Issue with Microsoft.Data.SqlClient.dll looking for Azure.Identity.dll version 1.7.0 but project has a dependency on version 1.8.0

[amitverma009]

Hi All,

Am facing issue with one of my windows application which is using Microsoft.Data.SqlClient.dll 5.1.0 ( which has an internal dependency on azure.identity.dll ver >1.7.0).

There is a dependency on a nuget in application which is using Azure.Identity.dll 1.8.0.

All project dependencies shows dependency on version 1.8.0 and the same is getting packaged as part of MSI.

Issue : at runtime code is looking for version 1.7.0 .

any help in understanding the exact cause would be helpful

Thanks

Amit

[lcheunglci]

Hi @amitverma009 , thanks for bringing this issue to our attention. When we dropped support for .NET Core 3.1 and added support to .NET6, I believe we upgraded our dependency from Azure Identity 1.6.0 to 1.7.0. I'll have to check with the team and see if we should upgrade dependency to the newer version or change the dependency to a min version instead of an exact version. We'll get back to you soon.

[amitverma009]

Thanks @lcheunglci .

[HamsterExAstris]

Is this Windows application .NET Framework or .NET Core?

If .NET Framework, does your MSI include an app.config file (with the same name as the executable) with a binding redirect for Azure.Identity?

[amitverma009]

Yes It is in .NET Framework 4.7.2. I have done a binding redirect (manually ) but that is not a long term solution.

Reason : There is an internal Nuget

So the nuget is referred in a separate project (class library) which is not having any app config. App config is in the main project where I have put in binding redirect.

[lcheunglci]

Can you provide us with a sample project to reproduce this? The dependency we have for Azure Identity is >= 1.7.0, so 1.8.0 shouldn't be an issue.

[amitverma009]

Hi @lcheunglci , am afraid I wont be able to provide the exact code. I have done the workaround by adding binding redirect. Let me try and create another sample project so that i can share that with you.

[inthemedium]

I have a solution that reproduces the issue and I understand the root cause.

Root cause

The root cause is the reference assembly has a different set of references compared to the implementation assembly.

Possible solutions

• Remove the reference assembly logic from the build (i.e. src\Microsoft.Data.SqlClient\netfx\ref) OR
• keep a shared file of References and PackageReferences between the ref and src projects

Also, please consider in the long-term throwing out all the custom build logic and switching to SDK-style projects (which automatically generate correct nugets).

Investigation notes

We had an issue where binding redirects were not automatically generated when they should have been resulting in a runtime crash.

I have narrowed down the cause to ResolveAssemblyReferences not being aware of ​the different versions of assemblies in the build graph because it received reference assemblies with a subset of references in the implementation assembly.

Failing example (at the root project in the "simplifed repro" below):
In the Assemblies parameter, RAR receives <package folder>\microsoft.data.sqlclient\5.0.0\ref\net462\Microsoft.Data.SqlClient.dll ​(see image 1 for references in the reference assembly and image 2 for the implementation assembly) and subsequently fails to output Azure.Identity​ in the SuggestedBindingRedirects​ ItemGroup (image 3).

If I delete the ref​ folder from the package, and clean the repo, the binding redirect is generated as expected.

---

Simplified repro structure (see attached)

ReferenceAssemblyCausesMissingBindingRedirects.csproj:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net48</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <ProjectReference Include="..\A\A.csproj" />
    <ProjectReference Include="..\B\B.csproj" />
  </ItemGroup>
</Project>

A.csproj:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net48</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Azure.Identity" Version="1.8.0" />
  </ItemGroup>
</Project>

B.csproj:

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>net48</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.0.0" /> <!-- This nuget has a reference assembly that hides its dependency on Azure.Identity, specifically version 1.6.0 -->
  </ItemGroup>
</Project>

Image 1: microsoft.data.sqlclient\5.0.0\ref\net462\Microsoft.Data.SqlClient.dll references in ilspy

Image 2: microsoft.data.sqlclient\5.0.0\lib\net462\Microsoft.Data.SqlClient.dll references in ilspy

Image 3: missing Azure.Identity​ in the output of RAR

[lcheunglci]

Thanks for the suggested solutions. During our triage meeting, we did notice that the ref and src project dependencies are out of sync as you mentioned and the second approach where there's a shared reference file for these dependency does make sense.

Also, please consider in the long-term throwing out all the custom build logic and switching to SDK-style projects (which automatically generate correct nugets).

I'm not sure if follow this properly as I thought we are using an SDK-style project https://learn.microsoft.com/en-us/nuget/resources/check-project-format ; however, if you can direct us to some documentation, we might be able to look into. Thanks!

[HamsterExAstris]

The netcore project is SDK-style, the netfx one is not. (As shown in your link, there's no Sdk attribute on the <Project> tag.)

#1860 includes an effort to convert the netfx project to SDK-style.

[JRahnama]

netfx in converted to SDK style in PR #2413. Also Azure.Identity is upgraded to use 1.11.2

Closing the issue as it has been resolved.