az login --identity issue on Machine Learning Compute: SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 64
Description
### Describe the bug
Azure Machine Learning Compute with a `System assigned identity` cannot execute the `az login --identity` command
This occurs with both conda and core ubuntu instances of `az cli`
Note:
- Managed Identity exists and is registered in EntraID
- Instance was created on 19/1/2024
- Image Size `Standard_DS11_v2 (2 cores, 14 GB RAM, 28 GB disk)`
- OS All packages have been updated and the machine restarted
### Related command
## with the default conda environment `azureml_py38`
Running `az login --identity`
Returns
> MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
## If conda is deactivated
running `az version` shows
> {
"azure-cli": "2.56.0",
"azure-cli-core": "2.56.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"ml": "2.5.0"
}
}
Running `az login --identity`
Returns
> MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
### Errors
# From conda environment
MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
The command failed with an unexpected error. Here is the traceback:
MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
Traceback (most recent call last):
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
raise ex
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
result = cmd_copy(params)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
return self.handler(*args, **kwargs)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
return op(**command_args)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/command_modules/profile/custom.py", line 122, in login
return profile.login_with_managed_identity(username, allow_no_subscriptions)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/_profile.py", line 234, in login_with_managed_identity
msi_creds = MSIAuthenticationWrapper(resource=resource)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msrestazure/azure_active_directory.py", line 592, in __init__
self.set_token()
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/auth/adal_authentication.py", line 75, in set_token
super().set_token()
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msrestazure/azure_active_directory.py", line 596, in set_token
self.scheme, _, self.token = get_msi_token_webapp(self.resource, self.msi_conf)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msrestazure/azure_active_directory.py", line 546, in get_msi_token_webapp
raise RuntimeError(err_msg)
RuntimeError: MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
# From default environment
The command failed with an unexpected error. Here is the traceback:
MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
Traceback (most recent call last):
File "/opt/az/lib/python3.11/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
raise ex
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
result = cmd_copy(params)
^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
return self.handler(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
return op(**command_args)
^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/profile/custom.py", line 122, in login
return profile.login_with_managed_identity(username, allow_no_subscriptions)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/_profile.py", line 234, in login_with_managed_identity
msi_creds = MSIAuthenticationWrapper(resource=resource)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/msrestazure/azure_active_directory.py", line 592, in __init__
self.set_token()
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/auth/adal_authentication.py", line 75, in set_token
super().set_token()
File "/opt/az/lib/python3.11/site-packages/msrestazure/azure_active_directory.py", line 596, in set_token
self.scheme, _, self.token = get_msi_token_webapp(self.resource, self.msi_conf)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/msrestazure/azure_active_directory.py", line 546, in get_msi_token_webapp
raise RuntimeError(err_msg)
RuntimeError: MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
### Issue script & Debug output
azure cli commands listed above
### Expected behavior
managed identity can be used from the machine learning compute.
### Environment Summary
With the default conda environment `azureml_py38`
running `az version` shows
> {
"azure-cli": "2.49.0",
"azure-cli-core": "2.49.0",
"azure-cli-telemetry": "1.0.8",
"extensions": {
"ml": "2.5.0"
}
}
If conda is deactivated
running `az version` shows
> {
"azure-cli": "2.56.0",
"azure-cli-core": "2.56.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"ml": "2.5.0"
}
}
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.