{"record":{"id":"a1aca1aa5703abeb","repo":"argoproj/argo-workflows","slug":"failed-to-get-token-w","errorCode":null,"errorMessage":"failed to get token: %w","messagePattern":"failed to get token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/sqldb/azure_auth.go","lineNumber":27,"sourceCode":"\t\"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy\"\n\t\"github.com/Azure/azure-sdk-for-go/sdk/azidentity\"\n\t\"github.com/lib/pq\"\n)\n\ntype azureConnector struct {\n\tdsn   string\n\tscope string\n}\n\nfunc (c *azureConnector) Connect(ctx context.Context) (driver.Conn, error) {\n\tcred, err := azidentity.NewDefaultAzureCredential(nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to obtain a credential: %w\", err)\n\t}\n\n\ttoken, err := cred.GetToken(ctx, policy.TokenRequestOptions{Scopes: []string{c.scope}})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get token: %w\", err)\n\t}\n\n\t// Escape single quotes in token just in case\n\tescapedToken := strings.ReplaceAll(token.Token, \"'\", \"\\\\'\")\n\n\t// Append password to DSN\n\tdsnWithPassword := fmt.Sprintf(\"%s password='%s'\", c.dsn, escapedToken)\n\n\treturn pq.Driver{}.Open(dsnWithPassword)\n}\n\nfunc (c *azureConnector) Driver() driver.Driver {\n\treturn pq.Driver{}\n}\n","sourceCodeStart":9,"sourceCodeEnd":42,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/sqldb/azure_auth.go#L9-L42","documentation":"After constructing an azidentity credential, azureConnector.Connect requests an access token via cred.GetToken for the configured scope (e.g. https://ossrdbms-aad.database.windows.net/.default). If the token request fails (auth endpoint error, bad credentials, network, expired federated token), Connect wraps it with \"failed to get token\". Unlike error 352, a credential object existed but using it failed.","triggerScenarios":"cred.GetToken returns an error when the credential cannot authenticate against Microsoft Entra ID: invalid client secret/certificate, workload identity federated token expired or file unreadable, managed identity unavailable on the host, MSAL/authority endpoint unreachable, or scope string is invalid.","commonSituations":"Federated identity credential deleted or name mismatched in Azure; AAD role not granted to the Postgres user so token issuance for the DB scope is denied; corporate proxy blocking login.microsoftonline.com; AZURE_AUTHORITY_HOST pointing to a sovereign cloud while resources are elsewhere.","solutions":["Verify the credential's identity is valid: check client secret/cert expiry, or re-sync the federated identity credential in Azure.","Confirm the configured scope matches the target service (for Azure Database for PostgreSQL it is https://ossrdbms-aad.database.windows.net/.default).","Ensure network egress to the authority endpoint (login.microsoftonline.com or the configured AZURE_AUTHORITY_HOST) from the pod.","Grant the managed/workload identity access to the database (CREATE USER ... FROM EXTERNAL PROVIDER) so the DB accepts the token.","Inspect the wrapped azidentity error for HTTP status/MSAL detail (invalid_client, unauthorized_client, network timeout)."],"exampleFix":"// before: scope mismatch\nscope: \"https://database.windows.net/.default\"\n// after\nscope: \"https://ossrdbms-aad.database.windows.net/.default\"","handlingStrategy":"retry","validationCode":"if !strings.HasSuffix(scope, \"/.default\") {\n    return fmt.Errorf(\"scope %q should end in /.default for DB tokens\", scope)\n}","typeGuard":null,"tryCatchPattern":"var tok policy acquireErr\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to get token\") {\n        // transient network failures are retryable; invalid_client is not\n        if strings.Contains(err.Error(), \"invalid_client\") {\n            log.Fatal(err)\n        }\n        backoff.Retry(func() error { return connectAzure(ctx) }, strategy)\n    }\n}","preventionTips":["Verify the AAD identity has a matching user in the Postgres server (CREATE USER ... FROM EXTERNAL PROVIDER).","Rotate secrets/certs before expiry and monitor federated token file freshness.","Allow egress to login.microsoftonline.com from workload subnets.","Pin the scope per service; for PostgreSQL use https://ossrdbms-aad.database.windows.net/.default."],"tags":["azure","entra-id","authentication","token"],"backgroundTag":"azure-token-request-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}