Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

az appconfig authentication not working, "object has no attribute '_credential'" #12

Open
wangzelin007 opened this issue Mar 18, 2025 · 1 comment
Open

az appconfig authentication not working, "object has no attribute '_credential'" #12

wangzelin007 opened this issue Mar 18, 2025 · 1 comment
Labels
Auto-Resolve

Comments

@wangzelin007
Copy link
Owner

Describe the bug

The az appconfig command now no longer supports login auth mode with system assigned identities

Related command

az appconfig kv set

Errors

'MSIAuthenticationWrapper' object has no attribute '_credential'
Traceback (most recent call last):
  File "/opt/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 666, in execute
    raise ex
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 734, in _run_jobs_serially
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 703, in _run_job
    result = cmd_copy(params)
             ^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
    return op(**command_args)
           ^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/keyvalue.py", line 443, in set_key
    azconfig_client = get_appconfig_data_client(cmd, name, connection_string, auth_mode, endpoint)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/_utils.py", line 191, in get_appconfig_data_client
    azconfig_client = AzureAppConfigurationClient(credential=AppConfigurationCliCredential(cred._credential, token_audience),  # pylint: disable=protected-access
                                                                                           ^^^^^^^^^^^^^^^^
AttributeError: 'MSIAuthenticationWrapper' object has no attribute '_credential'
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Issue script & Debug output

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
az login --identity
az appconfig kv set --auth-mode login --endpoint "https://test-appconfig.azconfig.io/" --key "Sample" --value "SampleValue" --yes

Output

$ az appconfig kv set --auth-mode login --endpoint "https://test-appconfig.azconfig.io/" --key "Sample" --value "SampleValue" --yes --debug
cli.knack.cli: Command arguments: ['appconfig', 'kv', 'set', '--auth-mode', 'login', '--endpoint', 'https://test-appconfig.azconfig.io/', '--key', 'Sample', '--value', 'SampleValue', '--yes', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7a8b1fad3740>, <function OutputProducer.on_global_arguments at 0x7a8b1f87e700>, <function CLIQuery.on_globa
l_arguments at 0x7a8b1f8c3c40>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'appconfig': ['azure.cli.command_modules.appconfig']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: appconfig                 0.003         9        47
cli.azure.cli.core: Total (1)                 0.003         9        47
cli.azure.cli.core: Loaded 9 groups, 47 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : appconfig kv set
cli.azure.cli.core: Command table: appconfig kv set
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7a8b1eaf2f20>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/adminuser/.azure/commands/2025-03-04.19-08-56.appconfig_kv_set.1480.log'.
az_command_data_logger: command args: appconfig kv set --auth-mode {} --endpoint {} --key {} --value {} --yes --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x7a8b1eb37ec0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x7a8b1eb6a2a0>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x7a8b1eb6a3e0>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x7a8b1eb6a480>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7a8b1f87e7a0>, <function CLIQuery.handle_query_parameter at 0x7a8b1f8c3ce0>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x7a8b1eb6a340>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=AppConfigurationManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): 169.254.169.254:80
urllib3.connectionpool: [http://169.254.169.254:80](http://169.254.169.254/) "GET /metadata/identity/oauth2/token?resource=https%3A%2F%2Fmanagement.core.windows.net%2F&api-version=2018-02-01 HTTP/1.1" 200 1768
msrestazure.azure_active_directory: MSI: Retrieving a token from http://169.254.169.254/metadata/identity/oauth2/token, with payload {'resource': 'https://management.core.windows.net/', 'api-version': '2018-02-01'}
msrestazure.azure_active_directory: MSI: Token retrieved
urllib3.connectionpool: Starting new HTTP connection (1): 169.254.169.254:80
urllib3.connectionpool: [http://169.254.169.254:80](http://169.254.169.254/) "GET /metadata/identity/oauth2/token?resource=https%3A%2F%2Fmanagement.core.windows.net%2F&api-version=2018-02-01 HTTP/1.1" 200 1768
msrestazure.azure_active_directory: MSI: Retrieving a token from http://169.254.169.254/metadata/identity/oauth2/token, with payload {'resource': 'https://management.core.windows.net/', 'api-version': '2018-02-01'}
msrestazure.azure_active_directory: MSI: Token retrieved
cli.azure.cli.core.azclierror: Traceback (most recent call last):
cli.azure.cli.core.azclierror: Traceback (most recent call last):
  File "/opt/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 666, in execute
    raise ex
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 734, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 703, in _run_job
    result = cmd_copy(params)
             ^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
    return op(**command_args)
           ^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/keyvalue.py", line 443, in set_key
    azconfig_client = get_appconfig_data_client(cmd, name, connection_string, auth_mode, endpoint)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/_utils.py", line 191, in get_appconfig_data_client
    azconfig_client = AzureAppConfigurationClient(credential=AppConfigurationCliCredential(cred._credential, token_audience),  # pylint: disable=protected-access
                                                                                           ^^^^^^^^^^^^^^^^
AttributeError: 'MSIAuthenticationWrapper' object has no attribute '_credential'

