SharedTokenCacheCredential authentication fails in Azure.Identity on ubuntu

We have written an internal command line tool that allows us to read secrets from Azure Keyvault. This tool consumes Azure.Identity, Azure.Security.KeyVault.*, and Azure.ResourceManager.Resources

We run this tool both on our dev machines and in the Azure DevOps release pipeline. However, today we have updated Azure.Identity from 1.2.2 to 1.3.0. While the tool still runs without any issue on my Windows machine, it fails on the build agent in the release pipeline (ubuntu-18.04):

ERROR: Azure.Identity.AuthenticationFailedException: SharedTokenCacheCredential authentication failed: Persistence check failed. Data was written but it could not be read. Possible cause: on Linux, LibSecret is installed but D-Bus isn't running because it cannot be started over SSH.
    Microsoft.Identity.Client.Extensions.Msal.MsalCachePersistenceException: Persistence check failed. Data was written but it could not be read. Possible cause: on Linux, LibSecret is installed but D-Bus isn't running because it cannot be started over SSH.
      at Microsoft.Identity.Client.Extensions.Msal.MsalCacheStorage.VerifyPersistence() 
      at Microsoft.Identity.Client.Extensions.Msal.MsalCacheHelper.VerifyPersistence() 
      at Azure.Identity.MsalClientBase`1.GetClientAsync(Boolean async, CancellationToken cancellationToken) 
      at Azure.Identity.MsalClientBase`1.GetClientAsync(Boolean async, CancellationToken cancellationToken) 
      at Azure.Identity.MsalPublicClient.GetAccountsAsync(Boolean async, CancellationToken cancellationToken) 
      at Azure.Identity.SharedTokenCacheCredential.GetAccountAsync(Boolean async, CancellationToken cancellationToken) 
      at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken) 
  at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex) 
  at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken) 
  at Azure.Identity.SharedTokenCacheCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken) 
  at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken) 
  at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken) 
  at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex) 
  at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken) 
  at Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken) 
  at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueFromCredentialAsync(HttpMessage message, Boolean async, CancellationToken cancellationToken) 
  at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.GetHeaderValueAsync(HttpMessage message, Boolean async) 
  at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async) 
  at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async) 
  at Azure.Core.Pipeline.RetryPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline, Boolean async) 
  at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline) 
  at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline) 
  at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.ProcessAsync(HttpMessage message, ReadOnlyMemory`1 pipeline) 
  at Azure.ResourceManager.Resources.ResourceGroupsRestOperations.GetAsync(String resourceGroupName, CancellationToken cancellationToken) 
  at Azure.ResourceManager.Resources.ResourceGroupsOperations.GetAsync(String resourceGroupName, CancellationToken cancellationToken) 

I don’t know if this is caused by Azure.Identity itself or by the MSAL token cache extension you’re using.

[schaabs]

@thoemmi Thank you for filing this issue, I’m sorry you’re running into this problem. I’ll investigate the root cause of this regression and hopefully release a patch for it soon. In the meantime you should be able to work around this by excluding the SharedTokenCacheCredential from the DefaultAzureCredential.

var credential = new DefaultAzureCredential(new DefaultAzureCredentialOptions { ExcludeSharedTokenCacheCredential = true });

This should work around the issue your experiencing in your CI and should not impact your authentication in your developement environment as the VisualStudioCredential will provide authentication in lieu of the SharedTokenCacheCredential. As a matter of fact we’re also planning on disabling the SharedTokenCacheCredential by default in our next release. More info on this can be found in this issue https://github.com/Azure/azure-sdk/issues/1970, and PR https://github.com/Azure/azure-sdk-for-net/pull/16615. Please let me know if you have further questions or have trouble getting the work around working.

[dgerding]

https://github.com/Azure/azure-sdk-for-net/issues/28120 Help 😃