Hi! I am using an azure ad group to control access to my key vault. I use az cli to add a member to the group I use azure.keyvault.secrets in Python SDK to check a keyvault secret. Access denied. I use az cli to chec secret. Access granted. After a long time (up to 1h), the sdk gives Access granted. I remove member from group. I use azure.keyvault.secrets in Python SDK to check a keyvault secret. Access granted. I use az cli to chec secret. Access denied. After a long time (up to 1h), the sdk gives Access denied. Is there any way to force-update, so that the sdk is in sync?

@Sofia Louisy Thank you for the detailed post! From your issue, I understand that whenever you're checking a Key Vault Secret using the Python SDK's azure.keyvault.secrets , you're seeing a delay when it comes to the propagation of Key Vault permissions for users within your Azure AD group. Since this sounds like it could be related to a delay in the Azure AD group membership refresh. You should be able to see if forcing an update / refresh of the token cache in your Python SDK, prior to retrieving the Secret helps to resolve your issue. For more info - DefaultAzureCredential get_token . If you're still having issues, can you share the documentation that you're following along with some more details: When you're checking the KV Secrets through the SDK, have you tried authenticating/re-authenticating each time or clearing your token cache? When removing the user from the Azure AD group, are you doing this through the Portal? I hope this helps! If you have any other questions, please let me know. Thank you for your time and patience throughout this issue. If the information helped address your question, please Accept the answer . This will help us and also improve searchability for others in the community who might be researching similar information.

azure python sdk Keyvault package not updating access

Accepted answer

JamesTran-MSFT 36,656 Reputation points Microsoft Employee

2023-05-17T20:30:26.39+00:00
@Sofia Louisy

Thank you for the detailed post!

From your issue, I understand that whenever you're checking a Key Vault Secret using the Python SDK's azure.keyvault.secrets , you're seeing a delay when it comes to the propagation of Key Vault permissions for users within your Azure AD group.

Since this sounds like it could be related to a delay in the Azure AD group membership refresh. You should be able to see if forcing an update / refresh of the token cache in your Python SDK, prior to retrieving the Secret helps to resolve your issue. For more info - DefaultAzureCredential get_token.

If you're still having issues, can you share the documentation that you're following along with some more details:

When you're checking the KV Secrets through the SDK, have you tried authenticating/re-authenticating each time or clearing your token cache?

When removing the user from the Azure AD group, are you doing this through the Portal?

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Please sign in to rate this answer.
JamesTran-MSFT 36,656 Reputation points Microsoft Employee

2023-05-18T18:05:51.9733333+00:00

@Sofia Louisy

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Sofia Louisy 40 Reputation points

2023-05-22T08:43:55.2566667+00:00

Hi, I apologize for the delay. There have been holidays in my country. I will hopefully have a chance to test your solution during this day!

Sofia Louisy 40 Reputation points

2023-05-22T11:50:28.7666667+00:00

Hi! This did not change the result for me. After 1 hour, the az cli call is responding as expected, but the sdk has not updated with the solution you provided

Sofia Louisy 40 Reputation points

2023-05-22T11:56:49.8166667+00:00

I would like to add that "az ad group member check" is updated very fast, but the keyvault secret request via the cli is not in sync until between 10 minutes and 1 hour, and the sdk I haven't seen syncing at all yet

JamesTran-MSFT 36,656 Reputation points Microsoft Employee

2023-05-22T19:18:15.47+00:00

@Sofia Louisy

Thank you for following up on this and for sharing your findings after testing my proposed solution!

I've reached out to our Key Vault team regarding your issue and will update here with their guidance on your issue as soon as possible.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue!

Jack Lichwa 11 Reputation points Microsoft Employee

2023-05-22T19:51:14.2566667+00:00

Security groups takes up to several hours to propagate. Since Key Vault itself has multiple instances, you may call experience that one call is success and next one is not. Usually access to Key Vault should not change often for apps (usually never change, one app per vault), for users, which should not access it often, we recommend just-in-time with PIM and delay for assignment is expected.

Sofia Louisy 40 Reputation points

2023-05-23T12:14:48.6466667+00:00

I see. I would like to present my origin problem which led to this problem, in case you are sitting with good knowledge about how to navigate my origin problem.

I need to be able to deploy my infrastructure as automated as possible. That is the task I have at hand. In the deployment process, I need to read a secret from the vault. I have a service principal, from which I can deploy MOST of my resources. This service principal can, via an ad group, have continuous access to the vault, so that is all good. What I cannot do with the service principal is to do an app registration with redirect url for my swa app. From what I understand, this app registration cannot be done with bicep, but can be done with e.g. the az cli. But, it seems to be impossible for a service principal to be able to perform actions on this ad level. Therefore, I figured that whoever does the deploy, can do it from its own user, with a temporary access to the key vault. But now, I see that that will not work because of this delay.

So, I am left with doing a mix between a service principal and a user to be able to do everything I need to do. That will be possible, and that will have to do.

Thank you for your help,

Sofia

JamesTran-MSFT 36,656 Reputation points Microsoft Employee

2023-05-24T21:16:30.8+00:00

@Sofia Louisy

Thank you for your detailed response on this!

Adding onto what was shared by Jack, you can also look into immediately acquiring new permissions by refreshing your local token.

The best way to do this is to create a new client, provide the original credential to this new client, and a new token will still be requested when you make a request. Automatically revoking user access immediately after permissions are changed upstream is possible in Azure via a feature called Continuous Access Evaluation (CAE), but this doesn't appear to be supported by Key Vault at the moment.

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

azure python sdk Keyvault package not updating access

0 additional answers

Your answer