Azure / Azure/azure-functions-host
Configuration of host storage with a user assigned identity referenced by `AzureWebJobsStorage__managedIdentityResourceId` does not work
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 36
Description
Configuration of host storage with a user assigned identity referenced by `AzureWebJobsStorage__managedIdentityResourceId` does not work.
From [Connecting to host storage with an identity](https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#connecting-to-host-storage-with-an-identity) describing the configuration options available for `AzureWebJobsStorage`
> **Common properties for identity-based connections** may also be set as well
From [Common properties for identity-based connections](https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#common-properties-for-identity-based-connections):
> **__managedIdentityResourceId**
> When credential is set to managedidentity, this property can be set to specify the resource Identifier to be used when obtaining a token. The property accepts a resource identifier corresponding to the resource ID of the user-defined managed identity. It's invalid to specify both a resource ID and a client ID. If neither are specified, the system-assigned identity is used. This property is used differently in local development scenarios, when credential shouldn't be set.
#### Repro steps
1. Create Azure Storage account with logging configuration e.g. to log analytics.
1. Create a user assigned identity.
1. Authorize user assigned identity to the storage account with **Storage Blob Data Owner** role.
1. Create an Azure Functions resource configured with both system and the created user assigned identity.
1. Configure the function app host storage with a user assigned identity:
- `AzureWebJobsStorage__accountName` = _storage account name_
- `AzureWebJobsStorage__credential` = "managedidentity"
- `AzureWebJobsStorage__managedIdentityResourceId` = "/subscriptions/.../resourcegroups/.../providers/microsoft.managedidentity/userassignedidentities/..."
#### Expected behavior
Host should connect to storage using the user assigned identity referenced by `AzureWebJobsStorage__managedIdentityResourceId`.
#### Actual behavior
Host incorrectly connects to storage using the system assigned identity. This is seen in logs as `AuthorizationPermissionMismatch` for `RequesterObjectId` of the system assigned identity. This indicates that the host is not using the `AzureWebJobsStorage__managedIdentityResourceId` configuration and falling back to the default system identity.
#### Known workarounds
Remove `AzureWebJobsStorage__managedIdentityResourceId` reference to the user identity resource id.
Add `AzureWebJobsStorage__clientId` reference to the user identity client id.
The host storage connection starts working with the user assigned identity. This can be verified from storage logs.
#### Related information
So far tested only with:
- VNet integrated Function App and Storage Account authorized using service endpoints
- Function App having system assigned identity in addition to the user assigned identity (system identity not authorized to host storage account)
Contributor guide
Research direction
Start by tracing the host storage connection handling for AzureWebJobsStorage identity-based settings. Reproduce the configuration with managedIdentityResourceId and inspect storage logs to confirm which identity is used. Done means the host selects the referenced user-assigned identity rather than the system-assigned identity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- authentication, backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100