Make Azure credential process timeout configurable by spboyer · Pull Request #16175 · microsoft/aspire

spboyer · 2026-04-14T21:35:49Z

Description

Fixes #15872 — aspire deploy az login check times out with no way to override.

Problem

The Azure CLI credential validation during aspire deploy had inconsistent timeout handling:

Publish mode (AzureCliCredential): No timeout at all — would use SDK defaults or hang
Run mode (DefaultAzureCredential): Hard-coded 15s CredentialProcessTimeout — too short for some machines
No user-facing way to increase the timeout when az CLI is slow (antivirus scanning, network latency)

Solution

Add CredentialProcessTimeoutSeconds to AzureProvisionerOptions (default: 60s, range: 5-600s)
Apply ProcessTimeout consistently to all process-backed credential types (AzureCli, AzurePowerShell, VisualStudio, AzureDeveloperCli)
Leave DefaultAzureCredential unchanged at 15s per-subprocess timeout to avoid changing run-mode behavior
Wrap ValidateAzureLoginAsync with a linked CancellationTokenSource to distinguish timeout from auth failure, providing specific error messages for each

Configuration

# Environment variable
export Azure__CredentialProcessTimeoutSeconds=120

# Or in appsettings.json / user-secrets
{
  "Azure": {
    "CredentialProcessTimeoutSeconds": 120
  }
}

Error Messages

Timeout:

Azure credential validation timed out after 60 seconds. This can happen when the Azure CLI is slow to respond (e.g., antivirus scanning, network latency). To increase the timeout, set Azure__CredentialProcessTimeoutSeconds to a higher value (e.g., 120).

Auth failure (unchanged):

Azure CLI authentication failed. Please run az login to authenticate before deploying.

Changes

File	Change
`AzureProvisionerOptions.cs`	Added `CredentialProcessTimeoutSeconds` property with `[Range(5, 600)]` validation
`DefaultTokenCredentialProvider.cs`	Applied `ProcessTimeout` to AzureCli, AzurePowerShell, VisualStudio, AzureDeveloperCli credentials
`AzureEnvironmentResource.cs`	Linked CTS with `CancelAfter` in `ValidateAzureLoginAsync` for timeout-specific error messaging
`AspireAzureConfigurationSchema.json`	Added schema entry for appsettings discoverability
`AzureProvisionerOptionsTests.cs`	7 tests: defaults, range validation, boundary cases

Testing

9 unit tests passing (7 new + no regressions)
Build succeeds
Integration tests verify timeout & auth failure behavior with mock credentials

The Azure CLI credential validation during 'aspire deploy' had no configurable timeout. On machines where 'az' is slow to respond (antivirus scanning, network latency), the deploy would fail or hang unpredictably. Changes: - Add CredentialProcessTimeoutSeconds to AzureProvisionerOptions (default: 60s, range: 5-600s), configurable via Azure__CredentialProcessTimeoutSeconds env var or Azure:CredentialProcessTimeoutSeconds in appsettings - Apply ProcessTimeout consistently to all process-backed credential types (AzureCli, AzurePowerShell, VisualStudio, AzureDeveloperCli) in DefaultTokenCredentialProvider — publish-mode AzureCliCredential previously had no timeout at all - Leave DefaultAzureCredential's 15s per-subprocess timeout unchanged to avoid changing run-mode behavior - Wrap ValidateAzureLoginAsync with a linked CancellationTokenSource to distinguish timeout from auth failure, providing actionable error messages for each case - Update AspireAzureConfigurationSchema.json for appsettings discoverability - Add unit tests for option validation and defaults Fixes microsoft#15872 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Verify that custom CredentialProcessTimeoutSeconds is applied correctly: - All process-backed credential types (AzureCli, AzurePowerShell, VisualStudio, AzureDeveloperCli) create successfully with custom timeout - InteractiveBrowser is not affected by ProcessTimeout (no process) - DefaultAzureCredential run-mode path is not affected - Min boundary (5s) creates credential successfully Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a configurable timeout for Azure process-based credential validation during aspire deploy, aiming to prevent hangs and allow users to extend timeouts on slow machines.

