mongodb/node-mongodb-native · error · MongoAzureError

Azure endpoint did not return a value with only access_token

Error message

Azure endpoint did not return a value with only access_token and expires_in properties

What it means

Thrown by the Azure machine workflow when the Azure IMDS endpoint returned a 200 response but the body did not validate as an OIDCResponse - i.e. it lacked an accessToken string and an expiresInSeconds number, or carried unexpected shape (src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:31). Note the validation actually checks the post-mapped fields accessToken/expiresInSeconds, so the message text mentioning access_token/expires_in refers to the raw Azure JSON fields that are expected to populate them. Surfaced as a MongoAzureError.

Source

Thrown at src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:32

const TOKEN_RESOURCE_MISSING_ERROR =
  'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.';

/**
 * The callback function to be used in the automated callback workflow.
 * @param params - The OIDC callback parameters.
 * @returns The OIDC response.
 */
export const azureCallback: OIDCCallbackFunction = async (
  params: OIDCCallbackParams
): Promise<OIDCResponse> => {
  const tokenAudience = params.tokenAudience;
  const username = params.username;
  if (!tokenAudience) {
    throw new MongoAzureError(TOKEN_RESOURCE_MISSING_ERROR);
  }
  const response = await getAzureTokenData(tokenAudience, username);
  if (!isEndpointResultValid(response)) {
    throw new MongoAzureError(ENDPOINT_RESULT_ERROR);
  }
  return response;
};

/**
 * Hit the Azure endpoint to get the token data.
 */
async function getAzureTokenData(tokenAudience: string, username?: string): Promise<OIDCResponse> {
  const url = new URL(AZURE_BASE_URL);
  addAzureParams(url, tokenAudience, username);
  const response = await get(url, {
    headers: AZURE_HEADERS
  });
  if (response.status !== 200) {
    throw new MongoAzureError(
      `Status code ${response.status} returned from the Azure endpoint. Response body: ${response.body}`
    );
  }

View on GitHub (pinned to 3366c21a63)

Solutions

1. Verify the system-assigned or user-assigned managed identity is attached to the compute resource.
2. Confirm the managed identity has been granted access to the MongoDB-cluster audience (TOKEN_RESOURCE) in Azure.
3. Bypass/whitelist the Azure IMDS endpoint (169.254.169.254) from any HTTP proxy.
4. Capture the raw IMDS response (e.g. via curl) to confirm it returns access_token and expires_in fields.

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoAzureError && /Azure endpoint did not return/.test(e.message)) {
    // Verify managed identity attachment and audience; curl the IMDS endpoint to inspect the raw payload
    throw new Error('Azure IMDS returned a malformed token response - check managed identity and audience.');
  }
  throw e;
}

When it happens

Trigger: Azure IMDS returned 200 but with a JSON body missing access_token or expires_in, or with non-string/non-number types, after which the driver's mapping failed validation. Also possible if a proxy returns a 200 page with an HTML error body or empty content.

Common situations: The managed identity is not assigned to the VM/VMSS so IMDS returns a 200 with an error payload, the identity does not have permission for the requested TOKEN_RESOURCE, or a corporate proxy intercepts and returns a captive-portal style 200 page.

Related errors

• Status code ${response.status} returned from the Azure endpo
• TOKEN_RESOURCE must be set in the auth mechanism properties
• OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.
• TOKEN_RESOURCE must be set in the auth mechanism properties
• username and ENVIRONMENT '${this.mechanismProperties.ENVIRON

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/838ebabacdfe7b4e.json. Report an issue: GitHub.