Environment Variables and Workload Options Are Not Fully Configured

[NancyOsalaniya]

I've deployed DICOM Cast successfully. And performed all the steps of Sync Medical Imaging Server for DICOM metadata into FHIR Server for Azure. But unable to retrieve an access token.

Here is the detailed container log:

info: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableServiceClientInitializer[0]
      Created Table named 'TransientRetryExceptionTable'
info: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableServiceClientInitializer[0]
      Table Storage and tables successfully initialized
info: Azure.Identity[1]
      DefaultAzureCredential.GetToken invoked. Scopes: [ https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/ ] ParentRequestId: 
info: Azure.Identity[1]
      EnvironmentCredential.GetToken invoked. Scopes: [ https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/ ] ParentRequestId: 
info: Azure.Identity[3]
      EnvironmentCredential.GetToken was unable to retrieve an access token. Scopes: [ https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/ ] ParentRequestId:  Exception: Azure.Identity.CredentialUnavailableException (0x80131500): EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot
info: Azure.Identity[1]
      WorkloadIdentityCredential.GetToken invoked. Scopes: [ https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/ ] ParentRequestId: 
info: Azure.Identity[3]
      WorkloadIdentityCredential.GetToken was unable to retrieve an access token. Scopes: [ https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/ ] ParentRequestId:  Exception: Azure.Identity.
(0x80131500): WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/workloadidentitycredential/troubleshoot
info: Azure.Identity[1]
      ManagedIdentityCredential.GetToken invoked. Scopes: [ https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/ ] ParentRequestId: 


info: Azure.Identity[8]
      False MSAL 4.54.1.0 MSAL.NetCore .NET 7.0.10 Linux 5.10.102.2-microsoft-standard #1 SMP Mon Mar 7 17:36:34 UTC 2022 [2023-09-22 07:55:24Z - 810f692a-da70-4655-84d7-b4519dcd6618] 
      === Request Data ===
      Authority Provided? - True
      Scopes - https://dc2healthdataservice-dc2fhirservice.fhir.azurehealthcareapis.com/
      Extra Query Params Keys (space separated) - 
      ApiId - AcquireTokenForClient
      IsConfidentialClient - True
      SendX5C - False
      LoginHint ? False
      IsBrokerConfigured - False
      HomeAccountId - False
      CorrelationId - 810f692a-da70-4655-84d7-b4519dcd6618
      UserAssertion set: False
      LongRunningOboCacheKey set: False
      Region configured:

[jnlycklama]

DefaultAzureCredential will go through different types of authentication until it finds one that works - https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/?tabs=command-line#exploring-the-sequence-of-defaultazurecredential-authentication-methods
So its not failing on EnvironmentCredential or WorkloadIdentityCredential, but just moving on to the next credential. It looks like it finally uses ManagedIdentityCredential and stops there.

https://github.com/microsoft/dicom-server/blob/main/converter/dicom-cast/docs/authentication.md - see these docs for more options on how to set up authentication