Error authenticating using Azure Managed Resource Identity

[GibbyOH]

I have two machines which I have been using to run Win ACME. I recently upgraded to 2.1.4 with the Azure plugin. On my Windows 10 machine, I have no issue. I have to create all my certificates manually which can be a headache for a server that has a bunch of URLs like Skype. However, on my IIS Server running Windows Server 2012, I get the error in the subject line. I initially tried running using IIS to pull in the URL but that failed so I went back to doing it manually and that also failed. As far as I can tell win acme running on Windows Server 2012 trying to use Azure plugin doesn't work.

A couple of things I tried was first to copy the working installation from my windows 10 computer. Next, I tried to create the TXT files manually and that did work but defeats the purpose of using the Azure Plugin.

I am hoping to automate my Skype and Exchange server within the next couple of weeks so any help would be appreciated.

[WouterTinus]

Hi @GibbyOH, please do a run with the --verbose switch on and post the log output here so that we can see what's leading up to this error.

[WouterTinus]

Maybe same issue as #1414

[GibbyOH]

Looks like it is trying to find a JSON file:

[VERB] Request completed with status OK
[INFO] Authorize identifier: dialin.gibbyoh.com
[INFO] Authorizing dialin.gibbyoh.com using dns-01 validation (Azure)
[EROR] Error preparing for challenge answer
Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProviderException: P
arameters: Connection String: [No connection string specified], Resource: https:
//management.azure.com/, Authority: . Exception Message: Tried the following 3 m
ethods to get an access token, but none of them worked.
Parameters: Connection String: [No connection string specified], Resource: https
://management.azure.com/, Authority: . Exception Message: Tried to get token usi
ng Managed Service Identity. Unable to connect to the Managed Service Identity (
MSI) endpoint. Please check that you are running on an Azure resource that has M
SI setup.
Parameters: Connection String: [No connection string specified], Resource: https
://management.azure.com/, Authority: . Exception Message: Tried to get token usi
ng Visual Studio. Access token could not be acquired. Visual Studio Token provid
er file not found at "C:\Users\josh.admin\AppData\Local.IdentityService\AzureSe
rviceAuth\tokenprovider.json"
Parameters: Connection String: [No connection string specified], Resource: https
://management.azure.com/, Authority: . Exception Message: Tried to get token usi
ng Azure CLI. Access token could not be acquired. 'az' is not recognized as an i
nternal or external command,
operable program or batch file.

at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAu
thResultAsyncImpl(String resource, String authority, CancellationToken cancellat
ionToken)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAu
thenticationResultAsync(String resource, String tenantId, CancellationToken canc
ellationToken)
at Microsoft.Azure.Services.AppAuthentication.AzureServiceTokenProvider.GetAc
cessTokenAsync(String resource, String tenantId, CancellationToken cancellationT
oken)
at PKISharp.WACS.Plugins.ValidationPlugins.Dns.Azure.GetClient()
at PKISharp.WACS.Plugins.ValidationPlugins.Dns.Azure.CreateRecord(String reco
rdName, String token)
at PKISharp.WACS.Plugins.ValidationPlugins.DnsValidation`1.PrepareChallenge()

at PKISharp.WACS.Plugins.ValidationPlugins.Validation`1.PrepareChallenge(ICha
llengeValidationDetails challenge)
at PKISharp.WACS.RenewalExecutor.Authorize(ILifetimeScope execute, RunLevel r
unLevel, ValidationPluginOptions options, TargetPart targetPart, Authorization a
uthorization)

[WouterTinus]

Definitely looks like an authentication problem, but that message about the .json file is only the result of one of three methods that it (unsuccesfully) tried.

How are you authenticating? Using a service principal account or a managed resource identity? It kind of looks like you're trying to use a managed resource identity but it's not set up properly.

[GibbyOH]

I am using a managed resource identity the same as on my Windows 10 machine.

[WouterTinus]

I'm afraid my knowledge of how this method of authentication works under the hood and why it can fail is limited, maybe someone with more Azure experience could chime in?

[GibbyOH]

Alright, so I figured it out. On my Windows 10 and Windows Server 2016 boxes, I can just enter the Display name (ie letsencrypt), anything older I have to enter the clientID string.

[WouterTinus]

Thanks for sharing that, would definitely be worth documenting!

[WouterTinus]

Added a note about this issue to the docs, thanks again.