NaridaL
commented
4 months ago OK, issue seems to be that the claims "tid" and "oid" were missing from by dummy auth token. These should probably be validated as part of the token validation.
For reference here is a TokenCredential which works:
namespace My.Test.Framework;
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Threading;
using System.Threading.Tasks;
using Azure.Core;
using Microsoft.IdentityModel.Tokens;
public class SelfSignedTokenCredential : TokenCredential
{
private readonly TimeSpan _expiration = TimeSpan.FromHours(1);
private readonly string _tenant = "aaaaaaaa-aaaa-aaaa-0000-aaaaaaaaaaaa";
private readonly string _issuer = $"https://sts.windows.net/aaaaaaaa-aaaa-aaaa-0000-aaaaaaaaaaaa/";
private readonly byte[] _secret = RandomNumberGenerator.GetBytes(32);
public override async ValueTask<AccessToken> GetTokenAsync(
TokenRequestContext requestContext,
CancellationToken cancellationToken)
{
return GetToken(requestContext, cancellationToken);
}
public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
{
var audience = requestContext.Scopes.Length > 0 ? requestContext.Scopes[0] : "default-audience";
audience = audience.Replace("//.default", "/");
var expires = DateTimeOffset.UtcNow + _expiration;
var token = GenerateJwtToken(audience, DateTime.UtcNow - TimeSpan.FromMinutes(5), expires.UtcDateTime);
return new AccessToken(token, expires);
}
private string GenerateJwtToken(string audience, DateTime notBefore, DateTime? expires)
{
var securityKey = new SymmetricSecurityKey(_secret);
var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);
return new JwtSecurityTokenHandler().CreateEncodedJwt(
issuer: _issuer,
audience: audience,
subject: new ClaimsIdentity(new []
{
new Claim("oid", "c0ffee00-c0ff-eeee-0000-c0ffee000000"),
new Claim("tid", _tenant),
}),
notBefore: notBefore,
expires: expires,
issuedAt: null,
signingCredentials: credentials);
}
}
blueww
EmmaZhu
Which service(blob, file, queue, table) does this issue concern?
blob
Which version of the Azurite was used?
Where do you get Azurite? (npm, DockerHub, NuGet, Visual Studio Code Extension)
npm
What's the Node.js version?
node --version v20.12.1
What problem was encountered?
Try to generate user delegated key, see log below.
Steps to reproduce the issue?
If possible, please provide the debug log using the -d parameter, replacing \<pathtodebuglog> with an appropriate path for your OS, or review the instructions for docker containers:
Please be sure to remove any PII or sensitive information before sharing!
The debug log will log raw request headers and bodies, so that we can replay these against Azurite using REST and create tests to validate resolution.
Have you found a mitigation/solution?
not yet