AZIdentity/ADAL: Increased Token Request Failures Due to HTTP2 Enablement on Microsoft Entra ID Token Endpoints

[bcho]

Bug Report

Following the enablement of HTTP2 on Microsoft Entra ID token endpoints (e.g., login.microsoftonline.com) in January 2024, we have observed an uptick in token request failures. This issue parallels the problem described in #21346, attributed to a known issue with the Go HTTP2 client (see Go Issue #59690). Despite updates to the azidentity transport that introduced HTTP 2 ping frame health checks to mitigate connection staleness, the detection window still permits the initiation of new requests over potentially faulty connections. Consequently, clients issuing token requests at frequent intervals may experience increased failures, primarily timeouts, as connections enter a stale or "zombie" state.

The AKS team has verified with the Microsoft Entra ID gateway team that HTTP2 was enabled starting January 2024, though support for HTTP/1.1 remains available.

Potential Workarounds and Mitigations:

1. Adjusting Ping Frame Health Check Intervals:

AzIdentity has a proper value set, if you are using legacy ADAL SDK, you should either migrate or set proper value. But like mentioned before, this interval cannot fully stop the error due to the Go HTTP2 client implementation.

2. Disabling HTTP2 in Client Transport:

To avoid these issues, clients can opt to disable HTTP2 entirely by following the guide provided in Go Issue #39302.

Note: These workarounds are suggested as interim solutions and should be implemented with caution.

---

• import path of package in question, e.g. .../services/compute/mgmt/2018-06-01/compute

azidentity and ADAL

• SDK version e.g. master, latest, 18.1.0

All versions since this applies to HTTP2 enabled client.

• Specify the exact commit if possible; one way to get this is the REVISION
  column output by go list -m <module>, for example go list -m github.com/Azure/azure-sdk-for-go/sdk/azcore.
• output of go version

Every go version if it's using newer version of x/net/http2.

[bcho]

NOTE to maintainers: free feel to close this issue as it's advisory only. The internal ticket id for this issue is 470672737.