API is able to call downstream APIs on localhost but not APP service due to "SharedTokenCacheCredential authentication failed"

Question

https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-web-api-call-api-overview

Configured an existing .NET6 API using the guide above to talk to a downstream API. My API can authenticate itself by obtaining a JWT bearer token using Azure Key Vaults.

This works fine on localhost but once my API is published to an app service it will return status 500 with the message "SharedTokenCacheCredential authentication failed: Persistence check failed. Inspect inner exception for details"

Answer 1

This has been fixed by adding

WEBSITE_LOAD_USER_PROFILE = 1

to the app service Environment Variables.

Answer 2

Hi @Jack Kerr ,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to "Accept" the answer.

Issue: Getting error '500: "SharedTokenCacheCredential authentication failed: Persistence check failed. Inspect inner exception for details" while published API to an app service.

Solution: Adding WEBSITE_LOAD_USER_PROFILE = 1 to the app service Environment Variables resolve the issue.

To add more to this, the error message you are encountering is related to the token cache implementation. The token cache is not working as expected when your API is published to an app service.

When your application is running on localhost, it is likely that the authentication token cache is being stored in memory. However, when your API is published to an Azure App Service, the cache needs to be persisted to a shared location so that it can be accessed by all instances of the application.

Setting WEBSITE_LOAD_USER_PROFILE to 1 is a workaround that can be used to resolve some issues related to loading user profiles when running applications in IIS to load a user profile for the application pool identity.

Keep in mind, this is only a workaround and not the recommended solution.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept the Answer" if the answer accurately represents the resolution, so that others in the community facing similar issues can easily find the solution.