Validating `DefaultAzureCredential()` using Python SDK?

Question

What are some example methods for logging and handling exceptions using try/except and DefaultAzureCredential()?

Example:

When DefaultAzureCredential() is used in a Python Azure Function, it generates a few WARNING messages and one of the .get_token methods in the credential chain succeeds.

I want to log which one succeeded and which ones failed.

WARNING:azure.identity._internal.decorators:EnvironmentCredential.get_token failed: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.

WARNING:azure.identity._internal.decorators:ManagedIdentityCredential.get_token failed: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.

WARNING:azure.identity._internal.decorators:SharedTokenCacheCredential.get_token failed: SharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.

WARNING:azure.identity._internal.decorators:VisualStudioCodeCredential.get_token failed: Failed to get Azure user details from Visual Studio Code.

And then it just succeeds, but there is no message indicating which one succeeded. In this case, running snippets in a .ipynb file in VS Code).

How do I log and handle errors when using DefaultAzureCredential() in production?

Looking for an example of something like:

try:
    credentials = DefaultAzureCredential()
    logging.info(f'<whichever>.get_token succeeded')
except Error1 as e1:
    logging.error(f'EnvironmentCredential.get_token failed: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.', e1)
except Error2 as e2:
    logging.error(f'ManagedIdentityCredential.get_token failed: ManagedIdentityCredential authentication unavailable, no managed identity endpoint found.', e2)
...<etc>

Charles Lowell · Accepted Answer · 2021-01-30 00:11:47Z

Just to supplement the accepted answer with some more details, let me add that DefaultAzureCredential does log this information. For example, if you enable INFO-level logging:

import logging
from azure.identity import DefaultAzureCredential

logger = logging.getLogger('azure.identity')
logger.setLevel(logging.INFO)

handler = logging.StreamHandler(stream=sys.stdout)
formatter = logging.Formatter('[%(levelname)s %(name)s] %(message)s')
handler.setFormatter(formatter)
logger.addHandler(handler)

You'll see log messages like these from DefaultAzureCredential:

[INFO] DefaultAzureCredential - EnvironmentCredential is unavailable
[INFO] DefaultAzureCredential - ManagedIdentityCredential is unavailable
[INFO] DefaultAzureCredential - SharedTokenCacheCredential is unavailable
[INFO] DefaultAzureCredential acquired a token from VisualStudioCodeCredential

You'll see the failed attempts logged only the first time the DefaultAzureCredential instance acquires a token. Once one of its constituent credentials provides a token, it uses that credential exclusively. So this particular DefaultAzureCredential will always authenticate through Visual Studio Code, and in the logs you'll see this message whenever it does so:

[INFO] DefaultAzureCredential acquired a token from VisualStudioCodeCredential

Kibrantn · Accepted Answer · 2020-11-02 23:55:28Z

2

There are a few ways I might approach this but none are particularly pretty. At the risk of a naive suggestion, if you want a fine-grained understanding of what worked in sequence, you could take an approach similar to what your example sketched out using the components credentials listed here:

for credential in [EnvironmentCredential, ManagedIdentityCredential, ...]:
  try:
    credentials = credential()
    # Validate credential functionality...
    logging.info('{}.get_token succeeded'.format(credential))
  except Error1 as e1:
    logging.error('{} failed due to {}'.format(credential, e1))

I suggest this because it does not seem like what you want is exposed in an easily accessible manner, looking at the ChainedCredential source here (history is built up but only used in the log message).

More "self-contained" approaches might involve creating a custom wrapper that basically does what ChainedCredential does for DefaultAzureCredential in running the list of get_token calls, but with more ability to export the success history, you could likely hack that off of the code I linked in 2 and do something directly comparable to the DefaultAzureCredential logic, but at the end of the day it's all isomorphisms of the sample above.

Don't hesitate to shout if I've misunderstood some aspect of the question or your requirements/constraints; and as always feel free to reach out if you need to get in touch with us on our github (full disclosure, am a maintainer for some of the other Python Azure SDKs)

answered Nov 2, 2020 at 23:55

Kibrantn

6093 silver badges4 bronze badges

3 Comments

ericOnline Over a year ago

Thank you for providing some ideas. I want to make sure I'm not overriding anything that DefaultAzureCredential() is doing and am actually using DefaultAzureCredential(). I don't see it listed in your proposed solution. Where is the actual call to DefaultAzureCredential() in your solution?

Kibrantn Over a year ago

To be clear, my solution basically "works around' needing to consume DefaultAzureCredential() explicitly, because I do not see an obvious way to extract the information you need from it; it simply does not persist it, so you'd need to have "your own version" of DefaultAzureCredential() which is what I outline above. Echoing myself to be VERY predantic: I do not see a way that you CAN actually use DefaultAzureCredential explicitly with the requirements you have above (to know what succeeded and failed within it)

ericOnline Over a year ago

Thank you for the clarification. Due to my current level of experience, I'd prefer not to create my own version of DefaultAzureCredential. I'll pursue an alternative unless you know a simple Python method to catch all the "Warning" messages that are displayed.

Collectives™ on Stack Overflow

Validating `DefaultAzureCredential()` using Python SDK?

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related