ManagedIdentityCredential authentication failed: Adding the specified count to the semaphore would cause it to exceed its maximum count

Question

I use the following code to obtain the access token from Azure

var credentialsProvider = new DefaultAzureCredential(
       new DefaultAzureCredentialOptions{ ManagedIdentityClientId = "XYZ" });

var accessToken = await credentialsProvider.GetTokenAsync(new TokenRequestContext(_scopes), cancellationToken);

From time to time, it throws exception

ManagedIdentityCredential authentication failed: Adding the specified count to the semaphore would cause it to exceed its maximum count. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot  Azure.Identity.AuthenticationFailedException: ManagedIdentityCredential authentication failed: Adding the specified count to the semaphore would cause it to exceed its maximum count. See the troubleshooting guide for more information. https://aka.ms/azsdk/net/identity/managedidentitycredential/troubleshoot   ---> System.Threading.SemaphoreFullException: Adding the specified count to the semaphore would cause it to exceed its maximum count.    
   at System.Threading.SemaphoreSlim.Release(Int32 releaseCount)    
   at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.GetAccessTokenAsync(CancellationToken cancellationToken, ILoggerAdapter logger)    
   at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.ExecuteAsync(CancellationToken cancellationToken)    
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)    
   at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenForClientParameters clientParameters, CancellationToken cancellationToken)    
   at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.ExecuteAsync[T](AbstractAcquireTokenParameterBuilder`1 builder, Boolean async, CancellationToken cancellationToken)    
   at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientCoreAsync(String[] scopes, String tenantId, Boolean enableCae, Boolean async, CancellationToken cancellationToken)    
   at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientAsync(String[] scopes, String tenantId, Boolean enableCae, Boolean async, CancellationToken cancellationToken)    
   at Azure.Identity.ManagedIdentityClient.AuthenticateAsync(Boolean async, TokenRequestContext context, CancellationToken cancellationToken)    
   at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)     
   --- End of inner exception stack trace ---    
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)    
   at Azure.Identity.ManagedIdentityCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)    
   at Azure.Identity.ManagedIdentityCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)    
   at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)    
   at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)    
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)    
   at Azure.Identity.DefaultAzureCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)    
   at Azure.Identity.DefaultAzureCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)    

I suspected that it is connected to the heavy load or some leak. I tried to reproduce it by calling this method 10k times one by one, I was not able to do that. Also, I tried to do this in multiple threads at the same time, can't reproduce it neither.

Any ideas?

Answer 1

Answered on Azure.SDK github.

https://github.com/Azure/azure-sdk-for-net/issues/42592

Copying the response:

The issue that you're reporting is with the MSAL dependency used by Azure.Identity and tracked by #4472. The comment there indicates that this was recently resolved with MSAL v4.59.0, which we'll need to pull in as a dependency update.

To mitigate the error in your application in the meantime, you can take a direct dependency on Microsoft.Identity.Client.Extensions.Msal v4.59.0, which will hoist the version used.