{"id":"838ebabacdfe7b4e","repo":"mongodb/node-mongodb-native","slug":"azure-endpoint-did-not-return-a-value-with-only-ac","errorCode":null,"errorMessage":"Azure endpoint did not return a value with only access_token and expires_in properties","messagePattern":"Azure endpoint did not return a value with only access_token and expires_in properties","errorType":"exception","errorClass":"MongoAzureError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts","lineNumber":32,"sourceCode":"const TOKEN_RESOURCE_MISSING_ERROR =\n  'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.';\n\n/**\n * The callback function to be used in the automated callback workflow.\n * @param params - The OIDC callback parameters.\n * @returns The OIDC response.\n */\nexport const azureCallback: OIDCCallbackFunction = async (\n  params: OIDCCallbackParams\n): Promise<OIDCResponse> => {\n  const tokenAudience = params.tokenAudience;\n  const username = params.username;\n  if (!tokenAudience) {\n    throw new MongoAzureError(TOKEN_RESOURCE_MISSING_ERROR);\n  }\n  const response = await getAzureTokenData(tokenAudience, username);\n  if (!isEndpointResultValid(response)) {\n    throw new MongoAzureError(ENDPOINT_RESULT_ERROR);\n  }\n  return response;\n};\n\n/**\n * Hit the Azure endpoint to get the token data.\n */\nasync function getAzureTokenData(tokenAudience: string, username?: string): Promise<OIDCResponse> {\n  const url = new URL(AZURE_BASE_URL);\n  addAzureParams(url, tokenAudience, username);\n  const response = await get(url, {\n    headers: AZURE_HEADERS\n  });\n  if (response.status !== 200) {\n    throw new MongoAzureError(\n      `Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`\n    );\n  }","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts#L14-L50","documentation":"Thrown by the Azure machine workflow when the Azure IMDS endpoint returned a 200 response but the body did not validate as an OIDCResponse - i.e. it lacked an accessToken string and an expiresInSeconds number, or carried unexpected shape (src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:31). Note the validation actually checks the post-mapped fields accessToken/expiresInSeconds, so the message text mentioning access_token/expires_in refers to the raw Azure JSON fields that are expected to populate them. Surfaced as a MongoAzureError.","triggerScenarios":"Azure IMDS returned 200 but with a JSON body missing access_token or expires_in, or with non-string/non-number types, after which the driver's mapping failed validation. Also possible if a proxy returns a 200 page with an HTML error body or empty content.","commonSituations":"The managed identity is not assigned to the VM/VMSS so IMDS returns a 200 with an error payload, the identity does not have permission for the requested TOKEN_RESOURCE, or a corporate proxy intercepts and returns a captive-portal style 200 page.","solutions":["Verify the system-assigned or user-assigned managed identity is attached to the compute resource.","Confirm the managed identity has been granted access to the MongoDB-cluster audience (TOKEN_RESOURCE) in Azure.","Bypass/whitelist the Azure IMDS endpoint (169.254.169.254) from any HTTP proxy.","Capture the raw IMDS response (e.g. via curl) to confirm it returns access_token and expires_in fields."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoAzureError && /Azure endpoint did not return/.test(e.message)) {\n    // Verify managed identity attachment and audience; curl the IMDS endpoint to inspect the raw payload\n    throw new Error('Azure IMDS returned a malformed token response - check managed identity and audience.');\n  }\n  throw e;\n}","preventionTips":["Pre-flight: curl the Azure IMDS token endpoint with the same audience to confirm a valid response shape.","Attach a managed identity to the VM/VMSS before deploying.","Whitelist 169.254.169.254 from any HTTP proxy."],"tags":["auth","oidc","azure","managed-identity","iam"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}