Cannot authenticate when debugging Azure Functions in local with VS Code

Question

I have an Azure Function in Python where I'm getting a secret from Key Vault. The Azure Function is part of an App Service with Managed Identity configured, so I do not have a Service Principal. To access Key Vault, I'm using the azure identity library and the DefaultAzureCredential class.

My issue is that with local debugging of this function, credentials are not detected. I know that the debugger use a different shell, so login environment variables are not set. I tried to specify the "env" property in launch.json but get a warning that I'm not allowed to add it, same thing if I rename it to "environment". I also tried the InteractiveBrowserCredential class to login with my user account as a workaround, but then the credentials are dismissed as incorrect to access Key Vault.

How could I setup my VS Code local debugging environment to work with the managed identity of App Service?

Here is an except of my code:

import os
import logging
import azure.functions as func
from azure.storage.blob import BlobServiceClient
from azure.identity import DefaultAzureCredential, UsernamePasswordCredential
from azure.keyvault.secrets import SecretClient

def main(req: func.HttpRequest) -> func.HttpResponse:
    vault_url = os.environ['KeyVaultUrl']
    credential = DefaultAzureCredential()
    secret_client = SecretClient(vault_url=vault_url, credential=credential)
    access_key = secret_client.get_secret(os.environ['StorageSecretName'])

Thank you

Jim Xu · Accepted Answer · 2020-07-29 07:22:17Z

3

If you want to run the function with DefaultAzureCredential on locally, we need to add these settings in local.settings.json. The json file is used to store app settings, connection strings, and settings used by local development tools. For more details, please refer to here and here

For example

local.settings.json

{
  "IsEncrypted": false,
  "Values": {
    "AzureWebJobsStorage": "",
    "FUNCTIONS_WORKER_RUNTIME": "python",  
    "AZURE_CLIENT_ID": "42e***522d988c4",
    "AZURE_CLIENT_SECRET": "Gbx2eK***ClJDfQpIjoae:",
    "AZURE_TENANT_ID": "e4c9ab4e-b***230ba2a757fb"
  }
}

Code

import logging
import azure.functions as func
import os
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential

async def main(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')
    
    vault_url = 'https://testsql.vault.azure.net/'
    credential = DefaultAzureCredential()
    secret_client = SecretClient(vault_url=vault_url, credential=credential)
    access_key = secret_client.get_secret('DBConnectionString')
    return func.HttpResponse(access_key.value,
        mimetype="application/json",)

answered Jul 29, 2020 at 7:22

Jim Xu

23.2k2 gold badges24 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Alssanro Over a year ago

Thanks for your help Jim, I'm setting it up as you said. Just one question: where do you get the client secret? From the security principal created by the Managed Identity, I cannot find it. Do I need to create a security principal manually and deactivate Managed Identity?

Jim Xu Over a year ago

@Alssanro We have no way to get Managed Identity client secret. I suggest you create a security principal manually

Collectives™ on Stack Overflow

Cannot authenticate when debugging Azure Functions in local with VS Code

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related