azure-sdk-for-net: DefaultAzureCredential fails when multiple accounts are available and defaulting to SharedTokenCacheCredential

I’m running in Visual Studio Code and am just authenticated via the command line using az login. When I run az account list is it lists multiple accounts, but one account is set to "isDefault": true. DefaultAzureCredential does not seem to be respecting that flag, so this seems to be broken whether you are using Visual Studio or not.

Please fix! This unnecessarily complicates the local development environment.

Update to my issue above

I created new user in Azure AD and used that to log in. This user is separate from that I used to create/login to the Azure Subscription. It works fine with the new user.

FWIW, I have written out the different options I used to get DefaultAzureCredential work on my local machine here

With inspiration from @xperiandri… what solved the issue for me was to configure AZURE_USERNAME and AZURE_TENANT_ID in VS2019 enterprise. In my case the issue was related to running an azure function locally. I added the above environment variables in (right click) [yourproject] --> properties --> debug - under section “Environment Variables”.

Above there has been some discussions which version to use of the Azure.Identity library. For me this is working with version 1.3.0 (Latest stable version at the time of writing)

I didn’t have to configure the DefaultAzureCredentialOptions - I just used the default constructor - DefaultAzureCredential()

My method that caused all the trouble - but now working well both locally and being deployed to azure: public static async Task<string> getSecretFromKeyvault(string _keyvaultName, string _secretName) { var kvUri = “https://” + _keyvaultName + “.vault.azure.net”; var client = new SecretClient(new Uri(kvUri), new DefaultAzureCredential()); var secret = await client.GetSecretAsync(_secretName); return secret.Value.Value; }

In my case, my AZURE_USERNAME was not an email address, though this isn’t indicated anywhere in Visual Studio and is tricky to find. Go to your Azure portal -> Azure Active Directory -> Users -> <your user> -> Profile (the default selection), and look at “Name” in the Identity section.

Ok, when I do this, I get the following:

Microsoft.Identity.Client.MsalServiceException
  HResult=0x80131500
  Message=AADSTS70002: The client does not exist or is not enabled for consumers. If you are the application developer, configure a new application through the App Registrations in the Azure Portal at https://go.microsoft.com/fwlink/?linkid=2083908.
Trace ID: ab88f102-5946-4b60-ac06-294565df0100
Correlation ID: 61d55a29-6ef5-4caf-ba0b-01ad1cbd8dea
Timestamp: 2019-11-07 23:13:55Z
  Source=Microsoft.Identity.Client
  StackTrace:
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateErrorResponse(HttpResponse response, RequestContext requestContext)

This occurs a number of times it seems. I had to click “don’t break on this” to be able to get through it.

I faced problems with DefaultAzureCredential with a single account.

I was able to over come this problem with a different type of Credential: ClientSecretCredential

        String keyVaultUri = "https://<YOUR_KEY_VAULT>.vault.azure.net/";

        TokenCredential clientSecretCredential = new ClientSecretCredentialBuilder()
                .clientSecret("<YOUR_CLIENT_SECRET>")
                .clientId("<YOUR_CLIENT_ID>")
                .tenantId("<YOUR_TENANT_ID>")
                .build();
        SecretClient secretClient = new SecretClientBuilder()
                .vaultUrl(keyVaultUri)
                .credential(clientSecretCredential)
                .buildClient();
...
// do what you want

pom.xml

    <dependency>
      <groupId>com.azure</groupId>
      <artifactId>azure-security-keyvault-secrets</artifactId>
      <version>4.2.7</version>
    </dependency>

    <dependency>
      <groupId>com.azure</groupId>
      <artifactId>azure-identity</artifactId>
      <version>1.2.5</version>
    </dependency>

Hi all, This issue has arose again in “Azure.Identity” Version=“1.3.0”. Everething works well in “Azure.Identity” Version=“1.2.0”.

I was experiencing the same issues. Moved to Azure.Identity 1.2.0-preview.3 and everything works fine debugging from Visual Studio with multiple accounts and an account selected in Azure Service Authentication

I solved this problem by just setting the environment variable named “AZURE_USERNAME” = [your azure account email id] that you want to use for the authentication in development mode.

How to Setup Environment Variable? for (Window 10) Window Key >> Search >> ENV >>open environment variable editor

assume you mean AZURE_USERNAME not AZURE_NAME.

I’m having exactly the same issue as alhardy. Not sure what is going wrong. But I do have the full calls tack:

Azure.Identity.AuthenticationFailedException
  HResult=0x80131500
  Message=DefaultAzureCredential authentication failed.
  Source=Azure.Identity
  StackTrace:
   at Azure.Identity.DefaultAzureCredential.<GetTokenImplAsync>d__11.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult()
   at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted[T](ValueTask`1 task)
   at Azure.Identity.DefaultAzureCredential.GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.<AuthenticateRequestAsync>d__9.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable.ConfiguredTaskAwaiter.GetResult()
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.<ProcessCoreAsync>d__8.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ValueTaskAwaiter.GetResult()
   at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
   at Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.RetryPolicy.<ProcessAsync>d__11.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Azure.Core.Pipeline.RetryPolicy.<ProcessAsync>d__11.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ValueTaskAwaiter.GetResult()
   at Azure.Core.Pipeline.TaskExtensions.EnsureCompleted(ValueTask task)
   at Azure.Core.Pipeline.RetryPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelinePolicy.ProcessNext(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipelineSynchronousPolicy.Process(HttpMessage message, ReadOnlyMemory`1 pipeline)
   at Azure.Core.Pipeline.HttpPipeline.Send(HttpMessage message, CancellationToken cancellationToken)
   at Azure.Core.Pipeline.HttpPipeline.SendRequest(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequest[TResult](RequestMethod method, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
   at Azure.Security.KeyVault.Secrets.SecretClient.GetSecret(String name, String version, CancellationToken cancellationToken)
   at BestelBoer.Registrations.Registrations.GetSecret(SecretClient client, String key) in C:\git\bestelboer\BackendWebsite\BestelBoer.Registrations\Registrations.cs:line 106

  This exception was originally thrown at this call stack:
    [External Code]

Inner Exception 1:
AuthenticationFailedException: SharedTokenCacheCredential authentication failed.

Inner Exception 2:
MsalServiceException: A configuration issue is preventing authentication - check the error message from the server for details.You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS70002: The client does not exist or is not enabled for consumers. If you are the application developer, configure a new application through the App Registrations in the Azure Portal at https://go.microsoft.com/fwlink/?linkid=2083908.
Trace ID: bbe2ba97-375c-4b46-b089-d11963257700
Correlation ID: 1b3232a9-e22e-48de-adc0-bbfe5d7b8a68
Timestamp: 2020-06-09 15:33:49Z

@Rolorob : Were you able to resolve this issue? I am seeing similar stack trace and unable to proceed forward. Thanks.

Hi @spmanjunath , I was unable to resolve this. I worked around this issue by using a different way to connect to the Key Vault:

https://docs.microsoft.com/en-us/aspnet/core/security/key-vault-configuration?view=aspnetcore-3.1

This worked instantly, you will need list permissions on secrets obviously, and it will retrieve ALL secrets and not only the ones requested. But at least it was working as expected…

Worth a check it isn’t this issue when using AZURE_USERNAME. The upper/lower case of the email account has to match the account that was registered in VS. https://github.com/Azure/azure-sdk-for-net/issues/10816. @schaabs has put a fix in.

Thanks @MikePennington, https://github.com/Azure/azure-sdk-for-net/pull/11575

Ok, when I do this, I get the following:

Microsoft.Identity.Client.MsalServiceException
  HResult=0x80131500
  Message=AADSTS70002: The client does not exist or is not enabled for consumers. If you are the application developer, configure a new application through the App Registrations in the Azure Portal at https://go.microsoft.com/fwlink/?linkid=2083908.
Trace ID: ab88f102-5946-4b60-ac06-294565df0100
Correlation ID: 61d55a29-6ef5-4caf-ba0b-01ad1cbd8dea
Timestamp: 2019-11-07 23:13:55Z
  Source=Microsoft.Identity.Client
  StackTrace:
   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateErrorResponse(HttpResponse response, RequestContext requestContext)

This occurs a number of times it seems. I had to click “don’t break on this” to be able to get through it.

I am getting the same error. Tried clearing the ‘%LOCALAPPDATA%/.IdentityService’ cache and logged back into VS with just one account. Below is what I see

at Microsoft.Identity.Client.ApiConfig.Executors.ClientApplicationBaseExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenSilentParameters silentParameters, CancellationToken cancellationToken) at Azure.Identity.MsalPublicClient.AcquireTokenSilentAsync(String[] scopes, IAccount account, CancellationToken cancellationToken) at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(TokenRequestContext requestContext, CancellationToken cancellationToken) ErrorCode: invalid_client StatusCode: 401

Happy to provide any other details

In the account window, click on the Apply filter next to the account you’re interested in.

If you don’t have this option, your account may not be invited in other tenants, and as such, my solution does not apply to your case…

I’m using VS Professional version so not sure if that matters but I don’t see the Apply Filter button next to the account. 😞