[BUG] Azure Identity credentials don't obey proxy when acquiring login tokens #43038
Labels
Azure.Identity
Client
This issue points to a problem in the data-plane of the library.
customer-reported
Issues that are reported by GitHub users external to the Azure organization.
needs-author-feedback
Workflow: More information is needed from author to address the issue.
question
The issue doesn't require a change to the product in order to be resolved. Most issues start as that
Library name and version
Azure.Security.KeyVault.Secrets 4.6.0
Describe the bug
Our hosts require HTTPS proxy for all egress. We can configure the SecretClientOptions.Transport with a suitable proxy (see attached sample program), and requests to the Azure KeyVault obey this proxy. However, requests from within SecretClient to obtain login tokens do not obey the proxy, and thus they fail to complete. If a proxy is set via SecretClientOptions.Transport, it should be used for all requests made by SecretClient or any libs that it uses.
Expected behavior
A proxy set viat SecretClientOptions should be used to all requests made by, or on behalf of, SecretClient.
Actual behavior
Requests made by SecretClient to acquire login tokens do not use the configured proxy.
The only way for login tokens to be acquired successfully is to change the HttpClient.DefaultProxy, which globally affects all HttpClient instances - obviously not a suitable solution.
Reproduction Steps
Use this project to reproduce the issue:
https://github.com/paulmedynski/azure-key-vault-proxy
Run with --help for options related to Azure Key Vault and whether or not a proxy is used.
All egress allowed, no proxy specified:
No egress allowed, no proxy specified:
Configure an HTTPS proxy on localhost:8888, for example tinyproxy.
Configure iptables to reject all outbound traffic except from the proxy:
Note that the initial connection to the Key Vault is refused, as expected.
No egress allowed, SecretClient proxy specified:
Now we see that the login token requests are failing, because they aren't using the proxy! This can be corroborated by inspecting the proxy logs and noting that only the initial Key Vault was tunneled through the proxy. The login token requests did not pass through the proxy.
No egress allowed, HttpClient.DefaultProxy specified:
Everything works when the global HttpClient.DefaultProxy is specified. This isn't a suitable solution though, since other HTTP connections within the app may rely on a default proxy specified by environment variables for example.
Environment
$ dotnet --info
.NET SDK:
Version: 8.0.202
Commit: 25674bb2f4
Workload version: 8.0.200-manifests.4e94be9c
Runtime Environment:
OS Name: debian
OS Version: 12
OS Platform: Linux
RID: linux-x64
Base Path: /usr/share/dotnet/sdk/8.0.202/
.NET workloads installed:
There are no installed workloads to display.
Host:
Version: 8.0.3
Architecture: x64
Commit: 9f4b1f5d66
The text was updated successfully, but these errors were encountered: