Azure / Azure/azure-sdk-for-cpp

ManagedIdentityCredential correctly detects App Service 2019 environment but sends wrong HTTP header name.

Open
#6,823 0 comments 0 reactions 0 assignees View on GitHub
Azure.Identity customer-reported needs-triage question
Dominant language
C++
Stars
205
Forks
172
Avg merge
1d 3h
Merged PRs (30d)
37

Description

## Bug: ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.

**Environment:**
- Runtime: Service Fabric on Windows Server 2019
- Azure SDK for C++: v1.11.0
- IMDS Endpoint: `http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0`
- Environment Variables Set by Service Fabric:
- `IDENTITY_ENDPOINT` (set by runtime)
- `IDENTITY_HEADER` (set by runtime)

**Issue:**
ManagedIdentityCredential fails on Service Fabric because it uses the wrong HTTP header name.

**Expected Behavior:**
Service Fabric IMDS requires header named `secret` (lowercase):
```cpp
// Working manual implementation:
std::wstring headerTag = L"secret:";
WinHttpAddRequestHeaders(hRequest, headerTag.c_str(), ...);
```

**Actual Behavior:**
SDK sends `x-identity-header` instead:
```
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?...
x-identity-header : ❌ Wrong header name
```

**Error Response:**
```json
{
"error": {
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required"
}
}
```

**Comparison with Other SDKs:**
- ✅ Python `azure-identity`: Correctly detects Service Fabric and uses `secret` header
- ✅ .NET `Azure.Identity`: Correctly detects Service Fabric and uses `secret` header
- ❌ C++ `azure-identity`: Detects Service Fabric but uses wrong header

**Request:**
Add proper Service Fabric Managed Identity support to match Python and .NET SDK capabilities.

Log Snippet:
GeneralizedSendUsageEvents failed with HRESULT: 0x85210002
TokenProviderCallback: Requesting token for scope: https://usage.azure.com/
Managed Identity Name (for logging): c1f44206-0092-4e20-8706-316e19182180
Using ManagedIdentityCredential with client ID: 30f7d658-b830-47ca-9ded-609d11a3a96c
Setting MSI_ENDPOINT from IDENTITY_ENDPOINT: http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=1.0
Setting MSI_SECRET from IDENTITY_HEADER: XXXX_DELETED_FOR_TICKET
Identity: ManagedIdentityCredential will be created with App Service 2019 source and Client ID '30f7d658-b830-47ca-9ded-609d11a3a96c'.
HTTP Request : GET http://169.254.128.1:2377/metadata/identity/oauth2/token?api-version=2019-08-01&client_id=REDACTED&resource=REDACTED
user-agent : azsdk-cpp-identity/1.11.0 (Windows Server 2019 Datacenter 6.3 17763 17763.1.amd64fre.rs5_release.180914-1434 Cpp/201402)
x-identity-header : REDACTED
x-ms-client-request-id : 09eb2999-af1c-46d7-8e6c-0a41ea623558
Status operation: 16(WINHTTP_CALLBACK_STATUS_SENDING_REQUEST )
Status operation: 32(WINHTTP_CALLBACK_STATUS_REQUEST_SENT )
Status operation: 4194304(WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Authentication error in TokenProviderCallback: GetToken(): error response: 400 Bad Request

{
"error": {
Status operation: 131072(WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE )
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
Read Data read from wire. Size: 145.
ReadData returned size: 145.
Status operation: 64(WINHTTP_CALLBACK_STATUS_RECEIVING_RESPONSE )
"code": "BadRequestWithReason",
"message": "BadRequestWithReason Secret header is required",
"details": []
}
Status operation: 128(WINHTTP_CALLBACK_STATUS_RESPONSE_RECEIVED )
Status operation: 524288(WINHTTP_CALLBACK_STATUS_READ_COMPLETE )
}

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.