[Bug] Connection issues with Workolad identity connection for combination of 13.2.1.jre8 Microsoft JDBC Driver For SQL Server , 1.55.2 azure-core, 1.15.3 azure-identity , msal4j-1.23.0

[bharath300]

Library version used

13.2.1.jre8 Microsoft JDBC Driver For SQL Server , 1.55.2 azure-core, 1.15.3 azure-identity , msal4j-1.23.0

Java version

jre8

Scenario

Other - please specify

Is this a new or an existing app?

None

Issue description and reproduction steps

We are migrating our SQL flyway application from managed identity based authentication to Workload identity. We upgraded all jars to the latest version but we were getting this exception.

Exception in thread "main" java.lang.NoSuchMethodError: 'com.microsoft.aad.msal4j.AbstractClientApplicationBase$Builder com.microsoft.aad.msal4j.ConfidentialClientApplication$Builder.instanceDiscovery(boolean)'
        at com.azure.identity.implementation.IdentityClientBase.getWorkloadIdentityConfidentialClient(IdentityClientBase.java:513)
        at com.azure.identity.implementation.IdentityClient.lambda$getWorkloadIdentityConfidentialClientApplication$7(IdentityClient.java:172)

Tried downgrading the MSAL4J and azure identity version but it did not work

Relevant code snippets

Expected behavior

Expected connection via workload identity to succeed.

Identity provider

Azure Active Directory Federation Services (ADFS)

Regression

No response

Solution and workarounds

No response

[Avery-Dunn]

It seems like azure-identity 1.15.3 has msal4j 1.19.0 as a dependency: https://mvnrepository.com/artifact/com.azure/azure-identity/1.15.3

I'm not sure why that particular mismatch would give a "NoSuchMethodError" (that method hasn't changed at all between those versions), but I've seen that error with version conflicts before.

Try one of these to avoid the mismatch:

1. If you need to use MSAL Java directly, upgrade to the latest azure-identity 1.18.1 which uses the latest msal4j 1.23.1
2. If you don't need to use MSAL Java directly, remove the explicit dependency reference and let azure-identity pull in the version it needs

[bharath300]

Tried with the both set of versions mentioned, still getting similar exceptions.

With below packages:
azure-core-1.55.2.jar
azure-core-http-netty-1.15.10.jar
azure-identity-1.15.3.jar
msal4j-1.19.0.jar
mssql-jdbc-13.2.1.jre8.jar

Exception:
Exception in thread "main" java.lang.NoSuchMethodError: 'com.microsoft.aad.msal4j.AbstractClientApplicationBase$Builder com.microsoft.aad.msal4j.ConfidentialClientApplication$Builder.instanceDiscovery(boolean)' at com.azure.identity.implementation.IdentityClientBase.getWorkloadIdentityConfidentialClient(IdentityClientBase.java:513) at com.azure.identity.implementation.IdentityClient.lambda$getWorkloadIdentityConfidentialClientApplication$7(IdentityClient.java:172) at reactor.core.publisher.MonoDefer.subscribe(MonoDefer.java:45) at reactor.core.publisher.MonoCacheTime.subscribeOrReturn(MonoCacheTime.java:143) at reactor.core.publisher.Mono.subscribe(Mono.java:4560) at reactor.core.publisher.FluxFlatMap$FlatMapMain.onNext(FluxFlatMap.java:430) at reactor.core.publisher.FluxIterable$IterableSubscription.slowPath(FluxIterable.java:335) at reactor.core.publisher.FluxIterable$IterableSubscription.request(FluxIterable.java:294) at reactor.core.publisher.FluxFlatMap$FlatMapMain.onSubscribe(FluxFlatMap.java:373) at reactor.core.publisher.FluxIterable.subscribe(FluxIterable.java:201) at reactor.core.publisher.FluxIterable.subscribe(FluxIterable.java:83) at reactor.core.publisher.Mono.subscribe(Mono.java:4576) at reactor.core.publisher.Mono.blockOptional(Mono.java:1830) at com.microsoft.sqlserver.jdbc.SQLServerSecurityUtility.getDefaultAzureCredAuthToken(SQLServerSecurityUtility.java:470) at com.microsoft.sqlserver.jdbc.SQLServerConnection.getFedAuthToken(SQLServerConnection.java:6670) at com.microsoft.sqlserver.jdbc.SQLServerConnection.onFedAuthInfo(SQLServerConnection.java:6482) at com.microsoft.sqlserver.jdbc.SQLServerConnection.processFedAuthInfo(SQLServerConnection.java:6316) at com.microsoft.sqlserver.jdbc.TDSTokenHandler.onFedAuthInfo(tdsparser.java:335) at com.microsoft.sqlserver.jdbc.TDSParser.parse(tdsparser.java:130) at com.microsoft.sqlserver.jdbc.TDSParser.parse(tdsparser.java:42) at com.microsoft.sqlserver.jdbc.SQLServerConnection.sendLogon(SQLServerConnection.java:7423) at com.microsoft.sqlserver.jdbc.SQLServerConnection.logon(SQLServerConnection.java:5921) at com.microsoft.sqlserver.jdbc.SQLServerConnection.access$300(SQLServerConnection.java:95) at com.microsoft.sqlserver.jdbc.SQLServerConnection$LogonCommand.doExecute(SQLServerConnection.java:5853) at com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:7825) at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:4828) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:4261) at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:3817) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:3591) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:2286) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1371) at org.flywaydb.core.internal.jdbc.DriverDataSource.getConnectionFromDriver(DriverDataSource.java:258) at org.flywaydb.core.internal.jdbc.DriverDataSource.getConnection(DriverDataSource.java:223) at org.flywaydb.core.internal.jdbc.JdbcUtils.openConnection(JdbcUtils.java:48) at org.flywaydb.core.internal.jdbc.JdbcConnectionFactory.<init>(JdbcConnectionFactory.java:74) at org.flywaydb.commandline.Main.main(Main.java:132)

