Skip to content

ManagedIdentityCredential correctly detects App Service 2019 environment but sends wrong HTTP header name. #6823

@vipulpawale

Description

@vipulpawale

Bug: ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.

Environment:

  • Runtime: Service Fabric on Windows Server 2019
  • Azure SDK for C++: v1.11.0
  • IMDS Endpoint: http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0
  • Environment Variables Set by Service Fabric:
    • IDENTITY_ENDPOINT (set by runtime)
    • IDENTITY_HEADER (set by runtime)

Issue:
ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.

Expected Behavior:
Service Fabric IMDS requires header named secret (lowercase):

// Working manual implementation:
std::wstring headerTag = L"secret:";
WinHttpAddRequestHeaders(hRequest, headerTag.c_str(), ...);

Actual Behavior:
SDK sends x-identity-header instead:

HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?...
x-identity-header : <value>  ❌ Wrong header name

Error Response:

{
  "error": {
    "code": "BadRequestWithReason",
    "message": "BadRequestWithReason Secret header is required"
  }
}

Comparison with Other SDKs:

  • ✅ Python azure-identity: Correctly detects Service Fabric and uses secret header
  • ✅ .NET Azure.Identity: Correctly detects Service Fabric and uses secret header
  • ❌ C++ azure-identity: Detects Service Fabric but uses wrong header

Request:
Add proper Service Fabric Managed Identity support to match Python and .NET SDK capabilities.

Log Snippet:
GeneralizedSendUsageEvents failed with HRESULT: 0x85210002
TokenProviderCallback: Requesting token for scope: https://usage.azure.com/
Managed Identity Name (for logging): c1f44206-0092-4e20-8706-316e19182180
Using ManagedIdentityCredential with client ID: 30f7d658-b830-47ca-9ded-609d11a3a96c
Setting MSI_ENDPOINT from IDENTITY_ENDPOINT: http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0
Setting MSI_SECRET from IDENTITY_HEADER: XXXX_DELETED_FOR_TICKET
Identity: ManagedIdentityCredential will be created with App Service 2019 source and Client ID '30f7d658-b830-47ca-9ded-609d11a3a96c'.
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=2019-08-01&client_id=REDACTED&resource=REDACTED
user-agent : azsdk-cpp-identity/1.11.0 (Windows Server 2019 Datacenter 6.3 17763 17763.1.amd64fre.rs5_release.180914-1434 Cpp/201402)
x-identity-header : REDACTED
x-ms-client-request-id : 09eb2999-af1c-46d7-8e6c-0a41ea623558
Status operation: 16(WINHTTP_CALLBACK_STATUS_SENDING_REQUEST )
Status operation: 32(WINHTTP_CALLBACK_STATUS_REQUEST_SENT )
Status operation: 4194304(WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Authentication error in TokenProviderCallback: GetToken(): error response: 400 Bad Request

{
"error": {
Status operation: 131072(WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
Read Data read from wire. Size: 145.
ReadData returned size: 145.
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required",
"details": []
}
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    customer-reportedIssues that are reported by GitHub users external to the Azure organization.needs-triageWorkflow: This is a new issue that needs to be triaged to the appropriate team.questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions