Azure / Azure/azure-sdk-for-cpp
ManagedIdentityCredential correctly detects App Service 2019 environment but sends wrong HTTP header name.
- Dominant language
- C++
- Stars
- 205
- Forks
- 172
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 37
Description
## Bug: ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.
**Environment:**
- Runtime: Service Fabric on Windows Server 2019
- Azure SDK for C++: v1.11.0
- IMDS Endpoint: `http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0`
- Environment Variables Set by Service Fabric:
- `IDENTITY_ENDPOINT` (set by runtime)
- `IDENTITY_HEADER` (set by runtime)
**Issue:**
ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.
**Expected Behavior:**
Service Fabric IMDS requires header named `secret` (lowercase):
```cpp
// Working manual implementation:
std::wstring headerTag = L"secret:";
WinHttpAddRequestHeaders(hRequest, headerTag.c_str(), ...);
```
**Actual Behavior:**
SDK sends `x-identity-header` instead:
```
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?...
x-identity-header : ❌ Wrong header name
```
**Error Response:**
```json
{
"error": {
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required"
}
}
```
**Comparison with Other SDKs:**
- ✅ Python `azure-identity`: Correctly detects Service Fabric and uses `secret` header
- ✅ .NET `Azure.Identity`: Correctly detects Service Fabric and uses `secret` header
- ❌ C++ `azure-identity`: Detects Service Fabric but uses wrong header
**Request:**
Add proper Service Fabric Managed Identity support to match Python and .NET SDK capabilities.
Log Snippet:
GeneralizedSendUsageEvents failed with HRESULT: 0x85210002
TokenProviderCallback: Requesting token for scope: https://usage.azure.com/
Managed Identity Name (for logging): c1f44206-0092-4e20-8706-316e19182180
Using ManagedIdentityCredential with client ID: 30f7d658-b830-47ca-9ded-609d11a3a96c
Setting MSI_ENDPOINT from IDENTITY_ENDPOINT: http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0
Setting MSI_SECRET from IDENTITY_HEADER: XXXX_DELETED_FOR_TICKET
Identity: ManagedIdentityCredential will be created with App Service 2019 source and Client ID '30f7d658-b830-47ca-9ded-609d11a3a96c'.
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=2019-08-01&client_id=REDACTED&resource=REDACTED
user-agent : azsdk-cpp-identity/1.11.0 (Windows Server 2019 Datacenter 6.3 17763 17763.1.amd64fre.rs5_release.180914-1434 Cpp/201402)
x-identity-header : REDACTED
x-ms-client-request-id : 09eb2999-af1c-46d7-8e6c-0a41ea623558
Status operation: 16(WINHTTP_CALLBACK_STATUS_SENDING_REQUEST )
Status operation: 32(WINHTTP_CALLBACK_STATUS_REQUEST_SENT )
Status operation: 4194304(WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Authentication error in TokenProviderCallback: GetToken(): error response: 400 Bad Request
{
"error": {
Status operation: 131072(WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
Read Data read from wire. Size: 145.
ReadData returned size: 145.
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required",
"details": []
}
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
}
Contributor guide
Assessment
This issue has not been assessed yet.