create consumerGroup for iothub build-in endpoint via REST call from python with shared access policy

Question

(how) is this possible?

two approaches:

1.

uri = 'https://management.azure.com/subscriptions/%s/resourceGroups/%s/providers/Microsoft.EventHub/namespaces/%s/eventhubs/%s/consumergroups/%s?api-version=%s' % (subscriptionId,resourceGroupName,namespaceName,eventHubName,consumerGroupName,apiVersion)

--> I am not able to create the header (authentication for the access) with:

def get_auth_token(sb_name, eh_name, sas_name, sas_value): # Returns an authorization token dictionary for making calls to Event Hubs REST API.
    uri = quote_plus("https://{}.servicebus.windows.net/{}".format(sb_name, eh_name))
    sas = sas_value.encode('utf-8')
    expiry = str(int(time() + 10000))
    string_to_sign = (uri + '\n' + expiry).encode('utf-8')
    signed_hmac_sha256 = HMAC(sas, string_to_sign, sha256)
    signature = quote(b64encode(signed_hmac_sha256.digest()))
    return 'SharedAccessSignature sr={}&sig={}&se={}&skn={}'.format(uri, signature, expiry, sas_name)

header = { 'Authorization':get_auth_token(sb_name, eh_name, 'iothubowner', sas_value), 'Content-Type':'application/json' }

2.

uri = '{sb_name}.servicebus.windows.net/{eh_name}/consumergroups'
header = { 'Authorization':get_auth_token(sb_name, eh_name, 'iothubowner', sas_value), 'Content-Type':'application/json' }
res = get(uri, headers=header) # this works (list of consumerGroups)

but:

uri = '{sb_name}.servicebus.windows.net/{eh_name}/consumergroups/newConsumerGroup'
res = put(uri, headers=header)

does not work:

401 40100: Unauthorized : Unauthorized access for 'CreateOrUpdateConsumerGroup' operation on endpoint 'sb://{sb_name}.servicebus.windows.net/{eh_name}/consumergroups/newConsumerGroup'.

score 0 · Answer 1 · answered May 29 '19 at 16:51

Adding a consumer group to an Event Hub-compatible endpoint in the IoT Hub is described here.
That's your first option. Note, that this approach requires to use a Bearer Token for Authorization header.

Your second approach such as using a ServiceBus namespace and sas token for authorization is working well for any public Event Hub entity, but not for internal Event Hub of the IoT Hub. That's the reason why you can call only GET method. In other words, the Event Hub-compatible endpoint of the IoT Hub doesn't have a write permission.

create consumerGroup for iothub build-in endpoint via REST call from python with shared access policy

1 Answers1