Azure function App - Error building configuration in an external startup class.

Question

Azure function App - Error building configuration in an external startup class.

David M 216

Bonjour,

J'ai un service fonction App (qui utilise des variables stockées dans un Key Vault) qui fonctionnait très bien depuis un moment.

Seulement, contrairement à d'autres de mes services Function App, les URL de fonctions ne sont pas protégées par une clé (url?code=4cDlZ6AgFK9c...)

J'ai voulu changer le paramétrage pour essayer de les passer en isolated (un message me le conseillait "Update your function app to the isolated worker model for continued support. The in-process model will be retired starting November 10, 2026."). J'ai aussi monté les versions de DOT NET (6=>8) et supprimé l'identité.
Ce qui a fait que mon service ne fonctionnait plus. Les fonctions ne se listaient même plus.

J'ai réussi à refaire le lien avec Keyvault et remis le paramétrage initial.

Mais j'ai toujours ce message d'erreur persistent après redémarrage du service "Error building configuration in an external startup class."
Je ne comprend pas pourquoi, mon paramétrage est exactement le même qu'avant.

Voici le message d'erreur complet:

Microsoft.Azure.WebJobs.Script.ExternalStartupException : Error building configuration in an external startup class. ---> 
Azure.Identity.CredentialUnavailableException : DefaultAzureCredential failed to retrieve a token from the included credentials. See the troubleshooting guide for more information. 
https://aka.ms/azsdk/net/identity/defaultazurecredential/troubleshoot - EnvironmentCredential authentication unavailable. Environment variables are not fully configured. 
See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot - ManagedIdentityCredential authentication unavailable. 
Multiple attempts failed to obtain a token from the managed identity endpoint. 
- Visual Studio Token provider can't be accessed at D:\DWASFiles\Sites\ubysol-dev-scheduler-azf\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json 
- Stored credentials not found. Need to authenticate user in VSCode Azure Account. See the troubleshooting guide for more information. 
https://aka.ms/azsdk/net/identity/vscodecredential/troubleshoot - Azure CLI not installed - Az.Account module >= 2.2.0 is not installed. ---> 
System.AggregateException : Multiple exceptions were encountered while attempting to authenticate. (EnvironmentCredential authentication unavailable. 
Environment variables are not fully configured. See the troubleshooting guide for more information. 
https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot) (ManagedIdentityCredential authentication unavailable. 
Multiple attempts failed to obtain a token from the managed identity endpoint.) 
(Visual Studio Token provider can't be accessed at D:\DWASFiles\Sites\ubysol-dev-scheduler-azf\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json) 
(Stored credentials not found. Need to authenticate user in VSCode Azure Account. See the troubleshooting guide for more information. 
https://aka.ms/azsdk/net/identity/vscodecredential/troubleshoot) (Azure CLI not installed) (Az.Account module >= 2.2.0 is not installed.) ---> 
EnvironmentCredential authentication unavailable. Environment variables are not fully configured. See the troubleshooting guide for more information. 
https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot ---> (Inner Exception #0) 
Azure.Identity.CredentialUnavailableException : EnvironmentCredential authentication unavailable. Environment variables are not fully configured. 
See the troubleshooting guide for more information. 
https://aka.ms/azsdk/net/identity/environmentcredential/troubleshoot at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex,String additionalMessage) 
at async Azure.Identity.EnvironmentCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.EnvironmentCredential.GetTokenAsync(TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources,TokenRequestContext requestContext,Boolean 
async,CancellationToken cancellationToken)<--- ---> (Inner Exception #1) Azure.Identity.CredentialUnavailableException : 
ManagedIdentityCredential authentication unavailable. Multiple attempts failed to obtain a token from the managed identity endpoint. ---> 
System.AggregateException : Retry failed after 4 tries. Retry settings can be adjusted in ClientOptions.Retry. 
(An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80)) (An attempt was made to access a socket in a way forbidden 
by its access permissions. (169.254.169.254:80)) (An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80)) 
(An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80)) ---> 
An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
An attempt was made to access a socket in a way forbidden by its access permissions. at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.ManagedIdentitySource.AuthenticateAsync(Boolean async,TokenRequestContext 
