Search code examples
node.jsazureelectronazure-ad-msalazure-identity

DefaultAzureCredential is not picking credential from the msal-node token cache

I am in the process of integrating the Entra ID to authenticate my Electron application, and to authroize the azure resources for the Service Principal.

Currently, the application is successfully authenticated with Entra ID using the msal-node library, as described in this article https://learn.microsoft.com/en-us/samples/azure-samples/ms-identity-ciam-javascript-tutorial/ms-identity-ciam-javascript-tutorial-3-sign-in-electron/.

However, when I try to access the CosmosDB and other resources with the DefaultAzureCredential, I am getting the following error.

enter image description here

Anything I am missing here?

Is there any other way to directly build the credential using the response, such as, tenent id, client id, authority, and accessToken, obtained from the authentication process?

Solution

  • To resolve the error, make sure to add below environment variables in your system:

    AZURE_CLIENT_ID - App ID of your service principal

    AZURE_TENANT_ID - Your Tenant ID

    AZURE_CLIENT_SECRET - Secret value of your service principal

    You can get values of AZURE_CLIENT_ID and AZURE_TENANT_ID from application's Overview page:

    enter image description here

    For AZURE_CLIENT_SECRET, you can create one client secret in your app registration and copy it's value that will be visible only once for few seconds:

    enter image description here

    Make sure to assign proper RBAC roles to the service principal under subscription to authorize the Azure resources.

    References:

    CredentialUnavailableError when using DefaultAzureCredential - Microsoft Q&A by Marilee Turscak-MSFT

    azure-sdk-for-js/sdk/identity/identity at main · Azure/azure-sdk-for-js · GitHub