App Service user-assigned MSI authentication

Hello, I’m having issues making App Service MSI authentication work. I went through this tutorial to set up a user-assigned managed identity. But I still can’t make it work.

The authentication part of my tedious config is

type: 'azure-active-directory-msi-app-service',
options: {
            clientId: client_ID_of_the_user_assigned_MSI
        } 

The error I’m getting at runtime is:

ConnectionError: Security token could not be authenticated or authorized.
     at ConnectionError (/home/site/wwwroot/node_modules/tedious/lib/errors.js:13:12)
     at /home/site/wwwroot/node_modules/tedious/lib/connection.js:2843:61
     at getTokenFromCredentials (/home/site/wwwroot/node_modules/tedious/lib/connection.js:2809:24)
     at /home/site/wwwroot/node_modules/@azure/ms-rest-nodeauth/dist/lib/login.js:645:24
     at /home/site/wwwroot/node_modules/@azure/ms-rest-js/dist/msRest.node.js:363:13
     at processTicksAndRejections (internal/process/task_queues.js:97:5) {
   code: 'EFEDAUTH'
 }

I saw that @azure/ms-rest-nodeauth is being deprecated for @azure/identity. Could that be why it’s not working?

[sharonchoong]

@sharonchoong Can you check if PR #1155 will fix your issue? Hopefully all goes well

@IanChokS That worked! Sorry for the delay, I had some trouble rebuilding the module with your PR changes, but the user-assigned MSI authentication worked nicely in the end. Would be great if this can be merged into master!

[ramya-rao-a]

In the function config, I had to also specify resource field alongside clientId for it to work, but the current documentation specifies only needing clientId (for user-assigned). So I’m not sure if resource field is required for all use cases, or just mine.

That is interesting. I am not familiar with the inner details here for quick answer. If you can log an issue in the ms-rest-nodeauth repo with details on your set up (preferably outside of tediousjs 😃), then we can take a deeper look and update the docs as needed

is your team planning on deprecating @azure/ms-rest-nodeauth in favour of @azure/identity sometime in the future?

Yes, but the progress is slow at the moment. For now, @azure/ms-rest-nodeauth is supported and will take bug fixes, but we will not be adding any new features.