context,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.ImdsManagedIdentitySource.AuthenticateAsync(Boolean async,TokenRequestContext context,CancellationToken cancellationToken) ---> 
(Inner Exception #0) Azure.RequestFailedException : An attempt was made to access a socket in a way forbidden by its access permissions. 
(169.254.169.254:80) ---> System.Net.Http.HttpRequestException : An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
System.Net.Sockets.SocketException : An attempt was made to access a socket in a way forbidden by its access permissions. 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 port,HttpRequestMessage 
initialRequest,Boolean async,CancellationToken cancellationToken) End of inner exception at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 port,
HttpRequestMessage initialRequest,Boolean async,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync[T](??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request,Boolean async,Boolean doRequestAuth,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) 
End of inner exception at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Core.Pipeline.HttpPipelineTransportPolicy.ProcessAsync(HttpMessage message,ReadOnlyMemory`1 pipeline) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.ResponseBodyPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??)<--- ---> 
(Inner Exception #1) Azure.RequestFailedException : An attempt was made to access a socket in a way forbidden by its access permissions. 
(169.254.169.254:80) ---> System.Net.Http.HttpRequestException : An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
System.Net.Sockets.SocketException : An attempt was made to access a socket in a way forbidden by its access permissions. 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 
port,HttpRequestMessage initialRequest,Boolean async,CancellationToken cancellationToken) End of inner exception 
at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 port,HttpRequestMessage initialRequest,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync[T](??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request,Boolean 
async,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request,Boolean async,Boolean doRequestAuth,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) End of inner exception 
at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Core.Pipeline.HttpPipelineTransportPolicy.ProcessAsync(HttpMessage message,ReadOnlyMemory`1 pipeline) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.ResponseBodyPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??)<--- ---> 
(Inner Exception #2) Azure.RequestFailedException : An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
System.Net.Http.HttpRequestException : An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
System.Net.Sockets.SocketException : An attempt was made to access a socket in a way forbidden by its access permissions. 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 port,HttpRequestMessage 
initialRequest,Boolean async,CancellationToken cancellationToken) End of inner exception at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 port,
HttpRequestMessage initialRequest,Boolean async,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync[T](??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request,Boolean async,Boolean doRequestAuth,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) End of inner exception 
at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Core.Pipeline.HttpPipelineTransportPolicy.ProcessAsync(HttpMessage message,ReadOnlyMemory`1 pipeline) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.ResponseBodyPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??)<--- ---> 
(Inner Exception #3) Azure.RequestFailedException : An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
System.Net.Http.HttpRequestException : An attempt was made to access a socket in a way forbidden by its access permissions. (169.254.169.254:80) ---> 
System.Net.Sockets.SocketException : An attempt was made to access a socket in a way forbidden by its access permissions. 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 port,HttpRequestMessage 
initialRequest,Boolean async,CancellationToken cancellationToken) End of inner exception at async System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host,Int32 
port,HttpRequestMessage initialRequest,Boolean async,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync[T](??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.ValueTask`1.get_Result() at async System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.ValueTask`1.get_Result() 
at async System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request,Boolean async,Boolean doRequestAuth,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) End of inner exception 
