{"record":{"id":"7efa1fad4ee70351","repo":"wtfutil/wtf","slug":"failed-to-initialize-azure-authentication-w","errorCode":null,"errorMessage":"failed to initialize Azure authentication: %w","messagePattern":"failed to initialize Azure authentication: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/azurelogs/session.go","lineNumber":24,"sourceCode":"\t\"github.com/Azure/azure-sdk-for-go/sdk/azidentity\"\n\t\"github.com/Azure/azure-sdk-for-go/sdk/monitor/azquery\"\n\t\"os\"\n)\n\nconst (\n\tenvAzureClientID     = \"AZURE_CLIENT_ID\"\n\tenvAzureClientSecret = \"AZURE_CLIENT_SECRET\"\n\tenvAzureTenantID     = \"AZURE_TENANT_ID\"\n)\n\n// Init initializes a new Azure session with the specified query file\nfunc Init(queryPath *string) (*Session, error) {\n\tsess := &Session{}\n\tsess.Azure = &AZSession{}\n\n\t// Initialize Azure authentication using modern non-deprecated libraries\n\tif err := InitializeAzureAuthentication(sess); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to initialize Azure authentication: %w\", err)\n\t}\n\n\terr := readQueryFile(sess, *queryPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read query file %s: %w\", *queryPath, err)\n\t}\n\n\treturn sess, nil\n}\n\n// Session holds the configuration and state for an Azure Log Analytics session\ntype Session struct {\n\tApp struct {\n\t\tSemVer string\n\t}\n\n\tAzure       *AZSession\n\tQueriesPath string","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/wtfutil/wtf/blob/bb838c1ccb0f0f3223690df44afdec663d622881/modules/azurelogs/session.go#L6-L42","documentation":"Init in modules/azurelogs/session.go:24 wraps any error from InitializeAzureAuthentication with this message. The Azure SDK's credential chain (DefaultAzureCredential or equivalent) failed to produce usable credentials, so no session can be built. The wrapped error carries the specific cause.","triggerScenarios":"Calling Init with a valid query path but no usable Azure credential: az CLI not installed/logged in, AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET unset or wrong, managed identity unavailable, or an invalid AZURE_AUTHORITY_HOST.","commonSituations":"Running locally for the first time without `az login`, CI pipelines missing secret env vars, service principal secret expired or client ID deleted, or running outside Azure where a managed identity was assumed.","solutions":["Run `az login` locally (or `az login --service-principal` with valid credentials)","Set AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET env vars for service-principal auth","Check the wrapped error for which credential in the chain failed and fix that source","For Azure-hosted workloads, verify the managed identity is enabled and has permissions","Rotate expired service-principal secrets/certificates"],"exampleFix":"// before: docker run azurelogs-app  (no credentials mounted)\n// after\n// shell: az login\n// shell: docker run -e AZURE_TENANT_ID=... -e AZURE_CLIENT_ID=... -e AZURE_CLIENT_SECRET=... azurelogs-app","handlingStrategy":"try-catch","validationCode":"cred, err := azidentity.NewDefaultAzureCredential(nil)\nif err != nil {\n    return fmt.Errorf(\"no Azure credential chain available (run az login or set AZURE_* env vars): %w\", err)\n}","typeGuard":null,"tryCatchPattern":"sess, err := azurelogs.Init(&queryPath)\nif err != nil {\n    var ae *azidentity.AuthenticationFailedError\n    if errors.As(err, &ae) || strings.Contains(err.Error(), \"initialize Azure authentication\") {\n        return fmt.Errorf(\"auth failed: run 'az login' or set AZURE_TENANT_ID/AZURE_CLIENT_ID/AZURE_CLIENT_SECRET: %w\", err)\n    }\n    return err\n}","preventionTips":["Run `az login` before local runs; document it in onboarding/README","Inject AZURE_* env vars via secret management in CI, never hardcode","Alert on service-principal secret expiry well before the deadline","Health-check credentials at startup with a lightweight token request"],"tags":["azure","authentication","credentials","session-init"],"backgroundTag":"azure-credential-error","analyzedSha":"bb838c1ccb0f0f3223690df44afdec663d622881","analyzedAt":"2026-09-03T17:02:45.030Z","contentChangedAt":"2026-09-03T17:02:45.030Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}