Azure / Azure/Webjobs.Extensions.Kusto

Using System Managed Identity on local machine

Open
#49 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
5
Forks
15
PR merge metrics
No merged PRs in 30d

Description

I wanted to use this extension along with my Managed Identity.
On local systems, this should default to the logged in user in Azure CLI or Visual Studio. However, this does not appear to be possible. I'm receiving the following error:

> [2023-11-14T20:26:23.583Z] System.Private.CoreLib: Exception while executing function: Functions.AddSensorData. Microsoft.Azure.WebJobs.Host: Error while handling parameter _binder after function returned:. Kusto.Ingest: A permanent error occurred while attempting to ingest: 'Stream' via streaming ingestion. Error: 'ManagedIdentityCredential authentication unavailable. Multiple attempts failed to obtain a token from the managed identity endpoint.'. Azure.Identity: ManagedIdentityCredential authentication unavailable. Multiple attempts failed to obtain a token from the managed identity endpoint. Azure.Core: Retry failed after 4 tries. Retry settings can be adjusted in ClientOptions.Retry or by configuring a custom retry policy in ClientOptions.RetryPolicy. (A socket operation was attempted to an unreachable network. (169.254.169.254:80)) (A socket operation was attempted to an unreachable network. (169.254.169.254:80)) (A socket operation was attempted to an unreachable network. (169.254.169.254:80)) (A socket operation was attempted to an unreachable network. (169.254.169.254:80)). Azure.Core: A socket operation was attempted to an unreachable network. (169.254.169.254:80). System.Net.Http: A socket operation was attempted to an unreachable network. (169.254.169.254:80). System.Net.Sockets: A socket operation was attempted to an unreachable network.

As for context, this is the configuration I'm using

```json
{
"IsEncrypted": false,
"Values": {
"AzureWebJobsStorage": "UseDevelopmentStorage=true",
"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
"MachineDataDatabase": "data",
"KustoConnectionString": "Data Source=https://my-instance.westeurope.kusto.windows.net;Initial Catalog=NetDefaultDB;User ID=;Password=;Application Client Id=;Application Key=;Application Certificate Thumbprint=;Application Certificate Subject Distinguished Name=;Application Certificate Issuer Distinguished Name=;Application Token=;User Token=;AAD Federated Security=True;dSTS Federated Security=False;Authority Id=",
"MachineTemperatureTableName": "MachineTemperature"
}
}
```

I got the connection string via LinqPad using the following code:

```csharp
var kustoUri = "https://my-instance.westeurope.kusto.windows.net";
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
.WithAadSystemManagedIdentity();

kustoConnectionStringBuilder.ConnectionString.Dump();
```

The actual Azure Function is rather simple at the moment.

```csharp
[Function(nameof(AddSensorData))]
[KustoOutput(Database: "data", Connection = "KustoConnectionString", TableName = "MachineTemperature", ManagedServiceIdentity = "system")]
public IEnumerable AddSensorData(
[HttpTrigger(AuthorizationLevel.Function, "get")]
HttpRequestData req)
{
_logger.LogInformation("Creating temperature data.");

List result = new ();
for(int i = 0; i < Produce.BatchSize; i++)
{
var machineName = NameBuilder.Machine(random.Next(0, Produce.BatchSize));
result.Add(new MachineTemperature
{
MachineId = computeIdentifier.Invoke(machineName),
MachineName = machineName,
TimeGenerated = DateTime.UtcNow,
TemperatureCelcius = random.Next(2000, 15000)
});
}
return result;
}
```

Am I doing something wrong in my current setup, maybe the connectionstring? Or is this scenario not supported (yet)?
Would love to know if/how I can resolve this.

Of course, creating a service principal & secret is a possibility but that would be my last resort.

Contributor guide

Open the contributing guide

Research direction

Start with the AddSensorData function and its KustoOutput attribute, then trace how the KustoConnectionString and ManagedServiceIdentity="system" settings are handled during local execution. Compare that behavior with the Azure CLI or Visual Studio identity described in the issue; done means the supported local authentication behavior is established and covered by an appropriate test or documentation.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.