3

Azure Service Bus supports managed identity access, however the only method I've found to for example send a message to a queue is using this approach that requires code and the Service Bus SDK:

var tokenProvider = TokenProvider.CreateManagedServiceIdentityTokenProvider();
QueueClient sendClient = new QueueClient($"sb://{Config.Namespace}.servicebus.windows.net/", Config.Queue, tokenProvider);
await sendClient.SendAsync(new Message(Encoding.UTF8.GetBytes(messageInfo.MessageToSend)));
await sendClient.CloseAsync();

Sources: https://github.com/Azure-Samples/app-service-msi-servicebus-dotnet https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity

I'm looking for a way to do the same thing with a REST API call from within an Azure API Management policy. I've granted APIM, role based access to Service Bus and I'm able to get a token back, but I get this error back from Service Bus when attempting the REST API call with the managed identity token passed in the Authorization header:

MalformedToken: The credentials contained in the WRAP header are not well-formed.

It looks like Service Bus might only support WRAP or SAS tokens at this point with their REST API: https://learn.microsoft.com/en-us/rest/api/servicebus/send-message-batch

But then again how is this working behind the scenes? 

TokenProvider.CreateManagedServiceIdentityTokenProvider()

Seems like it should be possible with the REST API.

Joe Eng
  • 1,072
  • 2
  • 15
  • 30
  • Seems like it assigns the token to the Authorization header, seems pretty standard :\ – juunas Sep 24 '19 at 18:21
  • Hmm, but it could be that they don't specify it as `Authorization: Bearer tokenabcdef.....` but as `Authorization: tokenabcdef`. – juunas Sep 24 '19 at 18:22
  • @juunas I couldn't find any documentation on this unfortunately. I tried using the APIM policy. It uses the "Bearer {token}" format, but SB doesn't like it. – Joe Eng Sep 24 '19 at 19:26
  • @juunas You were right! It works with just the token value. No prefix. I wonder why this isn't documented. If you add that as an answer I'll give you credit. – Joe Eng Sep 24 '19 at 20:51

1 Answers1

0

It seems in the SDK they don't specify it as Authorization: Bearer tokenabcdef..... but as Authorization: tokenabcdef. Which is a bit unusual.

juunas
  • 54,244
  • 13
  • 113
  • 149