title: Not able to connect to Azure Key Vault when using Service Identity
body: <p>I am trying to retrieve secrets from Azure Key Vault using Service Identity in an ASPNet 4.6.2 web application.  I am using the code as outlined in this <a href="https://azure.microsoft.com/en-us/resources/samples/app-service-msi-keyvault-dotnet/" rel="noreferrer">article</a>. Locally, things are working fine, though this is because it is using my identity.  When I deploy the application to Azure I get an exception when <code>keyVaultClient.GetSecretAsync(keyUrl)</code> is called.</p>
  
  <p>As best as I can tell everything is configured correctly.  I created a User assigned identity so it could be reused and made sure that identity had <em>get</em> access to secrets and keys in the KeyVault policy.</p>
  
  <p>The exception is an <code>AzureServiceTokenProviderException</code>.  It is verbose and outlines how it tried four methods to authenticate.  The information I'm concerned about is when it tries to use Managed Service Identity:</p>
  
  <blockquote>
    <p>Tried to get token using Managed Service Identity. Access token could
    not be acquired. MSI ResponseCode: BadRequest, Response:</p>
  </blockquote>
  
  <p>I checked application insights and saw that it tried to make the following connection with a 400 result error:  </p>
  
  <pre><code>http://127.0.0.1:41340/MSI/token/?resource=https://vault.azure.net&amp;api-version=2017-09-01
  </code></pre>
  
  <p>There are two things interesting about this:</p>
  
  <ol>
  <li>Why is it trying to connect to a localhost address?  This seems wrong.</li>
  <li>Could this be getting a 400 back because the resource parameter isn't escaped?</li>
  <li>In the MsiAccessTokenProvider <a href="https://github.com/Azure/azure-sdk-for-net/blob/40248f466aa063bd90f16dae10d06b9b7317e2d0/src/SdkCommon/AppAuthentication/Azure.Services.AppAuthentication/TokenProviders/MsiAccessTokenProvider.cs" rel="noreferrer">source</a>, it only uses that form of an address when the environment variables MSI_ENDPOINT and MSI_SECRET are set.  They are not set in application settings, but I can see them in the debug console when I output environment variables.  </li>
  </ol>
  
  <p>At this point I don't know what to do.  The examples online all make it seem like magic, but if I'm right about the source of the problem then there's some obscure automated setting that needs fixing.</p>
  
  <p>For completeness here is all of my relevant code:</p>
  
  <pre><code>public class ServiceIdentityKeyVaultUtil : IDisposable
  {
      private readonly AzureServiceTokenProvider azureServiceTokenProvider;
      private readonly Uri baseSecretsUri;
      private readonly KeyVaultClient keyVaultClient;
  
  
      public ServiceIdentityKeyVaultUtil(string baseKeyVaultUrl)
      {
          baseSecretsUri = new Uri(new Uri(baseKeyVaultUrl, UriKind.Absolute), "secrets/");
          azureServiceTokenProvider = new AzureServiceTokenProvider();
          keyVaultClient = new KeyVaultClient(
              new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
      }
  
      public async Task&lt;string&gt; GetSecretAsync(string key, CancellationToken cancellationToken = new CancellationToken())
      {
          var keyUrl = new Uri(baseSecretsUri, key).ToString();
          try
          {
              var secret = await keyVaultClient.GetSecretAsync(keyUrl, cancellationToken);
              return secret.Value;
          }
          catch (Exception ex)
          {
              /** rethrows error with extra details */
          }
      }
  
      /** IDisposable support */
  }
  </code></pre>
  
  <p><strong>UPDATE #2</strong> <em>(I erased update #1)</em></p>
  
  <p>I created a completely new app or a new service instance and was able to recreate the error.  <em>However</em>, in all instances I was using a <strong>User Assigned Identity</strong>.  If I remove that and use a <strong>System Assigned Identity</strong> then it works just fine.</p>
  
  <p>I don't know why these would be any different.  Anybody have an insight as I would prefer the user assigned one.</p>