Azure / Azure/azure-iot-sdk-csharp

[Bug Report]DeviceClient.GetFileUploadSaSUriAsync() returns invalid SAS when hub is using System-identity.

Open
#3,460 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
C#
Stars
477
Forks
492
Avg merge
9h 55m
Merged PRs (30d)
2

Description

# Context

- **OS, version, SKU and CPU architecture used:** (Windows 10 Desktop x64)
- **Application's .NET Target Framework :** .net8.0
- **Device:** Laptop
- **SDK version used:**
Microsoft.Azure.Devices.Client 1.42.3

## Description of the issue
Followeing these [instructions](https://learn.microsoft.com/en-us/azure/iot-hub/file-upload-dotnet)
Fie Upload works.
Change the authentication type for iot hub [here](https://learn.microsoft.com/en-us/azure/iot-hub/file-upload-dotnet#associate-an-azure-storage-account-to-iot-hub). from Key-based to System-assigned.
Change back, file upload works again.

From python it works by treating the token as an AccessToken and adding an auth header, but that is not an option in C#.
![image](https://github.com/Azure/azure-iot-sdk-csharp/assets/5841226/9a4ac87f-734d-48bd-b63f-e34c318e625b)

Original discussion in [Q&A](https://learn.microsoft.com/en-us/answers/questions/1695252/sas-token-not-working-for-fileupload-iothub).

## Code sample exhibiting the issue
[Please remove any connection string information!](https://github.com/Azure/azure-iot-sdk-csharp/blob/main/iothub/device/samples/getting%20started/FileUploadSample/FileUploadSample.cs)
Updated dotnet version and packages, did not test as written.

## Console log of the issue
Follow the instructions [here](https://github.com/Azure/azure-iot-sdk-csharp/tree/main/tools/CaptureLogs) to capture SDK logs.
Don't forget to remove any connection string information!

Exception thrown: 'Azure.RequestFailedException' in System.Private.CoreLib.dll
Azure.RequestFailedException: Server failed to authenticate the request. Please refer to the information in the www-authenticate header.
RequestId:2081d445-901e-0073-19b2-bda93b000000
Time:2024-06-13T16:53:36.5127373Z
Status: 401 (Server failed to authenticate the request. Please refer to the information in the www-authenticate header.)
ErrorCode: NoAuthenticationInformation

Content:
NoAuthenticationInformationServer failed to authenticate the request. Please refer to the information in the www-authenticate header.
RequestId:2081d445-901e-0073-19b2-bda93b000000
Time:2024-06-13T16:53:36.5127373Z

Headers:
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 2081d445-901e-0073-19b2-bda93b000000
x-ms-client-request-id: e3128d2e-e46f-4494-aa57-6c5876f0ae64
x-ms-version: 2023-11-03
x-ms-error-code: NoAuthenticationInformation
WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/37051258-66ca-457a-a41d-d94c41705e37/oauth2/authorize resource_id=https://storage.azure.com
Date: Thu, 13 Jun 2024 16:53:36 GMT
Content-Length: 302
Content-Type: application/xml

at Azure.Storage.Blobs.BlockBlobRestClient.UploadAsync(Int64 contentLength, Stream body, Nullable`1 timeout, Byte[] transactionalContentMD5, String blobContentType, String blobContentEncoding, String blobContentLanguage, Byte[] blobContentMD5, String blobCacheControl, IDictionary`2 metadata, String leaseId, String blobContentDisposition, String encryptionKey, String encryptionKeySha256, Nullable`1 encryptionAlgorithm, String encryptionScope, Nullable`1 tier, Nullable`1 ifModifiedSince, Nullable`1 ifUnmodifiedSince, String ifMatch, String ifNoneMatch, String ifTags, String blobTagsString, Nullable`1 immutabilityPolicyExpiry, Nullable`1 immutabilityPolicyMode, Nullable`1 legalHold, Byte[] transactionalContentCrc64, CancellationToken cancellationToken)
at Azure.Storage.Blobs.Specialized.BlockBlobClient.UploadInternal(Stream content, BlobHttpHeaders blobHttpHeaders, IDictionary`2 metadata, IDictionary`2 tags, BlobRequestConditions conditions, Nullable`1 accessTier, BlobImmutabilityPolicy immutabilityPolicy, Nullable`1 legalHold, IProgress`1 progressHandler, UploadTransferValidationOptions transferValidationOverride, String operationName, Boolean async, CancellationToken cancellationToken)
at Azure.Storage.Blobs.Specialized.BlockBlobClient.<>c__DisplayClass65_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at Azure.Storage.PartitionedUploader`2.UploadInternal(Stream content, Nullable`1 expectedContentLength, TServiceSpecificData args, IProgress`1 progressHandler, Boolean async, CancellationToken cancellationToken)
at Azure.Storage.Blobs.Specialized.BlockBlobClient.UploadAsync(Stream content, BlobUploadOptions options, CancellationToken cancellationToken)

Contributor guide

Open the contributing guide

Research direction

Start with FileUploadSample.cs and the DeviceClient.GetFileUploadSaSUriAsync() flow described in the issue. Reproduce file upload with the IoT Hub storage account set to System-assigned identity, compare it with key-based authentication, and use the reported 401 response to trace the generated SAS. Done means uploads authenticate successfully with System-assigned identity.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.