[QUERY] KeyVaultCredentialPolicy Makes Extras Requests

[lfgcampos]

Query/Question
I am not really sure if this is a Question, Bug or Feature.

Whle working recently with Azure (specifically Azure Key Vault product), we noticed that we always get double requests when we want to get or set a given Secret adding a lot to the latency of the requests. Half of them are 401 responses while the other half is 200.

That seemed to be a quite strange behaviour and we decided to go deeper into it.
Turned out, this behaviour is on the KeyVaultCredentialPolicy which always makes an extra request. Checking code, I can see some comments about challenge based auth. This Policy (and several others) are automatically included when you build a SecretClient and there is no easy way to add/remove the policies I want.

With all that info, I would like to understand the benefits of having the "challenge based auth" and if we can avoid it by our own risk.

I managed to configure my own pipeline overriding it and providing only a BearerTokenAuthenticationPolicy. The main problem I could see is that I have to provide a hard-coded scope (https://vault.azure.net/.default in my case) while the KeyVaultCredentialPolicy extract it from the header (www-authenticate) of the first response. The other downside is that I loose all the other Policies configured before, for example UserAgentPolicy and RetryPolicy.

ex:

// Azure SDK client builders accept the credential as a parameter
return SecretClientBuilder()
    .pipeline(
        HttpPipelineBuilder()
            .policies(
                BearerTokenAuthenticationPolicy(
                    principal,
                    "https://vault.azure.net/.default"
                )
            )
            .httpClient(httpClient)
            .build()
    )
    .httpClient(httpClient) // httpclient 2
    .vaultUrl(vaultUrl)
    .credential(principal)
    .buildClient()

Why is this not a Bug or a feature Request?
I am not sure if this is a Bug, Feature Request or by design, hence I think this is primarily a question.

[alzimmermsft]

@vcolin7 could you look into this

[vcolin7]

Hi @lfgcampos, your assessment is correct, the KeyVaultCredentialPolicy does in fact make more requests than necessary. I created an issue to track this a while back and had not had the chance to work on it, but I believe I will be able to do so soon and will most likely include this in our next release of the Key Vault libraries. I will let you know once that fix is in so you don't have to manually create your own pipeline.

[lfgcampos]

Hi @vcolin7, thank you very much for confirming it and we are looking forward to that.