Managed Identity via connection string not working #815
Comments
richardoliverpearce
changed the title
|
Could your also try with ManagedIdentityCredential and let us know: As this is what closely aligns with "Active Directory Managed Identity' or "MSI" authentication mode. |
|
Hi @cheenamalhotra, the code snippet with ManagedIdentityCredential works fine too. Just to make sure I have no other dependencies conflicting, I have also tried a with new VS functions project, which is also returning the same error. using System;
using System.IO;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.Data.SqlClient;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;
namespace FunctionApp1
{
public static class Function1
{
[FunctionName("Function1")]
public static async Task<IActionResult> Run(
[HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
ILogger log)
{
try
{
await using var connection =
new SqlConnection(
"Server=myinstance.database.windows.net;Database=mydatabase;Authentication=Active Directory Managed Identity");
{
await connection.OpenAsync();
}
}
catch (Exception e)
{
}
return new OkObjectResult(null);
}
}
}Thanks, Richard |
|
Firstly, thanks for capturing traces! That seems to have captured the problem here.
You'd get this when "User Id" is not null, and in this it seems to be blank ""? You could test this by passing Object Id of your Identity in "User Id" connection property, please use that as a workaround if that should work, while we investigate why it's going as blank there and handle it appropriately. |
|
Hi @cheenamalhotra, ok brilliant news. Unfortunately I believe I've tried that also (still system assigned) - spent hours trying combinations :) Not to worry, for now, I'll stick with the AccessToken property method. Thanks, Richard |
|
Hi, I'm using System Assigned identity and I'm experiencing the same issue. I tried setting "User Id" equal to the Object Id and it still failed. In the end I wrapped the public class ManagedIdentityProvider : SqlAuthenticationProvider
{
private class NullUserParameters : SqlAuthenticationParameters
{
public NullUserParameters(SqlAuthenticationMethod authenticationMethod, string serverName,
string databaseName, string resource, string authority, Guid connectionId)
: base(authenticationMethod, serverName, databaseName, resource, authority, userId: null,
password: null, connectionId)
{
}
}
private readonly SqlAuthenticationProvider provider;
public ManagedIdentityProvider(SqlAuthenticationProvider provider) =>
this.provider = provider;
public override async Task<SqlAuthenticationToken> AcquireTokenAsync(SqlAuthenticationParameters parameters)
{
if (string.IsNullOrWhiteSpace(parameters.UserId))
{
return await provider.AcquireTokenAsync(new NullUserParameters(
parameters.AuthenticationMethod, parameters.ServerName, parameters.DatabaseName,
parameters.Resource, parameters.Authority, parameters.ConnectionId));
}
try
{
return await provider.AcquireTokenAsync(parameters);
}
catch (Exception ex)
{
throw new Exception($"Auth failed for user '{parameters.UserId}'.", ex);
}
}
public override bool IsSupported(SqlAuthenticationMethod authenticationMethod) =>
provider.IsSupported(authenticationMethod);
}Hope that helps. Cheers, |
|
Having the same issue on Azure App Service Containers running .NET 5 however I made a workaround inspired by andygjp. SqlAuthenticationProvider.SetProvider(SqlAuthenticationMethod.ActiveDirectoryManagedIdentity, new WorkAroundSqlAuthenticationProvider());
...
public class WorkAroundSqlAuthenticationProvider : SqlAuthenticationProvider
{
private static readonly AzureServiceTokenProvider tokenProvider = new AzureServiceTokenProvider();
public async override Task<SqlAuthenticationToken> AcquireTokenAsync(SqlAuthenticationParameters parameters)
{
var token = await tokenProvider.GetAuthenticationResultAsync(parameters.Resource);
return new SqlAuthenticationToken(token.AccessToken, token.ExpiresOn);
}
public override bool IsSupported(SqlAuthenticationMethod authenticationMethod)
{
return authenticationMethod == SqlAuthenticationMethod.ActiveDirectoryManagedIdentity;
}
} |
|
@Nisden Thank you for providing the workaround. This issue will be in the version 2.1.1. |
|
Issue is fixed with v2.1.1 |
and others
Describe the bug
Hi, I'm attempting use the new 2.1 release to provide Managed Identity connection string support to no success:
Thanks
To reproduce
Works as expected when attaching debugger to Azure Functions instance:
Fails when attaching to debugger Azure Functions instance:
Expected behavior
Be able to call OpenAsync() without throwing an exception.
Further technical details
Microsoft.Data.SqlClient version: 2.1.0
.NET target: Core 3.1
SQL Server version: Azure SQL Database
Operating system: Azure Function App Runtime ~3 (tried both Windows and Linux plans)
The text was updated successfully, but these errors were encountered: