Redis Entra Id connection stops working after 24hours

Question

Redis Entra Id connection stops working after 24hours

Arun Babu 20

We started using Entra Id authentication to Redis with the dapr version 1.15.5. We are able to establish the connection from the AKS pod to Redis using the managed identity used by the pod.

Actual Behavior

However, after running for about 24hours the pod is failing to connect Redis with the error 'State operation failed: the Dapr endpoint indicated a failure. See InnerException for details. Status(StatusCode="Internal", Detail="fail to get PComSearchCacheProduct from state store statestore: ERR WRONGPASS invalid username-password pair") '.. Please let me know how to fix this

Mahesh Kurva 7,570 Reputation points Microsoft External Staff Moderator

2025-07-07T20:17:53.03+00:00
Hi Arun Babu,

Greetings!!The error you're encountering after ~24 h:

ours — ERR WRONGPASS invalid username-password pair strongly suggests that the managed identity token being used to authenticate to Azure Cache for Redis via Entra ID has expired and is not being refreshed properly by your Dapr-enabled service.

Here are some steps you can take to resolve the issue:

Dapr should automatically refresh tokens when using managed identities. However, verify that your configuration allows for token refresh.

If possible, try upgrading to a newer version of Dapr. There may be bug fixes or improvements related to token management in versions after 1.15.5.

As a temporary workaround, restarting the pod before the token expires (e.g., every 23 hours) can help avoid the issue.

Ensure that Redis is correctly configured to accept Entra ID tokens and that there are no caching issues or stale credentials.

Please refer the below documents, it might help you:

https://github.com/dapr/components-contrib/issues/3088

https://stackoverflow.com/questions/78869325/authenticating-azure-redis-cache-with-user-assigned-managed-identity-in-net-8-a

https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication#configure-your-redis-client-to-use-microsoft-entra-id

I hope this information helps. Please do let us know if you have any further queries.
Mahesh Kurva 7,570 Reputation points Microsoft External Staff Moderator

2025-07-08T19:53:00.2366667+00:00

Hi Arun Babu,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Arun Babu 20 Reputation points

2025-07-09T14:19:12.2533333+00:00

Hi Mahesh, Thanks for responding. In the documentation you provided, somewhere I have seen they are disabling the access keys and using Entra Id, do you think it works for authentication. How do we do this automated? do we have to manually go to portal and disable there?
Arun Babu 20 Reputation points

2025-07-09T14:28:28.1433333+00:00

For these 2 steps

Dapr should automatically refresh tokens when using managed identities. However, verify that your configuration allows for token refresh. ----- How do we configure this? Any documentation you can provide to follow?

If possible, try upgrading to a newer version of Dapr. There may be bug fixes or improvements related to token management in versions after 1.15.5. ---- Are you saying here, change it to the latest version. Could you tell me which version has the fixes?
Mahesh Kurva 7,570 Reputation points Microsoft External Staff Moderator

2025-07-10T01:35:02.3466667+00:00

Hi Arun Babu,

Sorry for delay in response.

This issue appears to be related to Dapr, where it fails to refresh the Entra ID authentication token used for connecting to Azure Cache for Redis. When the token expires (usually after 24 hours), the connection breaks, resulting in the ERR WRONGPASS error.

we recommend opening an issue directly with the Dapr team for further investigation.

You can also refer to the following known issue for more context:

https://github.com/dapr/components-contrib/issues/3554

I hope this has been helpful! Please do let us know if you have any further queries.
Arun Babu 20 Reputation points

2025-07-10T16:47:08.81+00:00

Yes, I have seen that closed issue but there was no fix for that thread. What we are currently doing is to refresh the pod every 23 hours+some more minutes. But how do we do this automated?
Arun Babu 20 Reputation points

2025-07-10T16:48:01.74+00:00

Can you help me with any script or where to add this? Is it in my helm.yaml file inside the sidecar containers?
Yaron Schneider 0 Reputation points

2025-07-10T21:24:59.89+00:00

Hi Arun, I'm a Dapr core maintainer and would like to help you with this. Can you DM me on the Dapr Discord server? My handle is yaron2

Accepted answer

0 additional answers

Your answer

Mahesh Kurva 7,570 Reputation points Microsoft External Staff Moderator

2025-07-07T20:17:53.03+00:00

Hi Arun Babu,

Greetings!!The error you're encountering after ~24 h:

ours — ERR WRONGPASS invalid username-password pair strongly suggests that the managed identity token being used to authenticate to Azure Cache for Redis via Entra ID has expired and is not being refreshed properly by your Dapr-enabled service.

Here are some steps you can take to resolve the issue:

Dapr should automatically refresh tokens when using managed identities. However, verify that your configuration allows for token refresh.

If possible, try upgrading to a newer version of Dapr. There may be bug fixes or improvements related to token management in versions after 1.15.5.

As a temporary workaround, restarting the pod before the token expires (e.g., every 23 hours) can help avoid the issue.

Ensure that Redis is correctly configured to accept Entra ID tokens and that there are no caching issues or stale credentials.

Please refer the below documents, it might help you:

https://github.com/dapr/components-contrib/issues/3088

https://stackoverflow.com/questions/78869325/authenticating-azure-redis-cache-with-user-assigned-managed-identity-in-net-8-a

https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication#configure-your-redis-client-to-use-microsoft-entra-id

I hope this information helps. Please do let us know if you have any further queries.
Mahesh Kurva 7,570 Reputation points Microsoft External Staff Moderator

2025-07-08T19:53:00.2366667+00:00

Hi Arun Babu,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Arun Babu 20 Reputation points

2025-07-09T14:19:12.2533333+00:00

Hi Mahesh, Thanks for responding. In the documentation you provided, somewhere I have seen they are disabling the access keys and using Entra Id, do you think it works for authentication. How do we do this automated? do we have to manually go to portal and disable there?
Arun Babu 20 Reputation points

2025-07-09T14:28:28.1433333+00:00

For these 2 steps

Dapr should automatically refresh tokens when using managed identities. However, verify that your configuration allows for token refresh. ----- How do we configure this? Any documentation you can provide to follow?

If possible, try upgrading to a newer version of Dapr. There may be bug fixes or improvements related to token management in versions after 1.15.5. ---- Are you saying here, change it to the latest version. Could you tell me which version has the fixes?
Mahesh Kurva 7,570 Reputation points Microsoft External Staff Moderator

2025-07-10T01:35:02.3466667+00:00

Hi Arun Babu,

Sorry for delay in response.

This issue appears to be related to Dapr, where it fails to refresh the Entra ID authentication token used for connecting to Azure Cache for Redis. When the token expires (usually after 24 hours), the connection breaks, resulting in the ERR WRONGPASS error.

we recommend opening an issue directly with the Dapr team for further investigation.

You can also refer to the following known issue for more context:

https://github.com/dapr/components-contrib/issues/3554

I hope this has been helpful! Please do let us know if you have any further queries.
Arun Babu 20 Reputation points

2025-07-10T16:47:08.81+00:00

Yes, I have seen that closed issue but there was no fix for that thread. What we are currently doing is to refresh the pod every 23 hours+some more minutes. But how do we do this automated?
Arun Babu 20 Reputation points

2025-07-10T16:48:01.74+00:00

Can you help me with any script or where to add this? Is it in my helm.yaml file inside the sidecar containers?
Yaron Schneider 0 Reputation points

2025-07-10T21:24:59.89+00:00

Hi Arun, I'm a Dapr core maintainer and would like to help you with this. Can you DM me on the Dapr Discord server? My handle is yaron2

Answer 1

Mason Fraser 165

This usually happens because the Entra ID (Azure AD) token expires after 24 hours. The managed identity needs to refresh it, but sometimes the automatic refresh fails. Try restarting your pod to force a fresh token—if that fixes it, you’ll need to add token renewal logic in your app or check Dapr’s configuration for token refresh. Also, make sure your Redis connection settings in Dapr explicitly include the managed identity credentials.

Share via

Redis Entra Id connection stops working after 24hours

0 additional answers

Your answer