Azure / Azure/azure-functions-host

Configuration of host storage with a user assigned identity referenced by `AzureWebJobsStorage__managedIdentityResourceId` does not work

Open
#9,559 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

Configuration of host storage with a user assigned identity referenced by `AzureWebJobsStorage__managedIdentityResourceId` does not work.

From [Connecting to host storage with an identity](https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#connecting-to-host-storage-with-an-identity) describing the configuration options available for `AzureWebJobsStorage`
> **Common properties for identity-based connections** may also be set as well

From [Common properties for identity-based connections](https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#common-properties-for-identity-based-connections):
> **__managedIdentityResourceId**
> When credential is set to managedidentity, this property can be set to specify the resource Identifier to be used when obtaining a token. The property accepts a resource identifier corresponding to the resource ID of the user-defined managed identity. It's invalid to specify both a resource ID and a client ID. If neither are specified, the system-assigned identity is used. This property is used differently in local development scenarios, when credential shouldn't be set.

#### Repro steps

1. Create Azure Storage account with logging configuration e.g. to log analytics.
1. Create a user assigned identity.
1. Authorize user assigned identity to the storage account with **Storage Blob Data Owner** role.
1. Create an Azure Functions resource configured with both system and the created user assigned identity.
1. Configure the function app host storage with a user assigned identity:
- `AzureWebJobsStorage__accountName` = _storage account name_
- `AzureWebJobsStorage__credential` = "managedidentity"
- `AzureWebJobsStorage__managedIdentityResourceId` = "/subscriptions/.../resourcegroups/.../providers/microsoft.managedidentity/userassignedidentities/..."

#### Expected behavior

Host should connect to storage using the user assigned identity referenced by `AzureWebJobsStorage__managedIdentityResourceId`.

#### Actual behavior

Host incorrectly connects to storage using the system assigned identity. This is seen in logs as `AuthorizationPermissionMismatch` for `RequesterObjectId` of the system assigned identity. This indicates that the host is not using the `AzureWebJobsStorage__managedIdentityResourceId` configuration and falling back to the default system identity.

#### Known workarounds

Remove `AzureWebJobsStorage__managedIdentityResourceId` reference to the user identity resource id.
Add `AzureWebJobsStorage__clientId` reference to the user identity client id.

The host storage connection starts working with the user assigned identity. This can be verified from storage logs.

#### Related information

So far tested only with:
- VNet integrated Function App and Storage Account authorized using service endpoints
- Function App having system assigned identity in addition to the user assigned identity (system identity not authorized to host storage account)

Contributor guide

Open the contributing guide

Research direction

Start by tracing the host storage connection handling for AzureWebJobsStorage identity-based settings. Reproduce the configuration with managedIdentityResourceId and inspect storage logs to confirm which identity is used. Done means the host selects the referenced user-assigned identity rather than the system-assigned identity.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.