at async Azure.Core.Pipeline.HttpClientTransport.ProcessAsync(??) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Core.Pipeline.HttpPipelineTransportPolicy.ProcessAsync(HttpMessage message,ReadOnlyMemory`1 pipeline) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.ResponseBodyPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??)<--- End of inner exception 
at async Azure.Identity.ImdsManagedIdentitySource.AuthenticateAsync(Boolean async,TokenRequestContext context,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.ManagedIdentityClient.AuthenticateAsync(Boolean async,TokenRequestContext 
context,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex,String additionalMessage) 
at async Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.ManagedIdentityCredential.GetTokenAsync(TokenRequestContext requestContext,
CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.DefaultAzureCredential.
GetTokenFromSourcesAsync(TokenCredential[] sources,TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken)<--- ---> 
(Inner Exception #2) Azure.Identity.CredentialUnavailableException : Visual Studio Token provider can't be accessed 
at D:\DWASFiles\Sites\ubysol-dev-scheduler-azf\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json ---> 
System.IO.DirectoryNotFoundException : Could not find a part of the path 'D:\DWASFiles\Sites\ubysol-dev-scheduler-azf\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json'. 
at Microsoft.Win32.SafeHandles.SafeFileHandle.CreateFile(String fullPath,FileMode mode,FileAccess access,FileShare share,FileOptions options) 
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath,FileMode mode,FileAccess access,FileShare share,FileOptions options,Int64 preallocationSize) 
at System.IO.Strategies.OSFileStreamStrategy..ctor(String path,FileMode mode,FileAccess access,FileShare share,FileOptions options,Int64 preallocationSize) 
at System.IO.Strategies.FileStreamHelpers.ChooseStrategyCore(String path,FileMode mode,FileAccess access,FileShare share,FileOptions options,Int64 preallocationSize) 
at System.IO.Strategies.FileStreamHelpers.ChooseStrategy(FileStream fileStream,String path,FileMode mode,FileAccess access,FileShare share,Int32 bufferSize,FileOptions 
options,Int64 preallocationSize) at System.IO.StreamReader.ValidateArgsAndOpenPath(String path,Encoding encoding,Int32 bufferSize) 
at System.IO.File.InternalReadAllText(String path,Encoding encoding) at System.IO.File.ReadAllText(String path) 
at Azure.Identity.VisualStudioCredential.GetTokenProviderContent(String tokenProviderPath) End of inner exception 
at Azure.Identity.VisualStudioCredential.GetTokenProviderContent(String tokenProviderPath) at Azure.Identity.VisualStudioCredential.GetTokenProviders(String tokenProviderPath) 
at async Azure.Identity.VisualStudioCredential.GetTokenImplAsync(TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex,String additionalMessage) 
at async Azure.Identity.VisualStudioCredential.GetTokenImplAsync(TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.VisualStudioCredential.GetTokenAsync(TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] 
sources,TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken)<--- ---> (Inner Exception #3) Azure.Identity.CredentialUnavailableException : 
Stored credentials not found. Need to authenticate user in VSCode Azure Account. 
See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/vscodecredential/troubleshoot ---> 
System.InvalidOperationException : The operation completed successfully. at Azure.Identity.WindowsNativeMethods.ThrowIfFailed(Boolean isSucceeded,String methodName) 
at Azure.Identity.WindowsVisualStudioCodeAdapter.GetCredentials(String serviceName,String accountName) at Azure.Identity.VisualStudioCodeCredential.GetStoredCredentials(String 
environmentName) End of inner exception at Azure.Identity.VisualStudioCodeCredential.GetStoredCredentials(String environmentName) 
at async Azure.Identity.VisualStudioCodeCredential.GetTokenImplAsync(TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex,String additionalMessage) 
at async Azure.Identity.VisualStudioCodeCredential.GetTokenImplAsync(TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.VisualStudioCodeCredential.GetTokenAsync(TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] 
sources,TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken)<--- ---> (Inner Exception #4) Azure.Identity.CredentialUnavailableException : 
Azure CLI not installed at async Azure.Identity.AzureCliCredential.RequestCliAccessTokenAsync(Boolean async,TokenRequestContext context,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.AzureCliCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,
CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception 
