blog/azure-managed-identity-postgres-aspnetcore

[giscus[bot]]

blog/azure-managed-identity-postgres-aspnetcore

https://mattparker.dev/blog/azure-managed-identity-postgres-aspnetcore

[GordonBeeming]

Great article... I know a project where this would be useful to use to make it better 🙂

Did you check if setting AZURE_CLIENT_ID works, in a similar way to how connecting to other resources works?

[SamBWagner]

Gangsta article. Clean and to the point. Tyty

[sliziky]

Hi, I have used the code from the article, with refresh set to 23 hours but after 2 days we still got error 28000: The acces token has expired. Please acquire a new token and retry

We are using User-assigned managed identity

Any idea why it happens? Thanks

[MattParkerDev]

Hi @sliziky! I think this behaviour might occur due to a combination of Npgsql's UsePeriodicPasswordProvider, and the DefaultAzureCredential().

DefaultAzureCredential.GetTokenAsync caches tokens internally.

My theory: at 23 hours, when Npgsql goes to get a "new" token, GetTokenAsync returns the same cached token, since it still has an hour until it expires. Npgsql then thinks it has a brand new token which lasts for another 23 hours, and after 1 more hour, the token Npgsql has, expires. You'd then be getting the error you see :)

Here's an issue relating to this problem:
npgsql/npgsql#5186

To fix this, you can either:

1. Reduce the PeriodicPasswordProvider successRefreshInterval to e.g. 1 minute
2. Use UsePasswordProvider instead. This method/s are called each time a connection to the db is opened, and therefore will absolutely always get a valid token, since it will call DefaultAzureCredential.GetTokenAsync each time.

var credentials = new DefaultAzureCredential();
var tokenRequestContext = new TokenRequestContext(["https://ossrdbms-aad.database.windows.net/.default"]);
dataSourceBuilder.UsePasswordProvider(
	passwordProvider: _ => credentials.GetToken(tokenRequestContext).Token,
	passwordProviderAsync: async (_, ct) => (await credentials.GetTokenAsync(tokenRequestContext, ct).ConfigureAwait(false)).Token);

Remembering that DefaultAzureCredential caches and handles invalidation and refreshing internally, so there is no problem calling GetTokenAsync each time a connection is opened.

1. assumes that DefaultAzureCredential refreshes its token at some point before it has actually expired - I would hope at least 5 minutes before?

I think either is an acceptable solution based on that assumption.

Having only used this on a personal project, deployed to Azure in an F1 dev App Service plan (which shuts down after a period of inactivity) I've never actually run into this issue, since every time the app service starts up, it would get a new valid token for 23 hours!

I hope this helps! Let me know how you go 😊

[sliziky]

Hi, we have decided to lower the refresh interval to 4 hours

We added logging of the token every 15 minutes into Insights and noticed that ~12 hours before expiration, the token refreshed, so 4 hours should be safe

One weird thing was that the app service did not get a new token even after restarting —probably Azure caches the token internally, too?