Azure-sdk-for-java: azure-keyvault-secrets-spring-boot-starter can not work with webflux

[gpa168]

Describe the bug
We have Spring Boot Reactive WebFlux application accessing Azure Key vault. When the application starts, spring boot makes two parallel calls to Azure key vault api to download the secrets. One of the call passes and other one always fails with 401 Unauthorized exception. Note that these two calls are made in two separate threads.

Exception or Stack Trace
kvazewpreprod.vault.azure.net
Duration:20 ms Response code:401 Dependency name:GET /secrets/businesrulespostgresdbhost/

To Reproduce
Start the Spring Boot reactive application with azure key vault dependency in pom and key vault config in the applicaiton.yml file.

Code Snippet
Maven dependencies - pom.xml:

<dependency>
      <groupId>com.microsoft.azure</groupId>
      <artifactId>azure-keyvault-secrets-spring-boot-starter</artifactId>
      <version>2.3.3</version>
 </dependency>
<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-webflux</artifactId>
       <version>2.3.1.RELEASE</version>
</dependency>

Application properties - application.yml:

azure:
  keyvault:
    enabled: true
    uri: https://kvazewpreprod.vault.azure.net/
    tenant-id: xxxx-xxx-xxxxx-xxx-xxxxxxx

WebApp access to Azure key vault is handled through managed identity. There fore clientId and Secret key is not passed from application.yml config.

Expected behavior
There should be only one call to download each secret from Azure key vault. The additional failing call to Azure key vault is causing issue with actual spring reactive api.

Screenshots
Spring Boot logs showing two request being sent with two separate threads

Logs showing one of the request was success with 200 status code and other one failed with 401 status code

Setup (please complete the following information):
This issue is occurring after deployment of spring boot reactive application on Azure WebApp.

Additional context
It looks like the Azure key vault maven dependency currently does not support spring reactive application. Could you please help me with the Azure key vault - Spring Boot reactive supported dependency to fix this issue. Thanks

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• [ ] Bug Description Added
• [ ] Repro Steps Added
• [ ] Setup information Added

[fatimamookhtiarmaersk]

Could someone please help here and clarify whether the web flux version is supported.

[joshfree]

Thanks for filing this question on github @fatimamookhtiarmaersk. @jialindai could you please help route this azure-spring question?

[fatimamookhtiarmaersk]

Any update guys? This is causing us plenty of issues in PROD.

[chenrujun]

Hi, @gpa168 , @fatimamookhtiarmaersk .

Sorry that currently azure-keyvault-secrets-spring-boot-starter does not support webflux yet.

[fatimamookhtiarmaersk]

Any alternatives you could recommend please?

[chenrujun]

@fatimamookhtiarmaersk , please use spring-boot-starter-web instead of spring-boot-starter-webflux.

[gpa168]

@chenrujun - by changing from spring-boot-starter-webflux to spring-boot-starter-web are you suggesting to covert Reactive api's to non reactive api's! That's not possible as it will be big change in how api's have been designed.
We have tried below two dependencies but we are getting the same 401 error. Could you suggest other dependency which support spring-webflux.

<dependency>
    <groupId>com.microsoft.azure</groupId>
    <artifactId>azure-spring-boot-starter</artifactId>
</dependency>
<dependency>
      <groupId>com.microsoft.azure</groupId>
      <artifactId>azure-keyvault-secrets-spring-boot-starter</artifactId>
</dependency>

We are seeing another issue with multiple threads causing Web App to go down. The availability drops from 100% to below 25% and eventually we notice the Web app instance freezing. The only thing which seems to resolve the issue is by doing a hard restart of the Web app which make me wonder if these two issues are related as WebFlux is not supported yet? The support ticket number for the second issue which may be related is 121010725001583.
Appreciate a prompt response as we have live issue in production impacting this issue.

[chenrujun]

Hi, @gpa168 .

Sorry for late response.

My sample project

I created a branch to reproduce your problem:

• Branch: https://github.com/chenrujun/azure-sdk-for-java/tree/issue-18270-investigation
• Commit used in current comment: https://github.com/chenrujun/azure-sdk-for-java/tree/9625c3b92205fcb26d079bdf232df8ad19ee5bf5
• Folder: https://github.com/chenrujun/azure-sdk-for-java/tree/9625c3b92205fcb26d079bdf232df8ad19ee5bf5/sdk/spring/azure-spring-boot-samples/azure-spring-boot-sample-keyvault-secrets

Here is the execution log:

Your concerns

You mentioned that

Note that these two calls are made in two separate threads.

In my understanding, it's not a problem. it's expected behavior.
In you screenshot:

2 thread is also expected behavior.
And Retrieved secret - businesrulespostgresdbhost means get the secret successfully, I think.

And you mentioned that

Logs showing one of the request was success with 200 status code and other one failed with 401 status code

I don't know how to get the log.

My request

• Please tell me where did you get the log about 401?
• Please try to use my sample to reproduce your problem: https://github.com/chenrujun/azure-sdk-for-java/tree/9625c3b92205fcb26d079bdf232df8ad19ee5bf5/sdk/spring/azure-spring-boot-samples/azure-spring-boot-sample-keyvault-secrets

[msftbot[bot]]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

[gpa168]

This issue still exist. One of the calls to Azure key vault fails with 401 status code and other one passes with 200 status code. Ideally both requests should have been success with 200 status code.

[chenrujun]

Hi, @gpa168 , could you please check my last comment?