Skip to content

az login with UAMI (-i) experienced slowness #32429

@chungyuhuang

Description

@chungyuhuang

Describe the bug

When running the command "az login -i --debug", we experienced a slowness after the below log.

cli.azure.cli.core.auth.msal_credentials: ManagedIdentityCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], kwargs={}

It took almost 10 seconds to output the next line of log.

msal.managed_identity: Obtaining token via managed identity on Azure VM

The rest of the process is fast when calling the IMDS but before obtaining token with the UAMI on VM, it got stuck.

The VM has one UAMI assigned and no SAMI.

Same slowness observed for the command az account get-access-token --debug as well. The msal_credentials: ManagedIdentityCredential.acquire_token step took longer time to process.

We've checked the VM and it doesn't have any HTTP proxy configured in the env.

Related command

az login -i debug
az account get-access-token --debug

Errors

No error observed but experienced slowness when running the command.

cli.azure.cli.core.auth.msal_credentials: ManagedIdentityCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], kwargs={}
---> stuck for 10 second then conitnue the below output
msal.managed_identity: Obtaining token via managed identity on Azure VM
urllib3.connectionpool: Starting new HTTP connection (1): 169.254.169.254:80

Issue script & Debug output

cli.azure.cli.core.auth.msal_credentials: ManagedIdentityCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], kwargs={}
---> stuck for 10 second then conitnue the below output
msal.managed_identity: Obtaining token via managed identity on Azure VM
urllib3.connectionpool: Starting new HTTP connection (1): 169.254.169.254:80

Expected behavior

Expect the login to be finished within 10 seconds.

Environment Summary

azure-cli 2.76.0
azure-cli-core 2.76.0
azure-cli-telemetry 1.1.0
extensions: {}

Additional context

No response

Metadata

Metadata

Labels

ARMaz resource/group/lock/tag/deployment/policy/managementapp/account management-groupAccountaz login/accountAuto-AssignAuto assign by botAuto-ResolveAuto resolve by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamquestionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions