Azure KeyVault: Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials

Question

I am trying to connect my aspnet core application that is targeting .net framework with Azure Keyvault. On a new azure vm that supports identity everything works fine, but this application is hosted on a classic azure vm that does not support identity. I made the system environment variable AzureServiceAuthConnectionString which severable other .net framework applications with Azure keyvault are already using and are working perfectly.

Looking at my stdout logs I get the following exception everytime.

Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials EnvironmentCredential authentication unavailable. Environment variables are not fully configured ManagedIdentityCredential authentication unavailable, the requested identity has not been assigned to this resource.

I use the following code in the startup:

        public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
            WebHost.CreateDefaultBuilder(args)               
       .UseApplicationInsights(ConfigurationManager.AppSettings["applicationInsightsInstrumentationKey"])
                .ConfigureKestrel(options => options.AddServerHeader = false)
                .UseIISIntegration()
                .ConfigureAppConfiguration((context, config) =>
                {
                    var vaultName = ConfigurationManager.AppSettings["VaultName"];
                    if (!string.IsNullOrEmpty(vaultName))
                    {
                        var azureServiceTokenProvider = new AzureServiceTokenProvider();
                        var keyVaultClient = new KeyVaultClient(
                            new KeyVaultClient.AuthenticationCallback(
                                azureServiceTokenProvider.KeyVaultTokenCallback));

                        config.AddAzureKeyVault(
                            $"https://{vaultName}.vault.azure.net/",
                            keyVaultClient,
                            new DefaultKeyVaultSecretManager());
                    }
                })
                .UseStartup<Startup>();

And in the web.config the following items :

   <configSections>
      <section name="configBuilders" type="System.Configuration.ConfigurationBuildersSection, System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" restartOnExternalChanges="false" requirePermission="false"/>
   </configSections>
   <configBuilders>
    <builders>
      <add name="AzureKeyVault" vaultName="<#= this.VaultName #>" type="Microsoft.Configuration.ConfigurationBuilders.AzureKeyVaultConfigBuilder, Microsoft.Configuration.ConfigurationBuilders.Azure, Version=2.0.0.0, Culture=neutral" vaultUri="https://<#= this.VaultName #>.vault.azure.net" />
    </builders>
  </configBuilders>
  <connectionStrings configBuilders="AzureKeyVault">
      <add name="ConnectionString" connectionString="" providerName="System.Data.SqlClient"/>
  </connectionStrings>

score 86 · Answer 1 · answered Oct 13 '20 at 19:16

86

This error can also occur if Visual Studio loses it's Azure Service Authentication connection for some reason or your actual AD credentials have changed (for example a password change).

In this case, simply signing in again has fixed this for me:

In Visual Studio, go to Tools > Options. Expand "Azure Service Authentication" > "Account Selection." If you see a "Reenter your credentials" link, click it and sign in again. If not, try a regular sign-out + sign-in via your Visual Studio profile in the top right.

answered Oct 13 '20 at 19:16

ElliotSchmelliot

7,322
4
41
64

3

Wish I could upvote this more, huge time saver! – nurdyguy Apr 21 '22 at 20:44
Me too. My VS was using a different Microsoft account in that setting. Would've died of old age before discovering that. Many thanks! – NobleGuy Feb 11 '23 at 13:27
Gold Star, sir! – Jeff Yates Jul 06 '23 at 16:05

score 32 · Accepted Answer · answered Jul 09 '20 at 15:08

32

Could you validate that you are setting the following system environment variables?

AZURE_CLIENT_ID - service principal's app id

AZURE_TENANT_ID - id of the principal's Azure Active Directory tenant

AZURE_CLIENT_SECRET - one of the service principal's client secrets

answered Jul 09 '20 at 15:08

Christopher Scott

2,676
2
26
26

1

I had everything except the AZURE_TENANT_ID. After adding it the keyvault worked as expected. Thankyou! – Dylan Meivis Jul 10 '20 at 09:15
where in key vault you added this information? – Code run Dec 14 '20 at 13:45
1

Sorry for the late response! The 3 lines of information you see above I added them into my environment variables on the virtual machine my application runs on. @Coderun – Dylan Meivis Jan 07 '21 at 10:52
Yes, I did the same. It worked for me as well – Code run Jan 12 '21 at 12:53
The key here for me was "system" environment variables. I tried setting them in code at the process level and it didn't work that way. Setting them from the system dialog worked. – E. Moffat Mar 18 '21 at 00:49
But this only works, when I login in Visual Studio. If I keep just these environment variables and do not sign in, it doesn't work. – CredibleAshok Jul 02 '21 at 08:57
I'm having similar issues but at build time in Azure DevOps Build Pipeline. When the VSBuild task runs, and it gets into the `MvcBuildViews` portion of the MSBuild, it encounters an error: `##[error]ASPNETCOMPILER(0,0): Error ASPRUNTIME: Type is not resolved for member 'Azure.Identity.CredentialUnavailableException,Azure.Identity, Version=1.4.1.0, Culture=neutral, PublicKeyToken=92742159e12e44c8'.` I've added an Azure CLI task in the pipeline, before the build, so there's an active az login using the service connection. I can also confirm the service connection can enumerate kv secrets. – Thiago Silva Oct 01 '21 at 15:17
Do we need to do this even if we are using managed identity? – OpenStack Oct 01 '22 at 15:31
No, Managed Identity doesn't require setting environment variables unless you are needing to specify the id of a user-defined identity. – Christopher Scott Oct 17 '22 at 15:42

score 8 · Answer 3 · edited Aug 16 '22 at 16:21

8

In VS 2019 app, for me, one can re-enter the credentials for the VS logged-in user, which has access to the azure resource group.

edited Aug 16 '22 at 16:21

ΩmegaMan

29,542
12
100
122

answered Oct 28 '20 at 13:04

Deepak Mitawa - AIS

151
2
5

score 6 · Answer 4 · answered Oct 12 '22 at 19:26

6

I followed the below steps to fix the issue. Make sure you have azure portal access and to the required resources.

