Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple HTTPS error and long wait time when combine MSI and local development for KeyVault access [BUG] #15626

Closed
bernardjeef opened this issue Oct 1, 2020 · 4 comments
Assignees
Labels
Client This issue points to a problem in the data-plane of the library. customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault needs-team-attention Workflow: This issue needs attention from Azure service team or SDK team question The issue doesn't require a change to the product in order to be resolved. Most issues start as that

Comments

@bernardjeef
Copy link

Describe the bug
Localhost connection to Keyvault on startup will fallback multiple HTTPS requests before working and will cause long waiting time on startup. There is 1 minute delay before it start working.

Expected behavior
I would expect that the Azure Keyvault SDK does not try to get keyvault secrets without bearer.

Actual behavior (include Exception or Stack Trace)
What is the actual behavior?
image

To Reproduce

  1. Create the infra from here https://github.com/hugogirard/devOpsMonolith
  2. Add your personal account on keyvault accessPolicy and give access to GET/LIST secrets
  3. Open the project in Visual Studio and make sure you are logged in Azure Service Authentification.

Here is the startup :
image

Environment:
image

  • IISExpress .Net Core 3.1
  • Visual Studio Enterprise 2019 16.7.2
@ghost ghost added needs-triage Workflow: This is a new issue that needs to be triaged to the appropriate team. customer-reported Issues that are reported by GitHub users external to the Azure organization. question The issue doesn't require a change to the product in order to be resolved. Most issues start as that labels Oct 1, 2020
@jsquire jsquire added Client This issue points to a problem in the data-plane of the library. KeyVault needs-team-attention Workflow: This issue needs attention from Azure service team or SDK team labels Oct 2, 2020
@ghost ghost removed the needs-triage Workflow: This is a new issue that needs to be triaged to the appropriate team. label Oct 2, 2020
@jsquire
Copy link
Member

jsquire commented Oct 2, 2020

//cc: @schaabs

@jsquire
Copy link
Member

jsquire commented Oct 2, 2020

Thank you for your feedback. Tagging and routing to the team members best able to assist.

@heaths
Copy link
Member

heaths commented Oct 2, 2020

Key Vault issues a challenge and responds with a 401, to which the challenge is authenticated and sent back. Given that Microsoft.Azure.KeyVault is deprecated and that we made some concurrency improvements to this challenge behavior in our newer packages, we recommend you upgrade to Azure.Security.KeyVault.Secrets. For ASP.NET configuration, you can use newer versions of Microsoft.Configuration.ConfigurationBuilders.Azure that use this packge.

This is still going to get an HTTP 401 response, however, but fewer if you have concurrent requests since we minimally block the threads until we can issue a challenge response. If you have problems with connections timing out with the new package (there are other improvements to the pipeline to mitigate connection pool starvation, which also help), please feel free to open an issue with specific details (e.g. stack trace, sanitized trace logs, and package versions).

@heaths heaths closed this as completed Oct 2, 2020
@heaths
Copy link
Member

heaths commented Oct 2, 2020

We will consider a challenge-free auth flow as well: #15651

@github-actions github-actions bot locked and limited conversation to collaborators Mar 28, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Client This issue points to a problem in the data-plane of the library. customer-reported Issues that are reported by GitHub users external to the Azure organization. KeyVault needs-team-attention Workflow: This issue needs attention from Azure service team or SDK team question The issue doesn't require a change to the product in order to be resolved. Most issues start as that
Projects
None yet
Development

No branches or pull requests

3 participants