We are trying to create a local environment for our application based on the guidelines here :

In order to authenticate to services , we are trying to use DefaultAzureCredentials() .

• But a standalone DefaultAzureCredential was giving us the following exception

  (Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. \r\n- EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. \r\n- WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. \r\n- ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource.\r\nStatus: 400 (Bad Request)\r\n\r\nContent:\r\n{\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"}\r\n\r\nHeaders:\r\nx-ms-request-id: 1f8909d1-e628-4d91-896b-50166142786a\r\nContent-Length: 68\r\nContent-Type: application/json; charset=utf-8\r\nDate: Tue, 19 Nov 2024 19:05:50 GMT\r\nServer: IMDS/150.870.65.1475\r\n\r\n- Visual Studio Token provider can't be accessed at C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\.IdentityService\\AzureServiceAuth\\tokenprovider.json\r\n- Azure CLI authentication failed due to an unknown error. See the troubleshooting guide for more information.  Traceback (most recent call last):\r\n  File \"runpy.py\", line 196, in _run_module_as_main\r\n  File \"runpy.py\", line 86, in _run_code\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/__main__.py\", line 39, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/__init__.py\", line 917, in get_default_cli\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/azlogging.py\", line 30, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py\", line 25, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/extension/__init__.py\", line 18, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/config.py\", line 40, in __init__\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/util.py\", line 115, in ensure_dir\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/util.py\", line 112, in ensure_dir\r\n  File \"os.py\", line 225, in makedirs\r\nPermissionError: [WinError 5] Access is denied: 'C:\\\\WINDOWS\\\\system32\\\\config\\\\systemprofile\\\\.azure'\r\n- Az.Accounts module >= 2.2.0 is not installed.\r\n- Azure Developer CLI could not be found. ---> System.AggregateException: Multiple exceptions were encountered while attempting to authenticate. ---> Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. \r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)\r\n   at Azure.Identity.EnvironmentCredential.<GetTokenImplAsync>d__12.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Azure.Identity.EnvironmentCredential.<GetTokenAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenFromSourcesAsync>d__14.MoveNext()\r\n   --- End of inner exception stack trace ---\r\n   --- End of inner exception stack trace ---\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenFromSourcesAsync>d__14.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenImplAsync>d__12.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenImplAsync>d__12.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult()\r\n   at Microsoft.Azure.Advisor.Common.Providers.AzureMSALAuthenticationProvider.<GetAccessTokenUtility>d__20.MoveNext() in C:\\One\\EngSys\\EngSys-AzExpertBE\\src\\AzeCommon\\Providers\\AzureMSALAuthenticationProvider.cs:line 312"). 
  

• tried to use DefaulAzureCredential with credential option that got me a bit far ((auth failed for MFA here)  (

  Azure.Identity.AuthenticationFailedException: UsernamePasswordCredential authentication failed: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '2746ea77-4702-4b45-80ca-3c97e680e8b7'. Trace ID: a183be80-9b37-4d4b-b861-e7b104930d00 Correlation ID: 498902ed-d264-42b7-8e97-60001298377c Timestamp: 2024-11-18 23:03:41Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see . If you are using the On-Behalf-Of flow, see  for details.\nSee the troubleshooting guide for more information.  ---> Microsoft.Identity.Client.MsalClaimsChallengeException: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '2746ea77-4702-4b45-80ca-3c97e680e8b7'. Trace ID: a183be80-9b37-4d4b-b861-e7b104930d00 Correlation ID: 498902ed-d264-42b7-8e97-60001298377c Timestamp: 2024-11-18 23:03:41Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see . If you are using the On-Behalf-Of flow, see  for details.\r\n   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)\r\n   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)\r\n   at Microsoft.Identity.Client.OAuth2.OAuth2Client.<ExecuteRequestAsync>d__12`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.OAuth2.TokenClient.<SendHttpAndClearTelemetryAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Microsoft.Identity.Client.OAuth2.TokenClient.<SendHttpAndClearTelemetryAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.OAuth2.TokenClient.<SendTokenRequestAsync>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatch Info.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<SendTokenRequestAsync>d__26.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.<GetTokenResponseAsync>d__6.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.<ExecuteAsync>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was
  

  )

• tried to use the normal VisualStudioCredential () was initially getting a file not found exception for tokenprovider.json file but it seemed SF app was looking in windows32 instead of %userlocal% to get the file. so copied the file over and re-ran getting me a permission denied to access the file ( was not able to see a way to direct SF app to look for my %userlocal% path) (

  Azure.Identity.AuthenticationFailedException: VisualStudioCredential authentication failed: Access to the path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\.IdentityService\\AzureServiceAuth\\tokenprovider.json' is denied. ---> System.UnauthorizedAccessException: Access to the path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\.IdentityService\\AzureServiceAuth\\tokenprovider.json' is denied.\r\n   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)\r\n   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)\r\n   at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize, Boolean checkHost)\r\n   at System.IO.File.InternalReadAllText(String path, Encoding encoding, Boolean checkHost)\r\n   )
  

  ( PS: for step 1 and 2 : i tried to set Env_variables of AZURE_USERNAME, AZURE_PASSWORD,AZURE_TENANT_ID)

  Also have VS starting with Azure Auth set.