ex,String additionalMessage) at async Azure.Identity.AzureCliCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.AzureCliCredential.GetTokenAsync(TokenRequestContext requestContext,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] 
sources,TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken)<--- ---> (Inner Exception #5) Azure.Identity.CredentialUnavailableException : 
Az.Account module >= 2.2.0 is not installed. at Azure.Identity.AzurePowerShellCredential.CheckForErrors(String output) 
at async Azure.Identity.AzurePowerShellCredential.RequestAzurePowerShellAccessTokenAsync(Boolean async,TokenRequestContext context,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.AzurePowerShellCredential.GetTokenImplAsync(Boolean async,TokenRequestContext 
requestContext,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex,String additionalMessage) 
at async Azure.Identity.AzurePowerShellCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.AzurePowerShellCredential.GetTokenAsync(TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] 
sources,TokenRequestContext requestContext,Boolean async,CancellationToken cancellationToken)<--- End of inner exception 
at async Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources,TokenRequestContext requestContext,Boolean async,CancellationToken 
cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex,String additionalMessage) 
at async Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async,TokenRequestContext requestContext,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.AuthenticateRequestAsync(HttpMessage message,Boolean async) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Security.KeyVault.ChallengeBasedAuthenticationPolicy.ProcessCoreAsync(HttpMessage message,ReadOnlyMemory`1 pipeline,Boolean async) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RedirectPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.RetryPolicy.ProcessAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Core.Pipeline.HttpPipeline.SendRequestAsync(Request request,CancellationToken cancellationToken) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(??) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Azure.Security.KeyVault.KeyVaultPipeline.GetPageAsync[T](Uri firstPageUri,String nextLink,Func`1 
itemFactory,String operationName,CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Core.PageResponseEnumerator.FuncAsyncPageable`1.AsPages[T](String continuationToken,Nullable`1 pageSizeHint) 
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1.ThrowForFailedGetResult(Int16 token) 
at async Azure.Core.PageResponseEnumerator.FuncAsyncPageable`1.AsPages[T](String continuationToken,Nullable`1 pageSizeHint) 
at async Azure.AsyncPageable`1.GetAsyncEnumerator[T](CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.AsyncPageable`1.GetAsyncEnumerator[T](CancellationToken cancellationToken) at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at System.Threading.Tasks.Sources.ManualResetValueTaskSourceCore`1.ThrowForFailedGetResult(Int16 token) 
at async Azure.AsyncPageable`1.GetAsyncEnumerator[T](CancellationToken cancellationToken) 
at async Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.LoadAsync() at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at async Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.LoadAsync() at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() 
at Azure.Extensions.AspNetCore.Configuration.Secrets.AzureKeyVaultConfigurationProvider.Load() at Microsoft.Extensions.Configuration.ConfigurationRoot..ctor(IList`1 providers) 
at Microsoft.Extensions.Configuration.ConfigurationBuilder.Build() at Ubysol.Scheduler.FunctionStartupBase.ConfigureAppConfiguration(IFunctionsConfigurationBuilder builder) 
at D:\a\1\s\Ubysol.Scheduler\FunctionStartupBase.cs : 54 at Microsoft.Azure.WebJobs.WebJobsBuilderExtensions.ConfigureAndLogUserConfigurationProviders(IWebJobsConfigurationStartup 
startup,WebJobsBuilderContext context,IWebJobsConfigurationBuilder builder,ILoggerFactory loggerFactory) 
at D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Hosting\WebJobsBuilderExtensions.cs : 342 
at Microsoft.Azure.WebJobs.WebJobsBuilderExtensions.UseWebJobsConfigurationStartup(IWebJobsConfigurationBuilder builder,Type startupType,WebJobsBuilderContext context,ILoggerFactory 
loggerFactory) at D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Hosting\WebJobsBuilderExtensions.cs : 327 
at Microsoft.Azure.WebJobs.WebJobsBuilderExtensions.UseExternalConfigurationStartup(IWebJobsConfigurationBuilder builder,IWebJobsStartupTypeLocator startupTypeLocator,
WebJobsBuilderContext context,ILoggerFactory loggerFactory) at D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Hosting\WebJobsBuilderExtensions.cs : 367 
at Microsoft.Azure.WebJobs.Script.ScriptHostBuilderExtensions.<>c__DisplayClass7_3.<AddScriptHostCore>b__8(IWebJobsStartupTypeLocator locator) 
at /_/src/WebJobs.Script/ScriptHostBuilderExtensions.cs : 263 End of inner exception

