CODEWITHSUNDEEP
azureazureservicebusazure-managed-identity
user12585721
user12585721

Reputation:

Trying to use Managed Identity with Azure Service Bus

I've tried following this tutorial in order to authenticate my service bus against DefaultAzureCredentials, however, I get a 401.

I'm using the following code in the set-up:

services.AddAzureClients(x =>
{
    x.AddServiceBusClientWithNamespace("myns.servicebus.windows.net")
        .WithCredential(new Azure.Identity.DefaultAzureCredential());
});

I then call the SB client like this:

var sender = client.CreateSender("myqueue");
var message = new ServiceBusMessage(Encoding.UTF8.GetBytes("test"));

await sender.SendMessageAsync(message);

When I call SendMessageAsync I get a 401 error:

fail: Azure-Messaging-ServiceBus[82] An exception occurred while creating send link for Identifier: myqueue-578624f3-f732-4a9b-2ab0-9adc01949a5a. Error Message: 'System.UnauthorizedAccessException: Put token failed. status-code: 401, status-description: InvalidIssuer: Token issuer is invalid. TrackingId:cde3a89c-8108-48d1-8b8f-dacde18e176f, SystemTracker:NoSystemTracker, Timestamp:2021-05-19T07:18:44.

Before I run this, I call az login. I have access to the the namespace to both send and receive. My guess is that I need to allocate some kind of permission between the service bus and ... something - but since I'm running this as a console app, I'm running with my own credentials. Clearly there's something about managed identity that I don't understand.

EDIT:

Following advice from @juunas, I tried the following:

services.AddHostedService<ConsoleHostedService>();
services.AddAzureClients(x =>
{
    //var creds = new Azure.Identity.EnvironmentCredential(); // 1st - EnvironmentCredential authentication unavailable. Environment variables are not fully configured.'
    //var creds = new Azure.Identity.ManagedIdentityCredential(); // 2nd - No Managed Identity endpoint found
    //var creds = new Azure.Identity.SharedTokenCacheCredential(); // 3rd - 'SharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.'
    //var creds = new Azure.Identity.VisualStudioCodeCredential(); // 4th - 'Stored credentials not found. Need to authenticate user in VSCode Azure Account.'
    //var creds = new Azure.Identity.AzureCliCredential(); // 5th
    var creds = new Azure.Identity.DefaultAzureCredential();
    
    x.AddServiceBusClientWithNamespace("myns.servicebus.windows.net")
        .WithCredential(creds);

Upvotes: 2

Views: 4125

Answers (1)

juunas
juunas

Reputation: 58723

It says the "token issuer is invalid". That means it got an access token, but it was issued by the wrong Azure AD tenant. The Az CLI allows you to specify the Azure AD tenant id with the -t tenant-id-here argument on az login.

DefaultAzureCredential could also be using some other credential (it attempts multiple credentials like VisualStudioCredential before the AzureCliCredential). You could instead try to use AzureCliCredential directly and see if it works. That of course won't use Managed Identity so you'd need to use ChainedTokenCredential with the AZ CLI credential + ManagedIdentityCredential to support both.

Upvotes: 5

Related Questions