cli.azure.cli.core.azclierror: The command failed with an unexpected error. Here is the traceback:
az_command_data_logger: The command failed with an unexpected error. Here is the traceback:
cli.azure.cli.core.azclierror: 'MSIAuthenticationWrapper' object has no attribute '_credential'
Traceback (most recent call last):
  File "/opt/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 666, in execute
    raise ex
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 734, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 703, in _run_job
    result = cmd_copy(params)
             ^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
    return op(**command_args)
          ^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/keyvalue.py", line 443, in set_key
    azconfig_client = get_appconfig_data_client(cmd, name, connection_string, auth_mode, endpoint)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/_utils.py", line 191, in get_appconfig_data_client
    azconfig_client = AzureAppConfigurationClient(credential=AppConfigurationCliCredential(cred._credential, token_audience),  # pylint: disable=protected-access
                                                                                           ^^^^^^^^^^^^^^^^
AttributeError: 'MSIAuthenticationWrapper' object has no attribute '_credential'
az_command_data_logger: 'MSIAuthenticationWrapper' object has no attribute '_credential'
Traceback (most recent call last):
  File "/opt/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 666, in execute
    raise ex
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 734, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 703, in _run_job
    result = cmd_copy(params)
             ^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 336, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler
    return op(**command_args)
           ^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/keyvalue.py", line 443, in set_key
    azconfig_client = get_appconfig_data_client(cmd, name, connection_string, auth_mode, endpoint)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/az/lib/python3.12/site-packages/azure/cli/command_modules/appconfig/_utils.py", line 191, in get_appconfig_data_client
    azconfig_client = AzureAppConfigurationClient(credential=AppConfigurationCliCredential(cred._credential, token_audience),  # pylint: disable=protected-access
                                                                                           ^^^^^^^^^^^^^^^^
AttributeError: 'MSIAuthenticationWrapper' object has no attribute '_credential'
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7a8b1eaf31a0>]
az_command_data_logger: exit code: 1
cli.__main__: Command ran in 0.397 seconds (init: 0.116, invoke: 0.281)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 8021 in cache file under /home/adminuser/.azure/telemetry/20250304190856956
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/opt/az/bin/python3 /opt/az/lib/python3.12/site-packages/azure/cli/telemetry/__init__.py /home/adminuser/.azure /home/adminuser/.azure/telemetry/20250304190856956"
telemetry.process: Return from creating process 1485
telemetry.main: Finish creating telemetry upload process.

Expected behavior

Failed to retrieve key-values from config store. Operation returned an invalid status 'Forbidden'

Environment Summary

Azure Linux vm with
azure-cli: 2.70

azure-cli: 2.69.0 works fine

Additional context

This change is what is causing the failure:
Azure@5fc3ec1
@azure-client-tools-bot-dev azure-client-tools-bot-dev
Copy link

Hi @wangzelin007,

2.69.0 is not the latest Azure CLI(2.70.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Auto-Resolve
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@wangzelin007