Skip to content

Fix IMDS token requests for managed identities#6698

Merged
antkmsft merged 1 commit intoAzure:mainfrom
chewi:imds-double-slash
Aug 14, 2025
Merged

Fix IMDS token requests for managed identities#6698
antkmsft merged 1 commit intoAzure:mainfrom
chewi:imds-double-slash

Conversation

@chewi
Copy link
Contributor

@chewi chewi commented Aug 13, 2025

This was broken by a035ee5, which accidentally constructed the IMDS URL with a double slash at the start of the path. This is not properly routed on the server side, leading to a 404 error with some very misleading XML.

<?xml version="1.0" encoding="utf-8"?>
<Error xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <Code>ResourceNotFound</Code>
    <Message>The specified resource does not exist.</Message>
    <Details>'' isn't a valid resource name.</Details>
</Error>

If I'm not mistaken, managed identities are completely broken right now, so I suggest getting this fix out soon.

Pull Request Checklist

  • C++ Guidelines
  • Doxygen docs - N/A
  • Unit tests - Maybe later?
  • No unwanted commits/changes
  • Descriptive title/description
    • PR is single purpose
    • Related issue listed - N/A
  • Comments in source - N/A
  • No typos
  • Update changelog
  • Not work-in-progress
  • External references or docs updated - N/A
  • Self review of PR done
  • Any breaking changes? - N/A

This was broken by a035ee5, which
accidentally constructed the IMDS URL with a double slash at the start
of the path. This is not properly routed on the server side, leading to
a 404 error with some very misleading XML.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Copilot AI review requested due to automatic review settings August 13, 2025 15:03
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes a critical bug in IMDS (Instance Metadata Service) token requests for managed identities that was introduced in a previous commit. The issue caused a double slash in the URL path, resulting in 404 errors and breaking managed identity authentication functionality.

  • Corrected the IMDS URL path by removing the leading slash to prevent double slash formation
  • Updated the changelog to document the bug fix

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
sdk/identity/azure-identity/src/managed_identity_source.cpp Fixed IMDS URL path construction by removing leading slash
sdk/identity/azure-identity/CHANGELOG.md Added changelog entry documenting the managed identity fix

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@github-actions github-actions bot added Azure.Identity Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. labels Aug 13, 2025
@github-actions
Copy link

Thank you for your contribution @chewi! We will review the pull request and get back to you soon.

@chewi
Copy link
Contributor Author

chewi commented Aug 13, 2025

#5187 suggests this shouldn't have been an issue and yet it was. Perhaps there's a gap in the logic? I imagine you'll want to accept this change anyway so that the URL is correct in the first place.

Copy link
Member

@antkmsft antkmsft left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you! Ah, it's the 3rd time or so as we trip over that double slash in URL. And it wouldn't show up when WinHTTP transport is used (WinHTTP is immune to https://url.com//path), which makes it harder to reproduce.

@github-project-automation github-project-automation bot moved this from Untriaged to In Progress in Azure Identity SDK Improvements Aug 14, 2025
@antkmsft antkmsft merged commit b33fb22 into Azure:main Aug 14, 2025
87 checks passed
@github-project-automation github-project-automation bot moved this from In Progress to Done in Azure Identity SDK Improvements Aug 14, 2025
@chewi chewi deleted the imds-double-slash branch August 14, 2025 08:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Azure.Identity Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization.

Projects

Development

Successfully merging this pull request may close these issues.

3 participants