Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

include source stack in aggregated errors in DefaultAzureCredential #1546

Merged

Conversation

demoray
Copy link
Contributor

@demoray demoray commented Jan 5, 2024

As indicated in #1543, error details are swallowed when building an aggregate error message.

Currently, we format each of the errors using to_string, which results in the following:

Error {
    context: Full(
        Custom {
            kind: Credential,
            error: Error {
                context: Message {
                    kind: Credential,
                    message: "Multiple errors were encountered while attempting to authenticate:\nenvironment credential\nIMDS timeout\naz-cli",
                },
            },
        },
        "failed to get bearer token",
    ),
}

This doesn't help the user understand how to fix the issue.

With this update, we recurse through the error sources, building a more
detailed message. This results in:

Error {
    context: Full(
        Custom {
            kind: Credential,
            error: Error {
                context: Message {
                    kind: Credential,
                    message: "Multiple errors were encountered while attempting to authenticate:\nenvironment credential - request token error - Server returned error response\nIMDS timeout - operation timed out\naz-cli - 'az account get-access-token' command failed: ERROR: AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://storage.azure.com/ offline_access openid profile is not valid. The scope format is invalid. Scope must be in a valid URI form <https://example/scope> or a valid Guid <guid/scope>.  Trace ID: 346f391a-48f2-4e96-849f-9ecd6c589d02 Correlation ID: 7888c325-56ff-4100-8ce2-c8cf41561b40 Timestamp: 2024-01-05 01:31:04Z\nInteractive authentication is needed. Please run:\naz login --scope https://storage.azure.com/\n",
                },
            },
        },
        "failed to get bearer token",
    ),
}

When printed, this message looks like:

Multiple errors were encountered while attempting to authenticate:
environment credential - request token error - Server returned error response
IMDS timeout - operation timed out
az-cli - 'az account get-access-token' command failed: ERROR: AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://storage.azure.com/ offline_access openid profile is not valid. The scope format is invalid. Scope must be in a valid URI form <https://example/scope> or a valid Guid <guid/scope>.  Trace ID: 02aecb08-69b4-4a5d-9ebb-784ea788c102 Correlation ID: dddc061a-ca11-4b21-b857-6d765a564597 Timestamp: 2024-01-05 01:43:45Z
Interactive authentication is needed. Please run:
az login --scope https://storage.azure.com/

As indicated in Azure#1543, error details are swallowed when building an
aggregate error message.

Currently, we format each of the errors using to_string, which results
in the following:

```
Error {
    context: Full(
        Custom {
            kind: Credential,
            error: Error {
                context: Message {
                    kind: Credential,
                    message: "Multiple errors were encountered while attempting to authenticate:\nenvironment credential\nIMDS timeout\naz-cli",
                },
            },
        },
        "failed to get bearer token",
    ),
}
```

This doesn't help the user understand how to fix the issue.

With this update, we recurse through the error sources, building a more
detailed message.   This results in:

```
Error {
    context: Full(
        Custom {
            kind: Credential,
            error: Error {
                context: Message {
                    kind: Credential,
                    message: "Multiple errors were encountered while attempting to authenticate:\nenvironment credential - request token error - Server returned error response\nIMDS timeout - operation timed out\naz-cli - 'az account get-access-token' command failed: ERROR: AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://storage.azure.com/ offline_access openid profile is not valid. The scope format is invalid. Scope must be in a valid URI form <https://example/scope> or a valid Guid <guid/scope>.  Trace ID: 346f391a-48f2-4e96-849f-9ecd6c589d02 Correlation ID: 7888c325-56ff-4100-8ce2-c8cf41561b40 Timestamp: 2024-01-05 01:31:04Z\nInteractive authentication is needed. Please run:\naz login --scope https://storage.azure.com/\n",
                },
            },
        },
        "failed to get bearer token",
    ),
}
```

When printed, this message looks like:
```
Multiple errors were encountered while attempting to authenticate:
environment credential - request token error - Server returned error response
IMDS timeout - operation timed out
az-cli - 'az account get-access-token' command failed: ERROR: AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://storage.azure.com/ offline_access openid profile is not valid. The scope format is invalid. Scope must be in a valid URI form <https://example/scope> or a valid Guid <guid/scope>.  Trace ID: 02aecb08-69b4-4a5d-9ebb-784ea788c102 Correlation ID: dddc061a-ca11-4b21-b857-6d765a564597 Timestamp: 2024-01-05 01:43:45Z
Interactive authentication is needed. Please run:
az login --scope https://storage.azure.com/
```
@demoray demoray linked an issue Jan 5, 2024 that may be closed by this pull request
@demoray
Copy link
Contributor Author

demoray commented Jan 5, 2024

In the future, we should investigate a better way to coalesce multiple errors into a single error. However, this provides a short-term stop gap to address information being swallowed that is needed to address issues.

@demoray demoray merged commit 612e0d5 into Azure:main Jan 5, 2024
19 checks passed
@demoray demoray deleted the include-source-stack-in-aggregated-errors branch January 5, 2024 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

DefaultAzureCredential throws away detailed error info
2 participants