Any suggestions on how we can use DefaultAzureAuthentication() correctly or we could be going wrong?

We are trying to create a local environment for our application based on the guidelines here : https://learn.microsoft/en-us/dotnet/azure/sdk/authentication/local-development-service-principal?tabs=azure-portal%2Cvisual-studio%2Ccommand-line

In order to authenticate to services , we are trying to use DefaultAzureCredentials() .

• But a standalone DefaultAzureCredential was giving us the following exception

  (Azure.Identity.CredentialUnavailableException: DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot\r\n- EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot\r\n- WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/workloadidentitycredential/troubleshoot\r\n- ManagedIdentityCredential authentication unavailable. The requested identity has not been assigned to this resource.\r\nStatus: 400 (Bad Request)\r\n\r\nContent:\r\n{\"error\":\"invalid_request\",\"error_description\":\"Identity not found\"}\r\n\r\nHeaders:\r\nx-ms-request-id: 1f8909d1-e628-4d91-896b-50166142786a\r\nContent-Length: 68\r\nContent-Type: application/json; charset=utf-8\r\nDate: Tue, 19 Nov 2024 19:05:50 GMT\r\nServer: IMDS/150.870.65.1475\r\n\r\n- Visual Studio Token provider can't be accessed at C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\.IdentityService\\AzureServiceAuth\\tokenprovider.json\r\n- Azure CLI authentication failed due to an unknown error. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/azclicredential/troubleshoot Traceback (most recent call last):\r\n  File \"runpy.py\", line 196, in _run_module_as_main\r\n  File \"runpy.py\", line 86, in _run_code\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/__main__.py\", line 39, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/__init__.py\", line 917, in get_default_cli\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/azlogging.py\", line 30, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/commands/__init__.py\", line 25, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\azure/cli/core/extension/__init__.py\", line 18, in <module>\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/config.py\", line 40, in __init__\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/util.py\", line 115, in ensure_dir\r\n  File \"D:\\a\\_work\\1\\s\\build_scripts\\windows\\artifacts\\cli\\Lib\\site-packages\\knack/util.py\", line 112, in ensure_dir\r\n  File \"os.py\", line 225, in makedirs\r\nPermissionError: [WinError 5] Access is denied: 'C:\\\\WINDOWS\\\\system32\\\\config\\\\systemprofile\\\\.azure'\r\n- Az.Accounts module >= 2.2.0 is not installed.\r\n- Azure Developer CLI could not be found. ---> System.AggregateException: Multiple exceptions were encountered while attempting to authenticate. ---> Azure.Identity.CredentialUnavailableException: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)\r\n   at Azure.Identity.EnvironmentCredential.<GetTokenImplAsync>d__12.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Azure.Identity.EnvironmentCredential.<GetTokenAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenFromSourcesAsync>d__14.MoveNext()\r\n   --- End of inner exception stack trace ---\r\n   --- End of inner exception stack trace ---\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenFromSourcesAsync>d__14.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenImplAsync>d__12.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenImplAsync>d__12.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Azure.Identity.DefaultAzureCredential.<GetTokenAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.ValueTaskAwaiter`1.GetResult()\r\n   at Microsoft.Azure.Advisor.Common.Providers.AzureMSALAuthenticationProvider.<GetAccessTokenUtility>d__20.MoveNext() in C:\\One\\EngSys\\EngSys-AzExpertBE\\src\\AzeCommon\\Providers\\AzureMSALAuthenticationProvider.cs:line 312"). 
  

• tried to use DefaulAzureCredential with credential option that got me a bit far ((auth failed for MFA here)  (

  Azure.Identity.AuthenticationFailedException: UsernamePasswordCredential authentication failed: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '2746ea77-4702-4b45-80ca-3c97e680e8b7'. Trace ID: a183be80-9b37-4d4b-b861-e7b104930d00 Correlation ID: 498902ed-d264-42b7-8e97-60001298377c Timestamp: 2024-11-18 23:03:41Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see https://aka.ms/msal-conditional-access-claims. If you are using the On-Behalf-Of flow, see https://aka.ms/msal-conditional-access-claims-obo for details.\nSee the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/usernamepasswordcredential/troubleshoot ---> Microsoft.Identity.Client.MsalClaimsChallengeException: AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '2746ea77-4702-4b45-80ca-3c97e680e8b7'. Trace ID: a183be80-9b37-4d4b-b861-e7b104930d00 Correlation ID: 498902ed-d264-42b7-8e97-60001298377c Timestamp: 2024-11-18 23:03:41Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see https://aka.ms/msal-conditional-access-claims. If you are using the On-Behalf-Of flow, see https://aka.ms/msal-conditional-access-claims-obo for details.\r\n   at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)\r\n   at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)\r\n   at Microsoft.Identity.Client.OAuth2.OAuth2Client.<ExecuteRequestAsync>d__12`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.OAuth2.TokenClient.<SendHttpAndClearTelemetryAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at Microsoft.Identity.Client.OAuth2.TokenClient.<SendHttpAndClearTelemetryAsync>d__11.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.OAuth2.TokenClient.<SendTokenRequestAsync>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatch Info.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<SendTokenRequestAsync>d__26.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.<GetTokenResponseAsync>d__6.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at Microsoft.Identity.Client.Internal.Requests.UsernamePasswordRequest.<ExecuteAsync>d__5.MoveNext()\r\n--- End of stack trace from previous location where exception was
  

