Azure / Azure/azure-functions-host

Cannot retrieve the master key using the Key management API

Open
#4,120 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

Hi I have a Function V2 that I've just created and I am trying to retrieve the `_master` key as described in the [Key management API](https://github.com/Azure/azure-functions-host/wiki/Key-management-API#host-key-resource-adminhostkeyskeyname) documentation.

> The host key resource exposes the same APIs as the function keys collection resource.
**Note**: The master key is exposed under the reserved name _master and DELETE is not supported

Function Get-Function-Jwt {
Param (
[string] [Parameter(Mandatory = $true)] $resourceGroupName,
[string] [Parameter(Mandatory = $true)] $functionAppName
)

$resourceType = "Microsoft.Web/sites/config"
$resourceName = "$functionAppName/publishingcredentials"
$publishingCredentials = Invoke-AzureRmResourceAction -ResourceGroupName $resourceGroupName -ResourceType $resourceType -ResourceName $resourceName -Action list -ApiVersion 2015-08-01 -Force

$accessToken = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $publishingCredentials.Properties.PublishingUserName, $publishingCredentials.Properties.PublishingPassword)))

$jwt = Invoke-RestMethod -Uri "https://$functionAppName.scm.azurewebsites.net/api/functions/admin/token" -Headers @{Authorization = ("Basic {0}" -f $accessToken)} -Method GET

return $jwt
}

Function Get-HostKey {
Param (
[string] [Parameter(Mandatory = $true)] $functionAppName,
[string] [Parameter(Mandatory = $true)] $hostKeyName,
[string] [Parameter(Mandatory = $true)] $jwt
)

return (Invoke-RestMethod -Uri "https://$functionAppName.azurewebsites.net/admin/host/keys/$hostKeyName" -Headers @{Authorization = ("Bearer {0}" -f $jwt)} -Method Get).value
}

# Connect-AzureRmAccount
$resourceGroupName = ""
$functionAppName = "function app name"

$jwt = Get-Function-Jwt -resourceGroupName $resourceGroupName -functionAppName $functionAppName
Get-HostKey -functionAppName $functionAppName -hostKeyName "_master" -jwt $jwt

Write-Host $hostKey

Here is the exception:

> Invoke-RestMethod : The remote server returned an error: (404) Not Found.

If I try with the `default` host key, it is working fine.

Also I've tried the approach describe [here](https://github.com/Azure/azure-functions-host/issues/3378)

But I have another exception containing a link to this documentation:

- [Changes to Key Management in Functions V2](https://github.com/Azure/azure-functions-host/wiki/Changes-to-Key-Management-in-Functions-V2)

I don't really want to change the `AzureWebJobsSecretStorageType` to `files` so at the moment I am kind of stuck.

Contributor guide

Open the contributing guide

Research direction

Start with the Key management API and Changes to Key Management in Functions V2 documentation, then trace the /admin/host/keys/{keyName} endpoint and the AzureWebJobsSecretStorageType behavior. Compare the documented _master request with the working default-key request; done means the master-key behavior is either restored without changing storage type or clearly documented as unsupported.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
api, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.