David M 216 Reputation points

2025-06-03T07:57:04.05+00:00
Etrangement, les variables d'environnement sont bien mappées (en vert "Resolved") avec le KeyVault, mais lorsque je lance une Function, il n'arrive pas à se connecter, il me dit :

An error occurred using the connection to database. ... Login failed for user '<token-identified principal>'.

Pour info, dans le KeyVault, j'ai du créer une nouvelle stratégie d'accès vers le service FunctionApp, l'ID à donc changé.
Il doit me manquer une étape. Mais ou faire le mappage avec "token-identified principal" que je ne trouve pas.
Sai Prabhu Naveen Parimi 3,970 Reputation points Microsoft External Staff Moderator

2025-06-05T00:56:16.3433333+00:00
@David M

Here are a few steps you could try to troubleshoot and potentially resolve the issue:

Verify Access Policies in Key Vault:

Go to your Key Vault in the Azure Portal.

Check the "Access policies" and ensure the Managed Identity of your Function App has the appropriate access (like Get and List for secrets).

Recheck Environment Variables:

In your Function App configuration settings, verify that the expected environment variables (especially the connection keys for Key Vault) are correctly set and match what your application is trying to access.

Local Development (if applicable):

If running locally, ensure your local development tools (like Azure CLI or Visual Studio) are all fully authenticated and can access the resources required.

Logging:

Implement logging in your Function App to get more insights into where the process is failing and what specific configurations may not be read correctly.

Check the Azure Documentation:

Since you're using newer configurations and changes, refer to the latest Azure documentation for troubleshooting ASP.NET Core on Azure App Service to ensure there are no overlooked steps.
David M 216 Reputation points

2025-06-05T07:42:15.9633333+00:00

Bonjour,

Merci pour votre réponse.

En effet, le droit vers ma functionApp dans le KeyVault/« stratégies d'accès » était cassé mais je l'avais bien remis.
Egalement dans les secrets, j'ai fait repointer le secret qui cible ma functionApp vers la nouvelle clé "Default" qui semble avoir changée car elle ne correspondait plus.

Ce secret est utilisé dans les variables d'environnements de la functionApp (je trouve ça étrange qu'il ait besoin de sa propre clé, mais mon, c'est comme ça en préprod ou ça marche bien).

Mais le problème semble avoir évolué. Le Bandeau d'erreur "Error building configuration in an external startup class." n'apparait plus en haut de "Vue D'ensemble" du service function App:

Mais lorsque je lance n'importe quelle Function de mon service, il y a un problème de droits d'accès à la BDD:
An exception occurred while iterating over the results of a query for context type 'Ubysol.DAL.Core.Entities.UbysolDbEntities'. Microsoft.Data.SqlClient.SqlException (0x80131904): Login failed for user '<token-identified principal>'. at Microsoft.Data.ProviderBase.DbConnectionPool.CheckPoolBlockingPeriod(Exception e) at Microsoft.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) at ...

Pourtant je peux me connecter à la BDD depuis mon MSSMS local, et l'application WEB fonctionne bien, c'est juste la FunctionApp qui n'y accède plus de manière globale.
J'ai vu que j'avais un utilisateur "ubysol-dev-scheduler-azf" dans "Security/Users" de ma BDD, j'imagine que c'est lui qui est utilisé pour la connexion de la FA.
J'ai également bien une "Application d’entreprise" "ubysol-dev-scheduler-azf", mais je ne vois aucun paramètre qui permette de restaurer le droit d'accès (si jamais c'est bien ça).
Sai Prabhu Naveen Parimi 3,970 Reputation points Microsoft External Staff Moderator

2025-06-06T00:27:31.98+00:00
@David M

Il semble que l’identité managée de ta Function App ait été recréée, donc l’accès précédent à la base SQL n’est plus valide.

