reading secrets from KeyVault with Microsoft.Azure.Services.AppAuthentication

Hi,

I’ve just did a console app to read a secret from key vault and it took 24 seconds to retrieve the value. Is it normal? Here’s the code:

static void Main(string[] args)
        {
            Console.WriteLine(DateTime.Now);
            Console.WriteLine(GetValue().Result);
            Console.WriteLine(DateTime.Now);
            Console.Read();
        }

        static async Task<string> GetValue()
        {
            AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();

            var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));

            var secret = await keyVaultClient.GetSecretAsync("https://{mykeyvault}.vault.azure.net/secrets/apiKey")
                .ConfigureAwait(false);

            return secret.Value;
        }

and here’s the packages.config

<packages>
  <package id="Microsoft.Azure.KeyVault" version="3.0.0" targetFramework="net462" />
  <package id="Microsoft.Azure.KeyVault.WebKey" version="3.0.0" targetFramework="net462" />
  <package id="Microsoft.Azure.Services.AppAuthentication" version="1.0.3" targetFramework="net462" />
  <package id="Microsoft.IdentityModel.Clients.ActiveDirectory" version="3.14.2" targetFramework="net462" />
  <package id="Microsoft.Rest.ClientRuntime" version="2.3.11" targetFramework="net462" />
  <package id="Microsoft.Rest.ClientRuntime.Azure" version="3.3.12" targetFramework="net462" />
  <package id="Newtonsoft.Json" version="6.0.8" targetFramework="net462" />
</packages>

[mwanchap]

@navzam yeah you can speed it up without setting a connection string, just add a local environment variable to windows called “AzureServicesAuthConnectionString” with a value of “RunAs=Developer; DeveloperTool=VisualStudio”

[navzam]

I’m also seeing calls to GetAccessTokenAsync() take ~24 seconds when running locally and not specifying a connection string. As above, when I run Fiddler, I can see a request to 169.254.169.254/metadata/identity/oauth2/token which hangs for ~22 seconds before it times out with a 502.

If I set the connection string to one of the local development options, then that request isn’t made and the whole call takes ~3 seconds.

Is the solution for me to detect whether I’m running locally and always set a connection string based on that? Or is there a way to speed up the local behavior when the connection string isn’t specified?