Unable to authenticate in node using @azure/identity DefaultAzureCredential()

[rudfoss]

I'm trying to authenticate in VSCode using the Azure Account extension as described here:
https://github.com/Azure/azure-sdk-for-js/blob/master/sdk/identity/identity/README.md#authenticating-via-visual-studio-code

I've installed "@azure/identity": "^1.1.0" and I'm using the example above to try to authenticate with Azure to get access to an App Configuration instance, but the authentication fails with the error below.

invalid_grant(status code 400).
More details:
AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2020-03-19T16:25:46.3627136Z and was inactive for 90.00:00:00.
Trace ID: 391fe4c9-beb4-4253-9b9f-cada7a647900
Correlation ID: b5b7743b-371e-482a-adb7-8d2260d6029b
Timestamp: 2020-11-03 08:24:13Z
AuthenticationError: invalid_grant(status code 400).
More details:
AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2020-03-19T16:25:46.3627136Z and was inactive for 90.00:00:00.
Trace ID: 391fe4c9-beb4-4253-9b9f-cada7a647900
Correlation ID: b5b7743b-371e-482a-adb7-8d2260d6029b
Timestamp: 2020-11-03 08:24:13Z
    at IdentityClient.<anonymous> (C:\projects\udi-form\node_modules\@azure\identity\src\client\identityClient.ts:99:21)
    at Generator.next (<anonymous>)
    at fulfilled (C:\projects\udi-form\node_modules\@azure\identity\node_modules\tslib\tslib.js:111:62)
    at processTicksAndRejections (internal/process/task_queues.js:97:5)

I've tried signing out and back in multiple times and that seems to be working fine. The statusbar in VSCode shows my account and I can pick from my subscriptions.

I've been debugging for a bit and it does not seem that any of the expected environment variables are set once my script runs. Do I need some additional launch configuration to set this up?

I'm currently using this configuration to run my ts-node script:

		{
			"name": "TS file",
			"type": "node",
			"request": "launch",
			"args": ["${fileBasename}"],
			"runtimeArgs": [
				"-r",
				"ts-node/register",
				"-r",
				"tsconfig-paths/register"
			],
			"cwd": "${fileDirname}",
			"outputCapture": "std",
			"resolveSourceMapLocations": [
				"${workspaceFolder}/**",
				"!**/node_modules/**"
			],
			"env": {
				"NODE_ENV": "development"
			}
		},

[rudfoss]

Here is a short code sample that produces the error when I'm signed in to Visual Studio Code:

import { AppConfigurationClient } from "@azure/app-configuration"
import { DefaultAzureCredential } from "@azure/identity"

import { setLogLevel } from "@azure/logger"
setLogLevel("verbose")

const start = async () => {
    const credentials = new DefaultAzureCredential()
    const appConfigClient = new AppConfigurationClient("[app configuration endpoint]", credentials)
    console.log(await appConfigClient.getConfigurationSetting({ key: "inf/cdnUrl" }))
}

start().catch((error) => {
    console.error(error)
    process.exit(1)
})

Edit: Swapping out DefaultAzureCredential for VisualStudioCodeCredential has no effect.

[RMacfarlane]

@rudfoss This doesn't seem to be using the Azure Account extension to get the credentials. You can get the API of this extension using:
const azureAccountExtensionApi = vscode.extensions.getExtension('ms-vscode.azure-account')

The API is here:

vscode-azure-account/src/azure-account.api.d.ts

Lines 15 to 28 in 68227a3

	export interface AzureAccount {
	readonly status: AzureLoginStatus;
	readonly onStatusChanged: Event<AzureLoginStatus>;
	readonly waitForLogin: () => Promise<boolean>;
	readonly sessions: AzureSession[];
	readonly onSessionsChanged: Event<void>;
	readonly subscriptions: AzureSubscription[];
	readonly onSubscriptionsChanged: Event<void>;
	readonly waitForSubscriptions: () => Promise<boolean>;
	readonly filters: AzureResourceFilter[];
	readonly onFiltersChanged: Event<void>;
	readonly waitForFilters: () => Promise<boolean>;
	createCloudShell(os: 'Linux' | 'Windows'): CloudShell;
	}

You would want to get credentials2 from a session listed in sessions.

[rudfoss]

Hmm... so the documentation here is wrong where it says specifically:

Applications using the DefaultAzureCredential or the VisualStudioCodeCredential can then use this account to authenticate calls in their application when running locally.

?

Or am I just doing it wrong? Am I supposed to call vscode.extensions logic from my code directly? I'm probably misunderstanding something, but I thought I would be able to "seamlessly" (or close to it) authenticate with azure once I had the Azure Account Extension installed and signed in.

I've also tried replacing DefaultAzureCredential with VisualStudioCodeCredential.

[RMacfarlane]

Oh, I see! I was unaware the the sdk team had added this feature, it looks like they just read the same storage key this extension writes to. It looks like signing out isn't clearing an expired credential for you. I think I have a fix for it, but since I'm not able to easily get into this state, can you help validate it?
azure-account-0.9.4.zip

You can install this extension by changing the file extension to .vsix and then running Extensions: Install from VSIX... in VS Code

[rudfoss]

Thanks for taking a look at this @RMacfarlane !

I've installed the extension and it now seems to be refreshing the token:

zure:core-http:info ServiceClient: using custom request policies
azure:core-http:info ServiceClient: creating bearer token authentication policy from provided credentials
azure:core-http:info ServiceClient: using default request policies
azure:identity:info IdentityClient: refreshing access token with client ID: aebc6443-996d-45c2-90f0-388ff96faa56, scopes: https://thr-app-config-test.azconfig.io/.default offline_access started
azure:identity:info IdentityClient: sending token request to [https://login.microsoftonline.com/common/oauth2/v2.0/token]

I'm still receiving a 403 error when accessing the App Configuration service, but it's working fine for Key Vault secrets now. Thanks for your help!

[rudfoss]

Any news on when the fix may be released? I'm working on setting up a dev environment for a new project and if we can rely on this working it would greatly simplify how we develop. Simply grab the code, login and all configurations would be ready :)

[rudfoss]

Saw the release. Thanks a bunch for resolving it!

[tomagb]

This issue still appears on my side. A logout doesn't solve it.

error: invalid_grant(status code 400).
More details:
AADSTS700082: The refresh token has expired due to inactivity. The token was issued on 2022-01-11T12:54:23.4089776Z and was inactive for 90.00:00:00.
Trace ID:
Correlation ID:
Timestamp: 2022-04-13 09:13:05Z

Azure Account Extension: 0.10.1
@Azure/Identity: ^2.0.4
Azure CLI: 2.35.0

Is there anything I miss about those versions?
Is there any chance I can manually remove the old refresh token or reset the extension's state?

[wwlorey]

Hi @tomagb, please refer to #443.

If you are building a VS Code extension, I recommend using the Azure Account Extension's API (sample).

If you were using that credential for development purposes, I would recommend using a different credential type until the above issue is resolved.

[tomagb]

@wwlorey For development purposes I'm using it. What other credential types are you referring to? MSAL/ADAL?

[wwlorey]

Here's a list of available credential types: https://docs.microsoft.com/en-us/dotnet/api/overview/azure/identity-readme#credential-classes

[t-muko]

The stored credential is renamed for 0.10.0. I had to manually remove the old credential using Windows Credential Manager before resolving the expired refresh token issue. Previously the name was 'VS Code Azure'

See: #443