[identity] DefaultAzureCredentials do not work properly under a proxy environment

[iamkdada]

• Package Name: @azure.identity
• Package Version: 4.0.0
• Operating system: Windows 11 Enterprise 22H2
• [ ] nodejs
  • version: v20.11.1
• [ ] browser
  • ~name/version:~
• [ ] typescript
  • version: 4.9.5
• Is the bug related to documentation in
  • [ ] README.md
  • [ ] source code documentation
  • [ ] SDK API docs on https://docs.microsoft.com

Describe the bug The DefaultAzureCredential will attempt to authenticate via the following mechanisms in order:

• Environment -> Workload Identity -> Managed Identity -> Azure Developer CLI -> Azrue CLI -> Azure PowerShell

However, when under a proxy environment, the DefaultAzureCredential is unable to utilize mechanisms beyond Managed Identity. Specifically, within a proxy environment, authentication with Managed Identity fails because it attempts to access the Managed Identity endpoint (169.254.169.254) and encounters an error, which prevents it from proceeding to the Azure Developer CLI credentials.

debug.log

To Reproduce Steps to reproduce the behavior: "Note: Use Fiddler as an alternative to Proxy."

1. Save the following source code.

const { DefaultAzureCredential } = require("@azure/identity");

async function main() {
  const credential = new DefaultAzureCredential();
  const token = await credential.getToken(
    "https://management.azure.com/.default"
  );

  console.log("Token:", token.token);
  console.log("Expires On:", token.expiresOnTimestamp);
}

main().catch((error) => {
  console.error("An error occurred:", error);
});

2. Open Command Prompt.
3. Set the environment variables:

set AZURE_LOG_LEVEL=verbose
set https_proxy=http://localhost:8888/ # For Fiddler
set http_proxy=http://localhost:8888/ # For Fiddler

4. Launch Fiddler.
5. Execute the file from step 1

node main.js

Expected behavior The behavior should be the same as when not under a Proxy environment. Attempting authentication using the credentials of Azure Developer CLI -> Azure CLI -> Azure PowerShell, without stopping at Managed Identity.

Additional context

• Setting the environment variable AZURE_POD_IDENTITY_AUTHORITY_HOST to empty can circumvent the issue.
• Although I cannot reproduce it in my environment, I have confirmed that in a different proxy environment, a 403 error occurs, and it stops at the authentication with Managed Identity.

[jeremymeng]

For some reason, the proxyPolicy isn't used for the internal IdentityClient?

[maorleger]

Hiya @iamkdada - You're quite right that Managed Identity does not work with a proxy as documented in our TROUBLESHOOTING guide

The bug you described, however, is actually slated to be fixed in our next GA release (4.5.0) which will go out in October. We will ensure ManagedIdentityCredential throws the correct error, so that DefaultAzureCredential is able to continue to the next credential in the chain. Appreciate your patience and I apologize for the delay in answering here

[github-actions[bot]]

Hi @iamkdada. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[github-actions[bot]]

Hi @iamkdada, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.