Install Azure Cli
Open PowerShell as admin
Login to azure using az login command
Open visual studio as administrator

answered Oct 12 '22 at 19:26

Kurkula

6,386
27
127
202

This worked for me after some of the other solutions didn't do it. – Dave Jun 20 '23 at 23:32

score 5 · Answer 5 · answered Oct 18 '22 at 05:38

5

This means the IDE is unable to find Azure credentials from your build environment/container. If the logout/login method doesn’t work, then from your terminal:

az login

Login with your credentials and re-run the program.

answered Oct 18 '22 at 05:38

karthik006

886
9
19

score 4 · Answer 6 · edited Aug 16 '22 at 16:22

4

If you're running your site locally using IIS, and not IIS Express, you may need to run the site's application pool identity under your Azure account credentials, so the exact credentials you use to login in your browser to portal.azure.com or dev.azure.com. Your PAT will not work.

Once that has been setup, recycle the app pool.

Then go to %windir%\System32\inetsrv\config\applicationHost.config

Search for setProfileEnvironment. If it's set to false, change it to true.

If not present, add it under applicationPoolDefaults tag i.e

<applicationPoolDefaults managedRuntimeVersion="v4.0">
    <processModel identityType="ApplicationPoolIdentity" loadUserProfile="true" setProfileEnvironment="true" />
</applicationPoolDefaults>

edited Aug 16 '22 at 16:22

ΩmegaMan

29,542
12
100
122

answered Jun 10 '21 at 01:45

Greg Quinn

1,927
1
23
26

I was having issue with KeyVault connection. It worked after adding the environment variables for Azure ClientID, TenantId and Client Secreat – Ratheesh Dec 13 '21 at 07:02
How to run the site's application pool identity under your Azure account credentials? – prasad maganti Mar 08 '22 at 06:31
I was able to authenticate azure keyvault in localhost but in IIS getting multiple errors on authentication – prasad maganti Mar 08 '22 at 06:32
@prasadmaganti You literally enter your email and password you use to login to the Azure Portal in the account credentials. – Greg Quinn Apr 26 '22 at 22:12

score 3 · Answer 7 · answered Feb 18 '22 at 06:00

3

For me this was just the first exception, drilling down further (Continue => Continue => Continue) I eventually got to the REAL exception:

''az' is not recognized as an internal or external command'

Turns out I had forgotten to install Azure CLI on my machine!

Once I did that I still got the original 'CredentialUnavailableException' but its handled (not sure why my debugger is breaking on it, but that's another story) and everything worked.

This StackOverflow link helped.

answered Feb 18 '22 at 06:00

RichyRoo

373
3
10

Thanks, this should be the first thing people should try. This was also my issue. Just one thing, after installing Azure CLI close VS and reopen it. Else you still get the error. – Laurent Greyling Apr 07 '22 at 07:30

score 0 · Answer 8 · answered Dec 07 '22 at 12:20

When debugging a webservice that is hosted in IIS remember to set the application pool Identity to your own account.

I bumped into this out after several hours of trying, the follow code did push me in the the right direction.

        var credential = new DefaultAzureCredential(
            new DefaultAzureCredentialOptions
            {
                VisualStudioTenantId = "xxx",
                ExcludeVisualStudioCodeCredential = true,
                ExcludeEnvironmentCredential = true,
                ExcludeManagedIdentityCredential = true,
                ExcludeVisualStudioCredential = false,
                ExcludeAzureCliCredential = true,
                ExcludeAzurePowerShellCredential = true,
                ExcludeSharedTokenCacheCredential = true
            });
        var token = credential.GetToken(new Azure.Core.TokenRequestContext(new[] { "https://database.windows.net/.default" }));

Visual Studio Token provider can't be accessed at c:\windows\system32\inetsrv.IdentityService\AzureServiceAuth\tokenprovider.json

Ofcourse that is the DefaultApplicationPool Identity being system :(

score 0 · Answer 9 · answered May 22 '23 at 12:49

For me, it was running fine locally but I experienced this problem with the deployed web app in Azure. It was having trouble accessing KeyVault.

Double check key vault role assignment:

Browse to the web app (in portal.azure.com)
Click on the Identity menu item on the left
Under the System assigned tab, make sure that status is On
Then under the Permission section, click Azure role assignments
Choose subscription, then select the resource, and "Key Vault Secrets User" or similar as the role, and fill out the rest.

Restart the web app or browse this in App Service Editor console to verify that the problem is resolved. Hope this helps someone!

score 0 · Answer 10 · answered Jun 29 '23 at 16:57

0

In my situation, Visual Studio logged in to Azure was not enough, though from Microsoft documentation it sounds like an option. I had to install Azure CLI on my Windows 11, and it still did not work to me until I rebooted my Windows

answered Jun 29 '23 at 16:57

YMC

4,925
7
53
83

score 0 · Answer 11 · answered Jul 19 '23 at 13:28

0

I accidentally added a connection string to my azure app service referencing activedirectory, when I needed to use username and pw

answered Jul 19 '23 at 13:28

Adam Diament

4,290
3
34
55

Azure KeyVault: Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials

11 Answers11

Linked