Error: Managed Identity: DefaultAzureCredential authentication failed
- Lingua principale
- TypeScript
- Stelle
- 142
- Fork
- 73
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
Hello,
I'm encountering an issue when trying to use a Managed Identity with a Federated Credential in GitHub Actions to run azure/sql-action@v2.3. The Managed Identity has been configured with a Federated Credential for GitHub (environment).
I added my Managed Identity to the database as `db_owner`, with the following query:
```sql
DROP USER IF EXISTS [ManagedIdentity-Dev];
CREATE USER [ManagedIdentity-Dev] FROM EXTERNAL PROVIDER WITH DEFAULT_SCHEMA=[dbo];
ALTER ROLE db_owner ADD MEMBER [ManagedIdentity-Dev];
```
Here is my GitHub Actions workflow (.yml file):
```yaml
create-sql-users:
runs-on:
group: github-runner-Dev
environment: ${{ inputs.environment }}
steps:
- uses: actions/checkout@main
- uses: azure/login@v2
with:
client-id: ${{ vars.AZURE_CLIENT_ID }} # The Managed Identity with Federated Credential
tenant-id: ${{ vars.AZURE_TENANT_ID }}
subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
- uses: azure/sql-action@v2.3
with:
connection-string: ${{ secrets.AZURE_SQL_CONNECTION_STRING }}
path: './.github/sql/users.sql'
skip-firewall-check: true
```
**Issue**:
When the workflow runs, I receive the following error message:
```
sqlcmd -S mydatabase-dev.database.windows.net,1433 -d mydatabase-dev --authentication-method=ActiveDirectoryDefault -i ./.github/sql/users.sql
DefaultAzureCredential authentication failed
GET http://localhost:42356/msi/token
--------------------------------------------------------------------------------
RESPONSE 400 Bad Request
--------------------------------------------------------------------------------
{
"statusCode": 400,
"message": "No User Assigned or Delegated Managed Identity found for specified ClientId/ResourceId/PrincipalId.",
"correlationId": "86d82795-065e-4a71-a11c-12a10e7879d0"
}
```
Am I missing something?
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Leggi il workflow YAML e l’invocazione di azure/sql-action@v2.3, quindi riproduci il comando sqlcmd mostrato con il percorso di autenticazione ActiveDirectoryDefault. Il lavoro è completato quando il job GitHub Actions esegue l’autenticazione tramite la Managed Identity federata configurata ed esegue ./.github/sql/users.sql senza l’errore DefaultAzureCredential.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- azure, github-actions, sql
- Ambito
- authentication, ci-cd, cloud, databases
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Da chiarire
- Idoneità per principianti
- 25/100