Connect-AzAccount -MSI does not work in the Azure Web App Sandbox
#7876
Comments
|
If you want to DM me on Teams or shoot me an email, we can coordinate a test environment. |
|
cc @markcowl This is a blocking issue for us |
|
@TylerLeonhardt Nothing has changed in this implementation, so I assume this was always not working in the sandbopx, even for AzureRM. We are just making standard HttpClient SendRequest calls - do you have any insight into the sandbox capabilities around HttpClient? |
|
@markcowl Here is an overview about the network restrictions applied to the sandbox, I hope it's useful for you to get some insight in what might be the cause. At the meantime, we found the module |
|
@markcowl @vladimir-shcherbakov I think I got to the bottom of this issue. It's because When receiving a bad response from the first request (the
As you can see, the request failed because of
If the mystery about BTW, the Here are the detailed tracing logs with my annotations to help you understand my tracing: |
|
Cc @mattchenderson @jeffhollan Incase they have context on api version |
|
From here: https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity#using-the-rest-protocol looks like the only supported version for app service MSI is 2017-09-01 so that well maybe the issue here. Also the http://localhost:50342/oauth2/token endpoint is for the older implementation of MSI in VM's which uses the MSI VM extension which is in the process of getting deprecated so this will obviously not work in the Functions Sandbox. |
|
An e-mail sent out to discuss possible ways of fixing the issue. |
|
I hope you guys can fix this. If I try the workaround $TenantId = $env:TenantId
$SubscriptionId = $env:SubscriptionId
$AccountId = $env:ApplicationId
$apiVersion = "2017-09-01"
$resourceURI = "https://management.azure.com/"
$tokenAuthURI = $env:MSI_ENDPOINT + "?resource=$resourceURI&api-version=$apiVersion"
$tokenResponse = Invoke-RestMethod -Method Get -Headers @{"Secret"="$env:MSI_SECRET"} -Uri $tokenAuthURI
$accessToken = $tokenResponse.access_token
$DefaultProfile = Connect-AzAccount -TenantId $TenantId -AccountId $AccountId -SubscriptionId $SubscriptionId -AccessToken $accessToken -Scope ProcessI get an error Meaning either way I cannot work with the MSI |
|
Fix released 1/31/2019 |
Hi there 👋
I work on the PowerShell language worker in Azure Functions.
Description
We are trying to get MSI working with Azure PowerShell so that users will be able to use MSI to authenticate their PowerShell functions. The Azure Functions run in the Azure Web App Sandbox so there are limitations in place for certain network traffic and other things.
Script/Steps for Reproduction
Run inside of an Azure Function App.
This gives me the following exception:
Module Version
Environment Data
$PSVersionTableDebug Output
Wasn't able to get anything.
Workaround
I have a script that works for now... but really
-MSIshould work in this scenario.Interested parties:
@asavaritayal, @anirudhgarg, @pragnagopa, @fabiocav from the Azure Functions team.
@daxian-dbw, @SteveL-MSFT, @joeyaiello from the PowerShell team
The text was updated successfully, but these errors were encountered: