-
Notifications
You must be signed in to change notification settings - Fork 142
Description
Bug: ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.
Environment:
- Runtime: Service Fabric on Windows Server 2019
- Azure SDK for C++: v1.11.0
- IMDS Endpoint:
http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0 - Environment Variables Set by Service Fabric:
IDENTITY_ENDPOINT(set by runtime)IDENTITY_HEADER(set by runtime)
Issue:
ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.
Expected Behavior:
Service Fabric IMDS requires header named secret (lowercase):
// Working manual implementation:
std::wstring headerTag = L"secret:";
WinHttpAddRequestHeaders(hRequest, headerTag.c_str(), ...);Actual Behavior:
SDK sends x-identity-header instead:
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?...
x-identity-header : <value> ❌ Wrong header name
Error Response:
{
"error": {
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required"
}
}Comparison with Other SDKs:
- ✅ Python
azure-identity: Correctly detects Service Fabric and usessecretheader - ✅ .NET
Azure.Identity: Correctly detects Service Fabric and usessecretheader - ❌ C++
azure-identity: Detects Service Fabric but uses wrong header
Request:
Add proper Service Fabric Managed Identity support to match Python and .NET SDK capabilities.
Log Snippet:
GeneralizedSendUsageEvents failed with HRESULT: 0x85210002
TokenProviderCallback: Requesting token for scope: https://usage.azure.com/
Managed Identity Name (for logging): c1f44206-0092-4e20-8706-316e19182180
Using ManagedIdentityCredential with client ID: 30f7d658-b830-47ca-9ded-609d11a3a96c
Setting MSI_ENDPOINT from IDENTITY_ENDPOINT: http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0
Setting MSI_SECRET from IDENTITY_HEADER: XXXX_DELETED_FOR_TICKET
Identity: ManagedIdentityCredential will be created with App Service 2019 source and Client ID '30f7d658-b830-47ca-9ded-609d11a3a96c'.
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=2019-08-01&client_id=REDACTED&resource=REDACTED
user-agent : azsdk-cpp-identity/1.11.0 (Windows Server 2019 Datacenter 6.3 17763 17763.1.amd64fre.rs5_release.180914-1434 Cpp/201402)
x-identity-header : REDACTED
x-ms-client-request-id : 09eb2999-af1c-46d7-8e6c-0a41ea623558
Status operation: 16(WINHTTP_CALLBACK_STATUS_SENDING_REQUEST )
Status operation: 32(WINHTTP_CALLBACK_STATUS_REQUEST_SENT )
Status operation: 4194304(WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Authentication error in TokenProviderCallback: GetToken(): error response: 400 Bad Request
{
"error": {
Status operation: 131072(WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
Read Data read from wire. Size: 145.
ReadData returned size: 145.
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required",
"details": []
}
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
}