HighAvailabilityEncodingStreaming - AMS - can't create transform 'Unauthorized'

[ChoOo7]

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ X ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Deploy HighAvailabilityEncodingStreaming and launch tests First of all, you will have to add extra permission on the keyvault It's asked to do Select the Get and List secret permissions. But the write permission is necessary for this portion of code E2ETestConfigServices.cs await keyVaultClient.SetSecretAsync($"https://{this.keyVaultName}.vault.azure.net", "ClearKeyStreamingKey", Convert.ToBase64String(this.clearKeyStreamingKey)).ConfigureAwait(false);

After that, my test errors are : Message:  Test method HighAvailability.Tests.E2ETests.SubmitTestRequests threw exception: Microsoft.Azure.Management.Media.Models.ApiErrorException: Operation returned an invalid status code 'Unauthorized'

Arborescence des appels de procédure:  TransformsOperations.CreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String accountName, String transformName, IList1 outputs, String description, Dictionary2 customHeaders, CancellationToken cancellationToken) TransformsOperationsExtensions.CreateOrUpdateAsync(ITransformsOperations operations, String resourceGroupName, String accountName, String transformName, IList`1 outputs, String description, CancellationToken cancellationToken) MediaServicesHelper.EnsureTransformExists(IAzureMediaServicesClient client, String resourceGroupName, String accountName, String transformName, Preset preset) ligne 44 E2ETests.SubmitTestRequests() ligne 124 ThreadOperations.ExecuteWithAbortSafety(Action action)

I'm not able to create a transform from the test script, but using the portal I can I'm the owner of the resource

Any log messages given by the failure

Message:  Test method HighAvailability.Tests.E2ETests.SubmitTestRequests threw exception: Microsoft.Azure.Management.Media.Models.ApiErrorException: Operation returned an invalid status code 'Unauthorized'

Arborescence des appels de procédure:  TransformsOperations.CreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String accountName, String transformName, IList1 outputs, String description, Dictionary2 customHeaders, CancellationToken cancellationToken) TransformsOperationsExtensions.CreateOrUpdateAsync(ITransformsOperations operations, String resourceGroupName, String accountName, String transformName, IList`1 outputs, String description, CancellationToken cancellationToken) MediaServicesHelper.EnsureTransformExists(IAzureMediaServicesClient client, String resourceGroupName, String accountName, String transformName, Preset preset) ligne 44 E2ETests.SubmitTestRequests() ligne 124 ThreadOperations.ExecuteWithAbortSafety(Action action)

Expected/desired behavior

Should work out of the box :)

OS and Version?

Windows 7, 8 or 10. Linux (which distribution). macOS (Yosemite? El Capitan? Sierra?) W10, Vs2022

Versions

Mention any other details that might be useful

---

Thanks! We'll be in touch soon.

[johndeu]

Thanks @ChoOo7 - Looks like a permission issue when creating the transform. I'll have someone re-run the tests on this again. Something may have changed in our version updates for the underlying SDK.

[sipetrik]

I was able to get the latest code from this repo and rerun tests successfully. At this point, I do not have a repro. @ChoOo7 could you double check the identity that is being used when you run tests? Probably the fastest way is to debug the failing test, get token value from https://github.com/Azure-Samples/media-services-v3-dotnet/blob/main/HighAvailabilityEncodingStreaming/HighAvailability/Factories/MediaServiceInstanceFactory.cs#:~:text=var-,accessToken,-%3D%20azureServiceTokenProvider.GetAccessTokenAsync(%22https decode it and verify claim values.

[ChoOo7]

Thanks The information look correct, it's my professional email adress, same user than my azure portal account { "aud": "https://management.azure.com", "iss": "https://sts.windows.net/b742faeb-XXXX/", "iat": 1699999999999, "nbf": 1639999999999, "exp": 16389999999, "acr": "1", "aio": "XXXXXXXXXX", "amr": [ "pwd", "rsa", "mfa" ], "appid": "872cd9fa-XXXXXXXXXX", "appidacr": "0", "deviceid": "cf60bc3e-XXXXXXXXXXX", "family_name": "Minotto", "given_name": "Simon", "ipaddr": "109.XXXXXXXXXX", "name": "Simon Minotto", "oid": "699be0f2-XXXXXXXXX", "puid": "1003XXXXXXXXXXXX", "rh": "0XXXXXXXXXXXXXXXXXXXXX", "scp": "user_impersonation", "sub": "T3kkXXXXXXXXXXXXXXXX", "tid": "b742XXXXXXXXXXXXXX", "unique_name": "simon.minotto@mycompanychangedmanually.com", "upn": "simon.minotto@mycompanychangedmanually.com", "uti": "09XXXXXXXXX", "ver": "1.0", "wids": [ "b79fbf4d-XXXXX" ], "xms_tcdt": 13799999999999999 }

And I still have the exception :/

[ChoOo7]

Ok, i have dumped the exception & response HTTP message and the answer is {"error":{"code":"InvalidAuthenticationTokenTenant","message":"The access token is from the wrong issuer 'https://sts.windows.net/b742faeb-XXX/'. It must match the tenant 'https://sts.windows.net/be604c81-XXXX/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/be604c81-XXXX' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."}}

[sipetrik]

Is it possible that you are using one tenant (b742faeb-XXXX) to login in visual studio (where you run tests from) and another tenant (be604c81-XXXX) to login in PowerShell where you run setup (deploy) script?

You could modify test project to make it executable and run it from the same PowerShell session as deploy script. I will also double check with AMS team to see if there is an easy way to troubleshoot this further.

[ChoOo7]

I confirm my company is using 2 tenants, and my user is maybe not on the same tenant that my target subscription I have edited the test sourcecode to use an AAD Aplication to access my media services, like other samples of this repo And everything is working So, thanks for you help, you can close this ticket

Bonus : can you extend this sample (the high avaibility one) to works with AES symetric key content protection ? Thanks and have a good day

[johndeu]

Issue has been resolved. Thanks @ChoOo7 and @sipetrik for the quick resolution.