[BUG] FormRecognizer and TextAnalytics clients don't work TokenCredential

[jongio]

1. Install Azure CLI
2. Run Azure CLI login: az login
3. Get current user object id az ad signed-in-user show --query objectId --output tsv
4. Assign current user to Cognitive Services User role

az role assignment create --assignee [objectIdFromAbove] --role a97b65f3-24c7-4388-baec-2e87135dc908

5. New up AzureCliCredential

var cred = new AzureCliCredential();

6. New up FormRecognizerClient

var formRecognizerClient = new FormRecognizerClient(
   endpoint,
   cred);

7. Call any method

var recognizeContentOperation = await formRecognizerClient.StartRecognizeContentFromUriAsync(new Uri(uri));

8. You will get this error:

Exception has occurred: CLR/Azure.RequestFailedException
An exception of type 'Azure.RequestFailedException' occurred in System.Private.CoreLib.dll but was not handled in user code: 'Service request failed.
Status: 400 (BadRequest)

Content:
{"error":{"code":"BadRequest","message": "Please provide an authentication key."}}

Headers:
apim-request-id: 42bf3386-0429-4f3c-88c6-16c25b9c794f
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Date: Mon, 15 Jun 2020 18:35:15 GMT
Content-Length: 82
Content-Type: application/json'
   at Azure.AI.FormRecognizer.ServiceRestClient.<AnalyzeLayoutAsyncAsync>d__44.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Azure.AI.FormRecognizer.FormRecognizerClient.<StartRecognizeContentFromUriAsync>d__11.MoveNext()
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at QueueService.Program.<Main>d__0.MoveNext() in C:\Users\Jon\OneDrive - Microsoft\code\GitHub\jongio\azsdkdemo2\src\net\Services\QueueService\Program.cs:line 72

According to docs, this should work.
https://azuresdkdocs.blob.core.windows.net/$web/dotnet/Azure.AI.FormRecognizer/1.0.0-preview.3/api/index.html#create-formrecognizerclient-with-azure-active-directory-credential

1. We should fix this so it works
2. We should make sure we update the error message to ensure it throws a 403 if the user doesn't have appropriate perms.

I ensured that the current CLI user has perms via portal:

azsdke2e

[annelo-msft]

@maririos per TA as well.

[jongio]

My cog services resource created with Terraform has this endpoint: https://westus.api.cognitive.microsoft.com/

resource "azurerm_cognitive_account" "form_recognizer" {
  name                = "${var.basename}formrecognizer"
  location            = var.location
  resource_group_name = azurerm_resource_group.rg.name
  kind                = "FormRecognizer"

  sku_name = "S0"
}

I created a new resource with the portal and it has this endpoint: https://jongfrtest.cognitiveservices.azure.com/

TokenCred works with https://jongfrtest.cognitiveservices.azure.com/ but not https://westus.api.cognitive.microsoft.com/

[jongio]

I have verified that this issue surfaced because I was using a region endpoint instead of an endpoint with a custom subdomain.

I have created the following issues to help improve that experience. Closing this issue.

1. The Cognitive Services Terraform provider does not support custom subdomain. Opened an issue here: Support CustomSubDomain in azurerm_cognitive_account hashicorp/terraform-provider-azurerm#7338
2. The Cognitive Services Terraform provider does not support setting a Managed Identity. Opened an issue here: Support Identity for azurerm_cognitive_account  hashicorp/terraform-provider-azurerm#7339
3. The Cognitive Services docs could be improved to educate on the difference between region and subdomain endpoints. Opened an issue here: [DOC] Add Cognitive Services requires custom subdomain for TokenCred to docs #12789
4. The Cognitive Services error message when trying to use AAD token against region endpoint can be improved. Opened an issue here: [FEATURE REQ] CognitiveServices should provide a better error message when trying to use AAD Token against a region endpoint. #12813
5. The Cognitive Services doc state that Cognitive Services User role is required, but it is not. Opened an issue here: [BUG] Cognitive Services docs state that "Cognitive Services User" role is required, but it is not. #12814

[maririos]

Thanks @jongio for the investigation and following up. Will triage the issues created and work on the improvements.