Même si l’identité a bien accès au Key Vault et que la chaîne de connexion est correctement résolue, l’erreur Login failed for user '<token-identified principal>' signifie que le serveur SQL ne reconnaît pas la nouvelle identité.

Pour régler ça :

Connecte-toi à ta base SQL avec SSMS ou l’éditeur de requêtes, en utilisant un compte administrateur.

Exécute le SQL suivant pour (re)créer l’utilisateur et lui assigner les rôles :

DROP USER IF EXISTS [ubysol-dev-scheduler-azf]; CREATE USER [ubysol-dev-scheduler-azf] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [ubysol-dev-scheduler-azf]; ALTER ROLE db_datawriter ADD MEMBER [ubysol-dev-scheduler-azf];

Remplace ubysol-dev-scheduler-azf par le nom exact de l’identité managée de ta Function App, si c’est différent.

Cela crée un utilisateur SQL lié à ta nouvelle identité managée et lui donne les accès nécessaires.
David M 216 Reputation points

2025-06-06T13:43:43.95+00:00

ça a fonctionné, merci.
Par contre, à part dans MSSMS, je ne vois pas ou est indiqué cet utilisateur dans Azure.
David M 216 Reputation points

2025-06-07T06:08:59.46+00:00

Merci à vous pour vos réponses, le service est revenu d'aplomb.

J'en suis maintenant à mon point de départ qui m'avait mis dans cette situation, à savoir :

Seulement, contrairement à d'autres de mes services Function App, les URL de fonctions ne sont pas protégées par une clé (url?code=4cDlZ6AgFK9c...)

Comment paramétrer mon service pour qu'il y ait cette clé d'accès ?

2 answers

Your answer

David M 216 Reputation points

2025-06-03T07:57:04.05+00:00

Etrangement, les variables d'environnement sont bien mappées (en vert "Resolved") avec le KeyVault, mais lorsque je lance une Function, il n'arrive pas à se connecter, il me dit :

An error occurred using the connection to database. ... Login failed for user '<token-identified principal>'.

Pour info, dans le KeyVault, j'ai du créer une nouvelle stratégie d'accès vers le service FunctionApp, l'ID à donc changé.
Il doit me manquer une étape. Mais ou faire le mappage avec "token-identified principal" que je ne trouve pas.
Sai Prabhu Naveen Parimi 3,970 Reputation points Microsoft External Staff Moderator

2025-06-05T00:56:16.3433333+00:00

@David M

Here are a few steps you could try to troubleshoot and potentially resolve the issue:

Verify Access Policies in Key Vault:

Go to your Key Vault in the Azure Portal.

Check the "Access policies" and ensure the Managed Identity of your Function App has the appropriate access (like Get and List for secrets).

Recheck Environment Variables:

In your Function App configuration settings, verify that the expected environment variables (especially the connection keys for Key Vault) are correctly set and match what your application is trying to access.

Local Development (if applicable):

If running locally, ensure your local development tools (like Azure CLI or Visual Studio) are all fully authenticated and can access the resources required.

Logging:

Implement logging in your Function App to get more insights into where the process is failing and what specific configurations may not be read correctly.

Check the Azure Documentation:

Since you're using newer configurations and changes, refer to the latest Azure documentation for troubleshooting ASP.NET Core on Azure App Service to ensure there are no overlooked steps.
David M 216 Reputation points

2025-06-05T07:42:15.9633333+00:00

Bonjour,

Merci pour votre réponse.

En effet, le droit vers ma functionApp dans le KeyVault/« stratégies d'accès » était cassé mais je l'avais bien remis.
Egalement dans les secrets, j'ai fait repointer le secret qui cible ma functionApp vers la nouvelle clé "Default" qui semble avoir changée car elle ne correspondait plus.

