[BUG] [MSAL] Regression in ManagedIdentityCredential: CredentialUnavailableException no longer thrown for invalid json responses

[kevinwedwards]

Library name and version

Azure.Identity 1.13.0 (and 1.13.1)

Describe the bug

I believe bug : #37409 may have been reintroduced in 1.13.0 (and still in 1.13.1).

In our situation - our corporate proxy is returning HTML and If it's like the 37409, the managed ID client is attempting to parse the response back, as json IIRC from the previous bug.

Expected behavior

When running locally - i'd expect this to fail through from ManagedID to AzureCliCredential
new ChainedTokenCredential(new ManagedIdentityCredential(), new AzureCliCredential()),

code works fine in 1.12.1, fails in 1.13.x

Actual behavior

Microsoft.Identity.Client.MsalServiceException is being thrown, I believe, because the HTML message returned from our corporate proxy - isn't able to be successfully parsed (as JSON?).

Reproduction Steps

run locally with a proxy or something that will return html vs json.

Environment

No response

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[kevinwedwards]

@christothes if you're still on this team, you assisted with the issue in 1.9.

[christothes]

Hi @kevinwedwards -
Could you please provide the full stack trace of the exception?

[github-actions]

Hi @kevinwedwards. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[kevinwedwards]

	Message	"ManagedIdentityCredential authentication failed: [Managed Identity] Authentication unavailable. The request failed due to a gateway error. [[HTML FROM PROXY]]
	Source	"Azure.Identity"	string
	StackTrace	"   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)\r\n   
	at Azure.Identity.ManagedIdentityCredential.<GetTokenImplAsync>d__18.MoveNext()\r\n   
	at System.Threading.Tasks.ValueTask`1.get_Result()\r\n   
	at System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult()\r\n   
	at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask`1 task)\r\n   
	at Azure.Identity.ManagedIdentityCredential.GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)\r\n   
	at Azure.Identity.ChainedTokenCredential.<GetTokenImplAsync>d__7.MoveNext()"	string

•   TargetSite	{System.Exception FailWrapAndThrow(System.Exception, System.String, Boolean)}	System.Reflection.MethodBase {System.Reflection.RuntimeMethodInfo}
  

[kevinwedwards]

builder.Configuration.AddAzureKeyVault(
new Uri(builder.Configuration[Constants.KeyVaultUrlKey]),
new ChainedTokenCredential(new ManagedIdentityCredential(), new AzureCliCredential()),
new AzureKeyVaultConfigurationOptions
{
ReloadInterval = TimeSpan.FromHours(Constants.KeyVaultReloadInterval)
});

StackTrace from the code above:

at Azure.Identity.ChainedTokenCredential.d__7.MoveNext()
at System.Threading.Tasks.ValueTask1.get_Result() at System.Runtime.CompilerServices.ValueTaskAwaiter1.GetResult()
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask1 task) at Azure.Identity.ChainedTokenCredential.GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken) at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.<SetResultOnTcsFromCredentialAsync>d__9.MoveNext() at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.<GetAuthHeaderValueAsync>d__6.MoveNext() at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](Task1 task)
at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.TokenRequestState.d__19.MoveNext()
at System.Threading.Tasks.ValueTask1.get_Result() at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable1.ConfiguredValueTaskAwaiter.GetResult()
at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AccessTokenCache.d__6.MoveNext()
at System.Threading.Tasks.ValueTask1.get_Result() at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask1 task)
at Azure.Core.Pipeline.BearerTokenAuthenticationPolicy.AuthenticateAndAuthorizeRequest(HttpMessage message, TokenRequestContext context)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.d__11.MoveNext()
at System.Runtime.CompilerServices.ValueTaskAwaiter1.GetResult() at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask1 task)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthorizeRequestOnChallenge(HttpMessage message)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.d__14.MoveNext()
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.Process(HttpMessage message, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory1 pipeline)
at Azure.Core.Pipeline.RedirectPolicy.d__7.MoveNext()
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Core.Pipeline.RedirectPolicy.Process(HttpMessage message, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory1 pipeline)
at Azure.Core.Pipeline.RetryPolicy.d__5.MoveNext()
at Azure.Core.Pipeline.RetryPolicy.d__5.MoveNext()
at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
at Azure.Core.Pipeline.RetryPolicy.Process(HttpMessage message, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory1 pipeline)
at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory1 pipeline) at Azure.Core.Pipeline.HttpPipeline.Send(HttpMessage message, CancellationToken cancellationToken) at Azure.Core.Pipeline.HttpPipeline.SendRequest(Request request, CancellationToken cancellationToken) at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest(Request request, CancellationToken cancellationToken) at Azure.Security.KeyVault.KeyVaultPipeline.GetPage[T](Uri firstPageUri, String nextLink, Func1 itemFactory, String operationName, CancellationToken cancellationToken)
at Azure.Security.KeyVault.Secrets.SecretClient.<>c__DisplayClass15_0.b__0(String nextLink)
at Azure.Core.PageResponseEnumerator.<>c__DisplayClass0_01.<CreateEnumerable>b__0(String continuationToken, Nullable1 pageSizeHint)
at Azure.Core.PageResponseEnumerator.FuncPageable1.<AsPages>d__2.MoveNext() at Azure.Pageable1.d__8.MoveNext()
at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.Load()
at Microsoft.Extensions.Configuration.ConfigurationManager.AddSource(IConfigurationSource source)
at Microsoft.Extensions.Configuration.ConfigurationManager.Microsoft.Extensions.Configuration.IConfigurationBuilder.Add(IConfigurationSource source)
at Microsoft.Extensions.Configuration.AzureKeyVaultConfigurationExtensions.AddAzureKeyVault(IConfigurationBuilder configurationBuilder, SecretClient client, AzureKeyVaultConfigurationOptions options)
at Microsoft.Extensions.Configuration.AzureKeyVaultConfigurationExtensions.AddAzureKeyVault(IConfigurationBuilder configurationBuilder, Uri vaultUri, TokenCredential credential, AzureKeyVaultConfigurationOptions options)

[christothes]

Hi @kevinwedwards
This is due to an implementation change we made in version 1.13.x where we now delegate to the underlying MSAL dependency for ManagedIdentityCredential flows. I've opened up an issue in their repo so that we can devise an approach to fix this regression.

AzureAD/microsoft-authentication-library-for-dotnet#5016

In the meantime, you can get similar behavior as before using DefaultAzureCredential with the options configured to exclude all credential except ManagedIdentityCredential and AzureCliCredential.