain with ChainedTokenCredential and only include the credential types you need.

Let me know if you want to pair on this. https://jong.io/contact

Jon

[AlexanderSher]

1. AuthenticationFailedException is a wrapper for any exception (except OperationCanceledException), so when it happens, it basically means that something unexpected has happened. Swallowing these exceptions in DefaultAzureCredential.GetTokenFromSourcesAsync will hide some real issues that users may experience and require fix from our side
2. We would probably need a separate CI for container tests.

I don’t see an option to Exclude Visual Studio Credential

DefaultAzureCredentialOptions.ExcludeVisualStudioCredential