This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 33%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EUR%3C/text%3E%3C/svg%3E)
I am running Docker Compose in an Azure App Service that has system-assigned managed identity enabled. I deployed this docker compose on Azure Container Registry that also had system-assigned managed identity enabled. I also granted this App Service's managed identity the access to a key vault and assigned it the role of 'Key Vault Administrator'. When I run this app, I get this error: "const err = new AggregateAuthenticationError(errors, "ChainedTokenCredential authentication failed."); AggregateAuthenticationError: ChainedTokenCredential authentication failed. CredentialUnavailableError: EnvironmentCredential is unavailable. No underlying credential could be used. To troubleshoot, visit https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot. CredentialUnavailableError: WorkloadIdentityCredential: is unavailable. tenantId, clientId, and federatedTokenFilePath are required parameters." Can anyone please tell me if I have to make some other configurations to make this work? Regards, Umar
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
Hi Umer, As of now managed identities is not supported with Multi-container webapps . Web App for Multi Containers is still in preview. You can keep up to date by checking this documentation or on the App Service Team blog site. Please let us know if you have further questions. Thanks Deepanshu
Hi Deepanshu Thanks for the prompt response. Can you please let me know what are the recommended practices for securely accessing keyvault from within a docker compose deployed in an Azure App? I am using system-assigned managed identity to access keyvault in a Nodejs-based Azure app but it seems I need a different approach in docker compose.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
I can access keyvault from system-assigned managed identity within Nodejs-based App Service, but I can't access keyvault from system-assigned managed identity within Docker Compose.
I can access keyvault from system-assigned managed identity within Nodejs-based App Service, but I can't access keyvault from system-assigned managed identity within Docker Compose. What I understand from your answer is that managed identities are not supported with Multi-container webapps. So I want to know how can I securely access keyvault from an App Service using a Docker Compose?
Hi Yes, please find this https://kevinle.medium.com/securely-store-and-access-secrets-in-azure-keyvault-from-docker-based-app-service-babe463fe57b, it has the complete steps Securely store and access secrets in Azure KeyVault from Docker-compse based App Service
Please let me know if anything else needed but in that doc everything is given just follow please
Hi Umer , Following up to see if the provided answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hi Deepanshu I am not clear about some points in this article: [ https://kevinle.medium.com/securely-store-and-access-secrets-in-azure-keyvault-from-docker-based-app-service-babe463fe57b] The article suggest using system-assigned managed identity with docker compose, but as you explained earlier, managed identities are not supported with muti-container web apps. In that case, the option is to create a service principal, grant it access to the keyvault and store the service principal's credentials in the environment file. Is that the recommended approach to access keyvault from docker compose webapp? Please let me know if my understanding is correct.
Ok then can you please tell exact issue and what you are expecting as I already mentioned in my previous comments ?
Please see the question above. I don't know why it got truncated.