AZCOPY_MSI_RESOURCE_STRING does not work with MSAL

[wanzhuM]

Which version of the AzCopy was used?

v10.21.0

Which platform are you using? (ex: Windows, Mac, Linux)

Linux (specifically shell extension in ev2)

What command did you run?

export AZCOPY_AUTO_LOGIN_TYPE=MSI
export AZCOPY_MSI_RESOURCE_STRING="$resourceId"
azcopy sync "$src" "$dst" --recursive --delete-destination=true

What problem was encountered?

2023-10-01 09:58:19.345119: Failed to perform Auto-login: ManagedIdentityCredential authentication failed
2023-10-01 09:58:19.345131: GET http://169.254.169.254/metadata/identity/oauth2/token
2023-10-01 09:58:19.345144: --------------------------------------------------------------------------------
2023-10-01 09:58:19.345156: RESPONSE 400 Bad Request
2023-10-01 09:58:19.345168: --------------------------------------------------------------------------------
2023-10-01 09:58:19.345180: Failed to make request: '\''Identity not found: '\''ACI_MI_DEFAULT'\'''\''
2023-10-01 09:58:19.345192: 
2023-10-01 09:58:19.345204: --------------------------------------------------------------------------------
2023-10-01 09:58:19.345215: To troubleshoot, visit https://aka.ms/azsdk/go/identity/troubleshoot#managed-id.'

How can we reproduce the problem in the simplest way?

Use any bash shell with User assigned managed identity, in my case it was in ev2

Have you found a mitigation/solution?

Use client ID instead of resource string

export AZCOPY_MSI_CLIENT_ID="$clientId"

[diodfr]

The option has been deprecated :
https://github.com/Azure/azure-storage-azcopy/releases/tag/v10.21.0-Preview

4. Deprecated support for object IDs in MSI. Client ID or Resource ID can be used as an alternative.

[wanzhuM]

The option has been deprecated : https://github.com/Azure/azure-storage-azcopy/releases/tag/v10.21.0-Preview

4. Deprecated support for object IDs in MSI. Client ID or Resource ID can be used as an alternative.

This doesn't make any sense, quoting from the official docs: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json

We were originally using "RESOURCE_STRING" not "OBJECT_ID"

RESOURCE_STRING, which I'm assiming is Resource ID should work and used to.

Example:

export AZCOPY_MSI_RESOURCE_STRING=/subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identityName>

[diodfr]

Please forgive me, I misread your issue.
I thought that you use the deprecated system variable.
In fact, I have the same issue #2398 but azcopy uses the system identity as fallback instead of the provided resource string.

[gapra-msft]

Hi, I believe this issue was fixed by the following PR #2406

This should be released as part of our 10.22 release

[gapra-msft]

The 10.22.0 version was just released. Closing this issue as a result.