  )

• tried to use the normal VisualStudioCredential () was initially getting a file not found exception for tokenprovider.json file but it seemed SF app was looking in windows32 instead of %userlocal% to get the file. so copied the file over and re-ran getting me a permission denied to access the file ( was not able to see a way to direct SF app to look for my %userlocal% path) (

  Azure.Identity.AuthenticationFailedException: VisualStudioCredential authentication failed: Access to the path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\.IdentityService\\AzureServiceAuth\\tokenprovider.json' is denied. ---> System.UnauthorizedAccessException: Access to the path 'C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Local\\.IdentityService\\AzureServiceAuth\\tokenprovider.json' is denied.\r\n   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n   at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)\r\n   at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)\r\n   at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize, Boolean checkHost)\r\n   at System.IO.File.InternalReadAllText(String path, Encoding encoding, Boolean checkHost)\r\n   )
  

  ( PS: for step 1 and 2 : i tried to set Env_variables of AZURE_USERNAME, AZURE_PASSWORD,AZURE_TENANT_ID)

  Also have VS starting with Azure Auth set.

Any suggestions on how we can use DefaultAzureAuthentication() correctly or we could be going wrong?

• visual-studio-2022
• azure-service-fabric
• defaultazurecredential

• Please provide your code. – Pravallika KV Commented Nov 21, 2024 at 3:39
• Check if below solution helps @Kriskros. – Pravallika KV Commented Dec 3, 2024 at 6:44

2 Answers 2

I have followed below steps to use DefaultAzureCredential in Azure Service Fabric Application locally.

• Create a Service Fabric Application in Visual Studio(Admin).
• Created a KeyVault and EntraID Application.
• Navigate to Key Vault=>Access Policies(if you have selected vault access instead of RBAC)=>Create and grant Key and Secret permissions to the Service Principal (EntraID Application).

Set Azure_Client_ID, Azure_Client_Secret, Azure_Tenant_ID as environment variables locally.

Or you can set using the below code.

Code Snippet:

   protected override async Task RunAsync(CancellationToken cancellationToken)
   {
       string tenantId = "<Azure_Tenant_ID>";
       string clientId = "<AZURE_CLIENT_ID>";
       string clientSecret = "<AZURE_CLIENT_SECRET>";

       Environment.SetEnvironmentVariable("AZURE_TENANT_ID", tenantId);
       Environment.SetEnvironmentVariable("AZURE_CLIENT_ID", clientId);
       Environment.SetEnvironmentVariable("AZURE_CLIENT_SECRET", clientSecret);
       var defaultAzureCredentialOptions = new DefaultAzureCredentialOptions
       {
           ExcludeEnvironmentCredential = false,
           ExcludeManagedIdentityCredential = true,
           ExcludeSharedTokenCacheCredential = true,
           ExcludeVisualStudioCredential = false,
           ExcludeVisualStudioCodeCredential = false,
           ExcludeAzureCliCredential = true,
           ExcludeInteractiveBrowserCredential = true
       };

       var credential = new DefaultAzureCredential(defaultAzureCredentialOptions);
       var kvUri = "https://<KeyVault_name>.vault.azure/";

       var client = new SecretClient(new Uri(kvUri),credential);
       var secretName = "<Secret_Name>";
       var secret = await client.GetSecretAsync(secretName);
       string keyVaultValue = secret.Value.Value;

       long iterations = 0;
       while (true)
       {
           cancellationToken.ThrowIfCancellationRequested();
           ServiceEventSource.Current.ServiceMessage(this.Context, "Working-{0}", ++iterations);
           await Task.Delay(TimeSpan.FromSeconds(1), cancellationToken);
       }
   }

I could debug the code and fetch the secret from using DefaultAzureCredential locally.

Debug Output:

Step into: Stepping over property 'Azure.ValueResponse.get_Value'. To step into properties or operators, go to Tools->Options->Debugging and uncheck 'Step over properties and operators (Managed only)'.
Step into: Stepping over property 'Azure.Security.KeyVault.Secrets.KeyVaultSecret.get_Value'. To step into properties or operators, go to Tools->Options->Debugging and uncheck 'Step over properties and operators (Managed only)'.

The issue with this was that it was a Local Service fabric application and Service Fabric realm doesnot recognize beyond the SfAppCluster level, hence was not able to pick up the Visual studio credentials

What we did was to go the service principal route and set our environment variables ( https://learn.microsoft/en-us/dotnet/azure/sdk/authentication/local-development-service-principal?tabs=azure-portal%2Cwindows%2Ccommand-line )

And placing the S_+NI cert on the SfAppCluster folder localy