Ce secret est utilisé dans les variables d'environnements de la functionApp (je trouve ça étrange qu'il ait besoin de sa propre clé, mais mon, c'est comme ça en préprod ou ça marche bien).

Mais le problème semble avoir évolué. Le Bandeau d'erreur "Error building configuration in an external startup class." n'apparait plus en haut de "Vue D'ensemble" du service function App:

Mais lorsque je lance n'importe quelle Function de mon service, il y a un problème de droits d'accès à la BDD:
An exception occurred while iterating over the results of a query for context type 'Ubysol.DAL.Core.Entities.UbysolDbEntities'. Microsoft.Data.SqlClient.SqlException (0x80131904): Login failed for user '<token-identified principal>'. at Microsoft.Data.ProviderBase.DbConnectionPool.CheckPoolBlockingPeriod(Exception e) at Microsoft.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject, DbConnectionOptions userOptions, DbConnectionInternal oldConnection) at ...

Pourtant je peux me connecter à la BDD depuis mon MSSMS local, et l'application WEB fonctionne bien, c'est juste la FunctionApp qui n'y accède plus de manière globale.
J'ai vu que j'avais un utilisateur "ubysol-dev-scheduler-azf" dans "Security/Users" de ma BDD, j'imagine que c'est lui qui est utilisé pour la connexion de la FA.
J'ai également bien une "Application d’entreprise" "ubysol-dev-scheduler-azf", mais je ne vois aucun paramètre qui permette de restaurer le droit d'accès (si jamais c'est bien ça).
Sai Prabhu Naveen Parimi 3,970 Reputation points Microsoft External Staff Moderator

2025-06-06T00:27:31.98+00:00

@David M

Il semble que l’identité managée de ta Function App ait été recréée, donc l’accès précédent à la base SQL n’est plus valide.

Même si l’identité a bien accès au Key Vault et que la chaîne de connexion est correctement résolue, l’erreur Login failed for user '<token-identified principal>' signifie que le serveur SQL ne reconnaît pas la nouvelle identité.

Pour régler ça :

Connecte-toi à ta base SQL avec SSMS ou l’éditeur de requêtes, en utilisant un compte administrateur.

Exécute le SQL suivant pour (re)créer l’utilisateur et lui assigner les rôles :

DROP USER IF EXISTS [ubysol-dev-scheduler-azf]; CREATE USER [ubysol-dev-scheduler-azf] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [ubysol-dev-scheduler-azf]; ALTER ROLE db_datawriter ADD MEMBER [ubysol-dev-scheduler-azf];

Remplace ubysol-dev-scheduler-azf par le nom exact de l’identité managée de ta Function App, si c’est différent.

Cela crée un utilisateur SQL lié à ta nouvelle identité managée et lui donne les accès nécessaires.
David M 216 Reputation points

2025-06-06T13:43:43.95+00:00

ça a fonctionné, merci.
Par contre, à part dans MSSMS, je ne vois pas ou est indiqué cet utilisateur dans Azure.
David M 216 Reputation points

2025-06-07T06:08:59.46+00:00

Merci à vous pour vos réponses, le service est revenu d'aplomb.

J'en suis maintenant à mon point de départ qui m'avait mis dans cette situation, à savoir :

Seulement, contrairement à d'autres de mes services Function App, les URL de fonctions ne sont pas protégées par une clé (url?code=4cDlZ6AgFK9c...)

Comment paramétrer mon service pour qu'il y ait cette clé d'accès ?

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

2 deleted comments

Comments have been turned off. Learn more

Answer 2

David M 216

Merci à vous pour vos réponses, le service est revenu d'aplomb. J'en suis maintenant à mon point de départ qui m'avait mis dans cette situation, à savoir : "Seulement, contrairement à d'autres de mes services Function App, les URL de fonctions ne sont pas protégées par une clé (url?code=4cDlZ6AgFK9c...)"

0 comments