Tried with the below jars as well
azure-core-1.55.2.jar
azure-core-http-netty-1.15.10.jar
azure-identity-1.18.1.jar
msal4j-1.23.1.jar
mssql-jdbc-13.2.1.jre8.jar

This also returned the below exception
Exception in thread "main" java.lang.NoSuchMethodError: 'com.microsoft.aad.msal4j.AbstractClientApplicationBase$Builder com.microsoft.aad.msal4j.ConfidentialClientApplication$Builder.instanceDiscovery(boolean)' at com.azure.identity.implementation.IdentityClientBase.getWorkloadIdentityConfidentialClient(IdentityClientBase.java:449) at com.azure.identity.implementation.IdentityClient.lambda$getWorkloadIdentityConfidentialClientApplication$9(IdentityClient.java:218)

[Avery-Dunn]

You've tried the different versions, but have you also tried removing the direct references to the overlapping dependencies?azure-identity-1.18.1 has dependencies on both msal4j and azure-core-http-netty: https://mvnrepository.com/artifact/com.azure/azure-identity/1.18.1

Other than that, if you're using Maven you can try running mvn dependency:tree -Dscope=runtime and dependency:tree -Dscope=compile to see the full dependency list of your project. Try to identify if there are different versions of msal4j or azure-identity used in each scope, and if there's any mismatch between the runtime and compile lists.

[bharath300]

@Avery-Dunn
Thanks for the quick response and suggestions.

I've tested both recommended combinations, but the NoSuchMethodError persists in both cases (full stack traces in earlier comments).

To follow your advice on avoiding explicit/overlapping deps:

• I'm now using only azure-identity 1.18.1 + its exact transitive dependencies (no separate msal4j.jar or overrides):
  • azure-identity-1.18.1.jar
  • azure-core-1.57.0.jar
  • azure-core-http-netty-1.16.2.jar
  • azure-json-1.5.0.jar
  • reactive-streams-1.0.4.jar
  • reactor-core-3.7.11.jar
  • reactor-netty-core-1.2.10.jar
  • mssql-jdbc-13.2.1.jre8.jar

The error remains identical when the chain reaches WorkloadIdentityCredential.

Since this is Flyway commandline (not a Maven build), I can't run mvn dependency:tree. Flyway loads all JARs flat from its /drivers directory, which likely causes classloader/shading conflicts with azure-identity's bundled msal4j — even with perfectly matching versions.

Workload identity injection itself is confirmed working (AZURE_FEDERATED_TOKEN_FILE exists and contains a valid token for https://database.windows.net/.default).

Is this a known issue with flat classpaths, or is there an azure-identity version that doesn't shade/relocate msal4j? Any recommended workaround for non-Maven environments like Flyway?