Changes:

Introduces CredentialProcessTimeoutSeconds (default 60s, range 5–600) on AzureProvisionerOptions.
Applies a consistent ProcessTimeout to process-backed Azure.Identity credentials (Azure CLI/PowerShell/VS/AZD).
Adds timeout-specific handling in ValidateAzureLoginAsync and updates configuration schema + unit tests.

Show a summary per file

File	Description
tests/Aspire.Hosting.Azure.Tests/AzureProvisionerOptionsTests.cs	Adds validation and basic construction tests for the new timeout option.
src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultTokenCredentialProvider.cs	Plumbs the configured timeout into process-backed credential options.
src/Aspire.Hosting.Azure/Provisioning/AzureProvisionerOptions.cs	Adds the new `CredentialProcessTimeoutSeconds` option with range validation + docs.
src/Aspire.Hosting.Azure/AzureEnvironmentResource.cs	Implements linked-CTS timeout for credential validation and a timeout-specific message.
src/Aspire.Hosting.Azure/AspireAzureConfigurationSchema.json	Exposes the new setting in the JSON schema (bounds + default).

Copilot's findings

Files reviewed: 5/5 changed files
Comments generated: 3

Test the full pipeline behavior for three credential scenarios: - Slow credential (10s delay, 5s timeout) → verifies timeout-specific error message with CredentialProcessTimeoutSeconds guidance - Failing credential (CredentialUnavailableException) → verifies 'az login' error message - Valid credential (existing TestTokenCredentialProvider) → verifies success Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-14T22:03:56Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16175

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16175"

- Throw TimeoutException instead of rethrowing OperationCanceledException so callers can distinguish timeout from user-initiated cancellation - Include both config key path (Azure:CredentialProcessTimeoutSeconds) and env var form (Azure__CredentialProcessTimeoutSeconds) in error message Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Address review feedback: use processTimeout consistently across all credential paths including the DefaultAzureCredential fallback, replacing the hardcoded 15-second CredentialProcessTimeout. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

spboyer · 2026-04-15T13:26:39Z

Filed #16205 to track the full Azure SDK configurable credential adoption that @eerhardt suggested. That will replace the manual credential switch statement entirely with the SDK's ConfigurableCredential / WithAzureCredential integration.

This PR remains scoped to the immediate timeout fix — making CredentialProcessTimeout configurable and consistent across all credential paths, with actionable error messages on timeout. It unblocks users hitting the 13s default today while the larger SDK adoption is planned.

spboyer · 2026-04-15T15:00:54Z

@eerhardt — All feedback addressed, threads resolved. Per our Teams discussion, proceeding with the custom CredentialProcessTimeoutSeconds property for 13.3, with SDK adoption tracked in #16205 for 13.4. Ready for your review when you get a chance. Thanks!

@eerhardt

Per @eerhardt's review: - Make CredentialProcessTimeoutSeconds nullable (int?) so SDK defaults are used when not explicitly configured - Remove the linked CancellationTokenSource timeout wrapper from ValidateAzureLoginAsync — the credential handles its own timeout - Only apply ProcessTimeout to credential options when explicitly set - Extract credential creation into helper methods for cleaner code - Update JSON schema to remove default value - Remove slow-credential integration test (no longer applicable) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

eerhardt

Thanks for the contribution!

Remove duplicate 'using Azure.Core' from AzureDeployerTests.cs — it conflicts with the Aspire.Hosting.Azure namespace and is treated as error IDE0005/CS0105 in CI. Use fully qualified global::Azure.Core types for the test credential classes instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-16T14:48:15Z

Re-running the failed jobs in the CI workflow for this pull request because 1 job was identified as retry-safe transient failures in the CI run attempt.
GitHub was asked to rerun all failed jobs for that attempt, and the rerun is being tracked in the rerun attempt.
The job links below point to the failed attempt jobs that matched the retry-safe transient failure rules.

Tests / Hosting-1 / Hosting-1 (windows-latest) - Job-level runner or infrastructure failure matched the transient allowlist.

