Aad-pod-identity: Access Azure KeyVault from ASP.NET Core

[AndreasM009]

I tried to deploy a pod with an ASP.NET Core API. It is not possible to get an access token using AzureServiceTokenProvider:
System.AggregateException: One or more errors occurred. (Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. /bin/bash: az: No such file or directory

) ---> Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. /bin/bash: az: No such file or directory

at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsyncImpl(String authority, String resource, String scope)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAccessTokenAsync(String resource, String tenantId)
--- End of inner exception stack trace ---
at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
at aspnetcoreaadpodidentity.Controllers.EchoController.GetMsiEndpoint() in /app/Controllers/EchoController.cs:line 55
---> (Inner Exception #0) Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried the following 3 methods to get an access token, but none of them worked.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Managed Service Identity. Unable to connect to the Managed Service Identity (MSI) endpoint. Please check that you are running on an Azure resource that has MSI setup.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Environment variable LOCALAPPDATA not set.
Parameters: Connectionstring: [No connection string specified], Resource: https://vault.azure.net, Authority: . Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. /bin/bash: az: No such file or directory

[kkmsft]

@AndreasM009: Thank you for trying aad-pod-identity. Can you please provide the following to debug this further:

1. Nmi logs (to figure out how nmi responded to the call to token request)

2. Mic logs.(to figure out if the assignment to vm and the binding happened or not)

3. Kubectl get azureassignedidentity (please parse our any potential private info)

4. Please confirm about rbac state - does the cluster have rbac and rbac deployment of aad-pod-identity has been made.

5. What version of k8s has been setup and whether it’s acs-engine or AKS(to try and repro internally).

[AndreasM009]

@kkmsft it was my mistake. It seems that the .NET component AzureServiceTokenProvider does not use User assigned Identity. I tried to do a http request to http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net . Now I get a vaild access token for my key vault

[AndreasM009]

Installing the latest release of Microsoft.Azure.Services.AppAuthentication fixed the problem.
Now it is possible to use the AzureServiceTokenProvider as expected:
C# var tokenProvider = new AzureServiceTokenProvider(); string accessToken = await tokenProvider.GetAccessTokenAsync("https://vault.azure.net"); var kvClient = new KeyVaultClient((authority, resource, scope) => tokenProvider.KeyVaultTokenCallback(authority, resource, scope)); return kvClient.GetSecretAsync("https://aspnetcorekv.vault.azure.net", "Settings--ValueOne").Result.Value;

[kkmsft]

@AndreasM009 - Thank you !! for clarifying this.

I am thinking that we should document various usages and versions. Have raised an issue here: https://github.com/Azure/aad-pod-identity/issues/110.

Closing this bug for now. Thank you, again @AndreasM009 for using aad-pod-identity and reporting the issue.

[goldenbeard]

@AndreasM009 could you confirm which version of Microsoft.Azure.Services.AppAuthentication you used to get aad-pod-identity working?

[AndreasM009]

I used version 1.0.3.
Take a look at my example Repository here