Azure / Azure/azure-cli

az login --identity issue on Machine Learning Compute: SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found

Open
#28,220 13 comments 1 reaction 1 assignee Claimed by @jiasli View on GitHub
Account act-codegen-extensibility-squad act-identity-squad Auto-Assign customer-reported Machine Learning question Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 10h
Merged PRs (30d)
64

Description

### Describe the bug

Azure Machine Learning Compute with a `System assigned identity` cannot execute the `az login --identity` command

This occurs with both conda and core ubuntu instances of `az cli`

Note:

- Managed Identity exists and is registered in EntraID
- Instance was created on 19/1/2024
- Image Size `Standard_DS11_v2 (2 cores, 14 GB RAM, 28 GB disk)`
- OS All packages have been updated and the machine restarted

### Related command

## with the default conda environment `azureml_py38`

Running `az login --identity`

Returns
> MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.

## If conda is deactivated

running `az version` shows

> {
"azure-cli": "2.56.0",
"azure-cli-core": "2.56.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"ml": "2.5.0"
}
}

Running `az login --identity`

Returns
> MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.

### Errors

# From conda environment

MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
The command failed with an unexpected error. Here is the traceback:
MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
Traceback (most recent call last):
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
raise ex
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
result = cmd_copy(params)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
return self.handler(*args, **kwargs)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
return op(**command_args)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/command_modules/profile/custom.py", line 122, in login
return profile.login_with_managed_identity(username, allow_no_subscriptions)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/_profile.py", line 234, in login_with_managed_identity
msi_creds = MSIAuthenticationWrapper(resource=resource)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msrestazure/azure_active_directory.py", line 592, in __init__
self.set_token()
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/azure/cli/core/auth/adal_authentication.py", line 75, in set_token
super().set_token()
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msrestazure/azure_active_directory.py", line 596, in set_token
self.scheme, _, self.token = get_msi_token_webapp(self.resource, self.msi_conf)
File "/anaconda/envs/azureml_py38/lib/python3.8/site-packages/msrestazure/azure_active_directory.py", line 546, in get_msi_token_webapp
raise RuntimeError(err_msg)
RuntimeError: MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.

# From default environment

The command failed with an unexpected error. Here is the traceback:
MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.
Traceback (most recent call last):
File "/opt/az/lib/python3.11/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
raise ex
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
result = cmd_copy(params)
^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
return self.handler(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
return op(**command_args)
^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/profile/custom.py", line 122, in login
return profile.login_with_managed_identity(username, allow_no_subscriptions)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/_profile.py", line 234, in login_with_managed_identity
msi_creds = MSIAuthenticationWrapper(resource=resource)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/msrestazure/azure_active_directory.py", line 592, in __init__
self.set_token()
File "/opt/az/lib/python3.11/site-packages/azure/cli/core/auth/adal_authentication.py", line 75, in set_token
super().set_token()
File "/opt/az/lib/python3.11/site-packages/msrestazure/azure_active_directory.py", line 596, in set_token
self.scheme, _, self.token = get_msi_token_webapp(self.resource, self.msi_conf)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/az/lib/python3.11/site-packages/msrestazure/azure_active_directory.py", line 546, in get_msi_token_webapp
raise RuntimeError(err_msg)
RuntimeError: MSI: Failed to retrieve a token from 'http://127.0.0.1:46808/MSI/auth/?resource=https://management.core.windows.net/&api-version=2017-09-01' with an error of 'SSO failure: unable to retrieve a token. Error Token service my-compute01. Token not found'.

### Issue script & Debug output

azure cli commands listed above

### Expected behavior

managed identity can be used from the machine learning compute.

### Environment Summary

With the default conda environment `azureml_py38`

running `az version` shows

> {
"azure-cli": "2.49.0",
"azure-cli-core": "2.49.0",
"azure-cli-telemetry": "1.0.8",
"extensions": {
"ml": "2.5.0"
}
}

If conda is deactivated

running `az version` shows

> {
"azure-cli": "2.56.0",
"azure-cli-core": "2.56.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"ml": "2.5.0"
}
}

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.