Adds documentation for the new Azure:CredentialProcessTimeoutSeconds configuration option introduced in microsoft/aspire#16175. The option lets users override the credential subprocess timeout (range 5-600) when az login validation is slow due to antivirus, network latency, etc. - Adds the option to the Local Azure provisioning configuration table and a new 'Credential process timeout' section. - Adds a 'Configurable Azure credential timeout' section to the What's new in Aspire 13.3 doc. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Document Azure:CredentialProcessTimeoutSeconds option Adds documentation for the new Azure:CredentialProcessTimeoutSeconds configuration option introduced in microsoft/aspire#16175. The option lets users override the credential subprocess timeout (range 5-600) when az login validation is slow due to antivirus, network latency, etc. - Adds the option to the Local Azure provisioning configuration table and a new 'Credential process timeout' section. - Adds a 'Configurable Azure credential timeout' section to the What's new in Aspire 13.3 doc. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Mention CredentialProcessTimeoutSeconds in deployment env var asides Adds a follow-up note to each `Azure__SubscriptionId` env var list pointing at the new credential process timeout option for users hitting slow credential validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

spboyer marked this pull request as ready for review April 14, 2026 21:40

spboyer requested review from eerhardt and mitchdenny as code owners April 14, 2026 21:40

Copilot AI review requested due to automatic review settings April 14, 2026 21:40

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure/AzureEnvironmentResource.cs Outdated

Comment thread src/Aspire.Hosting.Azure/AzureEnvironmentResource.cs Outdated

Comment thread tests/Aspire.Hosting.Azure.Tests/AzureProvisionerOptionsTests.cs

Copilot started reviewing on behalf of spboyer April 14, 2026 21:54 View session

github-actions Bot mentioned this pull request Apr 14, 2026

[pull requests] Review required #13834

Open

eerhardt reviewed Apr 14, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultTokenCredentialProvider.cs Outdated

eerhardt reviewed Apr 14, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure/Provisioning/Internal/DefaultTokenCredentialProvider.cs Outdated

eerhardt reviewed Apr 15, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure/Provisioning/AzureProvisionerOptions.cs Outdated

eerhardt reviewed Apr 15, 2026

View reviewed changes

Comment thread src/Aspire.Hosting.Azure/AzureEnvironmentResource.cs Outdated

spboyer force-pushed the fix/az-login-timeout branch from f1590cd to e0503a7 Compare April 15, 2026 15:37

spboyer requested a review from eerhardt April 15, 2026 15:41

eerhardt approved these changes Apr 15, 2026

View reviewed changes

Merge remote-tracking branch 'upstream/main' into fix/az-login-timeout

57fa026

eerhardt enabled auto-merge (squash) April 17, 2026 01:46

Merge remote-tracking branch 'upstream/main' into fix/az-login-timeout

e2a740c

eerhardt merged commit 7abefc4 into microsoft:main Apr 17, 2026
283 checks passed

github-actions Bot added this to the 13.3 milestone Apr 17, 2026

eerhardt mentioned this pull request Apr 20, 2026

Document Azure:CredentialProcessTimeoutSeconds option microsoft/aspire.dev#731

Merged

This was referenced Apr 20, 2026

Azure CLI Timeout Error on running Aspire Deployment using Github Actions. #13904

Closed

Document Azure:CredentialProcessTimeoutSeconds option microsoft/aspire.dev#737

Closed

This was referenced Apr 24, 2026

[13.3] Change log #16431

Closed

[13.3] Change log #16433

Closed

[13.3] Change log #16452

Closed

[13.3] Change log #16455

Closed

[milestone-changelog] [13.3] Change log #16462

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make Azure credential process timeout configurable#16175

Make Azure credential process timeout configurable#16175
eerhardt merged 9 commits intomicrosoft:mainfrom
spboyer:fix/az-login-timeout

spboyer commented Apr 14, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

spboyer commented Apr 15, 2026

Uh oh!

Uh oh!

Uh oh!

spboyer commented Apr 15, 2026

Uh oh!

eerhardt left a comment

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

spboyer commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Problem

Solution

Configuration

Error Messages

Changes

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spboyer commented Apr 15, 2026

Uh oh!

Uh oh!

Uh oh!

spboyer commented Apr 15, 2026

Uh oh!

eerhardt left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

spboyer commented Apr 14, 2026 •

edited

Loading

github-actions Bot commented Apr 14, 2026 •

edited

Loading