Azure / Azure/azure-functions-host
EasyAuth middleware hang when restarting azure function app under load
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
When the authentication feature (EasyAuth) is activated on a function app and setup with Azure Active Directory, if the function app restart when there are still HTTP requests incoming, the function app stays unhealthy.
Azure Function Setup:
- Function App version: v3 with .NET Core 3.1 or v4 (preview) with .NET 6 RC2 using Docker Linux Image
- AppServicePlan Linux : P3v2
- appsvc/middleware:1.4.7
Authentication feature setup:
- Token Store 'on' or 'off' -> still have the issue
- Restrict Access : Require Authentication
- Identity provider : Microsoft
#### Repro steps
Provide the steps required to reproduce the problem:
1) Create a function App with a HTTP trigger (can be just a return ok 200) hosted on an app service plan (P3v2) using docker image
2) Setup the app registration in Active Directory for this API with token OAUTH 2.0
3) Activate the authentication feature on this API with the identity provider Microsoft
4) Execute constant HTTP Request load (+-100 Requests Per Second) using artillery, loader-IO, or other loading test tools with a valid bearer token
5) Stop the function app during the load
6) Wait for some execution errors
7) Start the function app
At this stage, the function app will not reply anymore until a restart after end of load.
#### Expected behavior
The function app should restart even if there is constant HTTP request load and process incoming requests
#### Actual behavior
The function stays unhealthy
#### Known workarounds
Block the incoming requests and restart the function
#### Additional information
If we do the same test with authentication feature deactivated, the function app restart correctly and the load test continue without any issue...
When the function app is unhealthy we don't see any logs in kudu log stream for appsvc/middleware or msiProxy explaining the situation even if the have activated the filesystem application logging feature in the portal.
Contributor guide
Assessment
This issue has not been assessed yet.