{"action":"opened","issue":{"url":"https://api.github.com/repos/Azure/autorest/issues/1389","repository_url":"https://api.github.com/repos/Azure/autorest","labels_url":"https://api.github.com/repos/Azure/autorest/issues/1389/labels{/name}","comments_url":"https://api.github.com/repos/Azure/autorest/issues/1389/comments","events_url":"https://api.github.com/repos/Azure/autorest/issues/1389/events","html_url":"https://github.com/Azure/autorest/issues/1389","id":174322611,"number":1389,"title":"[C#] Unable to use ApplicationTokenProvider.LoginSilentAsync to generate tokens for Azure KeyVault","user":{"login":"anthonyphelps","id":21350330,"avatar_url":"https://avatars.githubusercontent.com/u/21350330?v=3","gravatar_id":"","url":"https://api.github.com/users/anthonyphelps","html_url":"https://github.com/anthonyphelps","followers_url":"https://api.github.com/users/anthonyphelps/followers","following_url":"https://api.github.com/users/anthonyphelps/following{/other_user}","gists_url":"https://api.github.com/users/anthonyphelps/gists{/gist_id}","starred_url":"https://api.github.com/users/anthonyphelps/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anthonyphelps/subscriptions","organizations_url":"https://api.github.com/users/anthonyphelps/orgs","repos_url":"https://api.github.com/users/anthonyphelps/repos","events_url":"https://api.github.com/users/anthonyphelps/events{/privacy}","received_events_url":"https://api.github.com/users/anthonyphelps/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-31T16:44:54Z","updated_at":"2016-08-31T16:44:54Z","closed_at":null,"body":"I have determined the parameters that I should be using by making an unauthenticated request to my vault:\r\n\r\n`curl -i https://mycompany.vault.azure.net/keys?api-version=2015-06-01`\r\n\r\nWhich returns the relevant header:\r\n\r\n`WWW-Authenticate: Bearer authorization=\"https://login.windows.net/<mytenantidguid>\", resource=\"https://vault.azure.net\"`\r\n\r\nSo I attempted the following:\r\n\r\n```c#\r\nActiveDirectoryServiceSettings vaultSettings = new ActiveDirectoryServiceSettings()\r\n{\r\n    AuthenticationEndpoint = ActiveDirectoryServiceSettings.Azure.AuthenticationEndpoint,\r\n    TokenAudience = new Uri(\"https://vault.azure.net\", UriKind.Absolute),\r\n    ValidateAuthority = ActiveDirectoryServiceSettings.Azure.ValidateAuthority\r\n};\r\n\r\nvar creds = ApplicationTokenProvider.LoginSilentAsync(mytenantidguid, new ClientCredential(clientID, clientSecret), vaultSettings);\r\n\r\nusing (KeyVaultClient client = new KeyVaultClient(creds))\r\n{\r\n    var result = await client.GetKeysAsync(\"https://mycompany.vault.azure.net/\");\r\n}\r\n```\r\n\r\nThis will throw Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'Unauthorized'\r\n\r\nI came across issue #835 and tried the code there (using AuthenticationContext.AcquireToken directly) with the same parameters and was able to generate a token that works. When I cloned autorest and stepped through ApplicationTokenProvider I discovered this line in LoginSilentAsync:\r\n\r\n`var audience = settings.TokenAudience.ToString();`\r\n\r\nI had created my Uri with `\"https://vault.azure.net\"` but Uri.ToString() was returning `\"https://vault.azure.net/\"` and that value is used to acquire the token, which the vault API refuses to accept because the audience does not match exactly what it is expecting."}}
{"actor":{"display_login":"anthonyphelps"}}