Aspire: FormatException with Azure PostgreSQL Flexible Server and Entra ID Authentication
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 196
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
I am encountering a System.FormatException: The input is not a valid Base-64 string when accessing a PostgreSQL Flexible Server using Aspire's Entra ID (Managed Identity) authentication via DefaultAzureCredential. This occurs when establishing the database connection.
**Environment**
- Packages/Versions: All packages, frameworks, and tools are at the most recent versions (e.g., C# 14, .NET 10, Aspire 13).
- PostgreSQL: Azure PostgreSQL Flexible Server.
- Authentication: DefaultAzureCredential (Managed Identity).
- Affected NuGet Package: Aspire.Azure.Npgsql.EntityFrameworkCore.PostgreSQL
### Expected Behavior
Expected to be able to retrieve data from the database.
### Steps To Reproduce
As my code targets my postgres server, I don't know how I would provide a minimal project for you to test?
The configuration of my postgres server is `Burstable, B1ms, 1 vCores, 2 GiB RAM, 32 GiB storage`.
Instead, here are some steps to reproduce:
In the Aspire AppHost, register the server and database resource:
`builder.AddAzurePostgresFlexibleServer(ServiceNames.PostgresServer).AddDatabase(ServiceNames.PostgresDatabase);`
In the dependent service (Blazor app), register the EF Core DbContext using the Aspire extension:
```
host.AddAzureNpgsqlDbContext(ServiceNames.PostgresDatabase);
host.Services.AddDbContextFactory();
```
Attempt to access data using the SentrylineDbContext instance.
Injecting the DbContext directly or through the DbContextFactory makes no difference.
### Exceptions (if any)
The application throws a `System.FormatException` during the connection process, specifically within Aspire's managed identity token handling logic, suggesting an issue with parsing the JWT.
The full exception stack trace points to the utility methods in the Aspire component:
```
System.Convert.FromBase64String(String s)
Aspire.ManagedIdentityTokenCredentialHelpers.TryGetUsernameFromToken(...)
Aspire.ManagedIdentityTokenCredentialHelpers.ConfigureEntraIdAuthentication(...)
```
### .NET Version info
_No response_
### Anything else?
The behavior is inconsistent across environments:
My Desktop: Connection succeeds (No exception).
My Laptop & Colleague's Machine: Connection fails (Exception occurs always).
This suggests the issue may be related to differences in how the DefaultAzureCredential obtains the token across different machines (e.g., token format differences from different sources like VS sign-in, Azure CLI, or Environment Variables).
Let me know if you have any follow up questions. Hopefully you can help with this, as I've searched the web, read documentation, tried different implementations, gone over the entire issue multiple times with different LLMs, all without luck.
Contributor guide
Assessment
This issue has not been assessed yet.