Azure MSI auth fails with adal: Refresh request failed. Status Code = '411' (MissingContentLengthHeader)

I think I'm doing everything right, but the encryption fails, even though it worked both when logged in via az login and also when using a service principal.

# There is only the system-assigned managed identity for this VM, but added this just in case.
$ export AZURE_CLIENT_ID="the-object-id-of-the-VM" 
$ export AZURE_AD_RESOURCE="https://accessnews-sops.vault.azure.net/"
$ export MSI_ENDPOINT="http://169.254.169.254/metadata/identity/oauth2/token"

$ sops --encrypt --verbose \
    --azure-kv  https://accessnews-sops.vault.azure.net/keys/sops-key/VERSION test.json > test.enc.json

[CMD]	 DEBU[0000] Master keys available:  [0xc000122ba0]       
[AZKV]	 ERRO[0000] Encryption failed                             error="azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://accessnews-sops.vault.azure.net/keys/sops-key/VERSION/encrypt?api-version=2016-10-01: StatusCode=411 -- Original Error: adal: Refresh request failed. Status Code = '411'. Response body: <?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Error xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\">\n    <Code>MissingContentLengthHeader</Code>\n    <Message>The Content-Length header was not specified.</Message>\n    <Details></Details>\n</Error> Endpoint http://169.254.169.254/metadata/identity/oauth2/token" key=sops-key version=VERSION
Could not generate data key: [failed to encrypt new data key with master key "https://accessnews-sops.vault.azure.net/keys/sops-key/VERSION": Failed to encrypt data: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://accessnews-sops.vault.azure.net/keys/sops-key/VERSION/encrypt?api-version=2016-10-01: StatusCode=411 -- Original Error: adal: Refresh request failed. Status Code = '411'. Response body: <?xml version="1.0" encoding="utf-8"?>
<Error xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <Code>MissingContentLengthHeader</Code>
    <Message>The Content-Length header was not specified.</Message>
    <Details></Details>
</Error> Endpoint http://169.254.169.254/metadata/identity/oauth2/token]

When I run the token request manually, it works:

$ curl "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://accessnews-sops.vault.azure.net/"  \
   -H Metadata:true  | jq

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1690  100  1690    0     0   183k      0 --:--:-- --:--:-- --:--:--  183k
{
  "access_token": "...",
  "client_id": "uuid",
  "expires_in": "85497",
  "expires_on": "1680209924",
  "ext_expires_in": "86399",
  "not_before": "1680123224",
  "resource": "https://accessnews-sops.vault.azure.net/",
  "token_type": "Bearer"
}

Wasn't sure about the format of MSI_ENDPOINT, so looked it up in Azure/go-autorest, but it matched what I used at the top. Just in case, also tried setting it to

• http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01
• http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://accessnews-sops.vault.azure.net/

Unfortunately I'm not conversant with Go but will keep looking.

Start by reproducing the failure with the shown sops encryption command and compare it with the working curl request to the MSI endpoint. Read the linked Azure/go-autorest autorest/adal/token.go path and trace the Azure MSI authentication entry point used by sops; done means encryption succeeds through the system-assigned managed identity without the 411 error.