Even though ChainedTokenCredential enables multiple TokenCredential implementations to be tried in order until one of the getToken methods returns an access token, but it can handle only authentication error but not authorization i.e., it will throw 403 error and will not automatically switch to other available authentication if RBAC permissions are not defined. ChainedTokenCredential is not switching from System Assigned Managed Identity to User Assigned Managed Identity if System Assigned Managed Identity don't have RBAC permissions
DefaultAzureCredential defaultAzureCredential = new DefaultAzureCredentialBuilder().build();
ManagedIdentityCredential userAssignedmanagedIdentityCredential = new ManagedIdentityCredentialBuilder().clientId("<USER ASSIGNED MANAGED IDENTITY CLIENT ID>").build();
ChainedTokenCredentialBuilder builder = new ChainedTokenCredentialBuilder();
builder.addFirst(defaultAzureCredential);
builder.addLast(userAssignedmanagedIdentityCredential);
ConnectionPolicy defaultPolicy = ConnectionPolicy.getDefaultPolicy();
defaultPolicy.setUserAgentSuffix(applicationName);
defaultPolicy.setPreferredRegions(Arrays.asList("Central US"));
AsyncDocumentClient asyncDocumentClient = new AsyncDocumentClient.Builder().withServiceEndpoint("<Cosmos DB URL>").withTokenCredential(builder.build()).withConnectionPolicy(defaultPolicy) .withConsistencyLevel(ConsistencyLevel.EVENTUAL).build();
Below are the artifact details
<properties>
<java.version>11</java.version>
<reactor-netty>1.0.9</reactor-netty>
<reactor-core>3.4.8</reactor-core>
</properties>
<dependencies>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-core</artifactId>
<version>1.18.0</version>
</dependency>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-storage-blob</artifactId>
<version>12.12.0</version>
<exclusions>
<exclusion>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-cosmos</artifactId>
<version>4.17.0</version>
<exclusions>
<exclusion>
<groupId>io.projectreactor.netty</groupId>
<artifactId>reactor-netty</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-identity</artifactId>
<version>1.3.3</version>
</dependency>
<dependency>
<groupId>io.projectreactor</groupId>
<artifactId>reactor-core</artifactId>
<version>${reactor-core}</version>
<!--$NO-MVN-MAN-VER$ -->
<!-- Please don't remove/degrade the version, possible for compatibility issues -->
</dependency>
<dependency>
<groupId>io.projectreactor.netty</groupId>
<artifactId>reactor-netty</artifactId>
<version>${reactor-netty}</version>
<!--$NO-MVN-MAN-VER$ -->
<!-- Please don't remove/degrade the version, possible for compatibility issues -->
</dependency>
