/tenant/settings no longer returning details

[velsietis]

Bug description

It seems there's been a breaking change to the Management API and it's no longer possible to retrieve the portal storage account details as described in the wiki pages:

• Retrieve managed portal storage account
• Move from managed to self hosted

Reproduction steps

1. Make the following request:

GET https://<api-management-instance>.management.azure-api.net/tenant/settings?api-version=2018-01-01
...
Authorization: SharedAccessSignature token
...

2. Inspect the response (shown below). It does not include PortalStorageConnectionString

   {
   "settings": {
       "CustomPortalSettings.UserRegistrationTerms": null,
       "CustomPortalSettings.UserRegistrationTermsEnabled": "False",
       "CustomPortalSettings.UserRegistrationTermsConsentRequired": "False",
       "CustomPortalSettings.DelegationEnabled": "False",
       "CustomPortalSettings.DelegationUrl": "",
       "CustomPortalSettings.DelegatedSubscriptionEnabled": "False"
   }
   }

Additional context

Not sure if this is related to the breaking changes, but we are also unable to "Save to" or "Deploy" from the built-in git repository, Both operations fail with the message below:

9/3/2020, 11:32:57 AM Request processing failed due to internal error.

[nmeuret-smag]

Exactly the same problem. I asked MS Azure Support who answered me this morning :

Could please try to generate a new token and then try again.

https://docs.microsoft.com/en-us/rest/api/apimanagement/apimanagementrest/azure-api-management-rest-api-authentication#ProgrammaticallyCreateToken

Check scripts.v2 scripts and you will see they use new SAS tokens. Works fine for me.

[velsietis]

Generating new tokens - doesn't work

Thanks @nmeuret-smag, I did try generating a new token but still the same issue.

• I've tried manually creating a SAS token using the management portal
• I've tried programmatically creating a SAS token, in both token formats.

The tokens all work fine for other operations, but /tenant/settings still returns the same

Scripts.v2 - I've had a look but can't see anything to generate the management access token, only for generating the storage SAS token. All the scripts seem to rely on you providing the management token.

Possible workaround - new API?

Looking at the changes in #876, I can see it's now possible to get a storage URL and SAS token with this operation

POST https://<api-management-instance>.management.azure-api.net/portalSettings/mediaContent/listSecrets?api-version=2018-01-01
...
Authorization: SharedAccessSignature token
...

The problem is we've got an automated publish process that relies on the previous /tenant/settings endpoint working as before, so we'll have to rework our code for that.

[azaslonov]

That's correct: /tenant/settings will not return secrets anymore. That's a breaking change that we had to do in a rush due to security considerations. As @velsietis mentioned, /portalSettings/mediaContent/listSecrets will become an alternative for accessing storage. Besides that, Scripts.v2 will take care of generating a temporary SAS URL to download/upload media files, making those settings optional. The portal client also doesn't require providing connection string or SAS URL for blob, but if needed, custom storage still can be specified.

[velsietis]

Thanks @azaslonov. We'll rework our process to use the new scripts.

Did you spot my comment on #876 - it seems the designer doesn't work properly with the latest version of @paperbits/azure I've sent a PR that I think sorts that issue out

[shashiguru]

Can anyone help me how i can get storage URL of apim instance as /tenant/settings not working.

[velsietis]

@shashiguru , get an access token - instructions here - and then make a request to this URL (passing the access token in the Authorization header).

POST https://<api-management-instance>.management.azure-api.net/portalSettings/mediaContent/listSecrets?api-version=2018-01-01
...
Authorization: SharedAccessSignature token
...

However, if you're using the latest version from this repository, you don't actually need to supply the storage URL in the config anymore, just remove it from the config files and it should work. The only problem I've had is that there appears to be a bug with the designer, so I had to downgrade all the paperbits dependencies to 0.1.316 in package.json.

[shashiguru]

Hi @azaslonov, we are going for production release this week and we have old scripts to migrate the portal content. i need your help in that, is there any way that we can get storage connection string? because we want to go with hotfix for this change. Anything can be helpful, it may be az command or any restful service to pull the connectionstring.

[BrunoSolfo]

Hi @azaslonov, we are going for production release this week and we have old scripts to migrate the portal content. i need your help in that, is there any way that we can get storage connection string? because we want to go with hotfix for this change. Anything can be helpful, it may be az command or any restful service to pull the connectionstring.

Hello @shashiguru ! We used this workaround to retrieve the connectionString :

Use this URL to get the Container SAS Url : https://[apim-name].management.azure-api.net/portalSettings/mediaContent/listSecrets?api-version=2018-01-01

Also this we used librairies that required a ConnectionString and not only the Container SAS url, so we used this PowerShell script to generate the connectionString from this result :

In this case the we removed the container name (content) and change the string format

$sasUrl = $result.containerSasUrl
$splitedSasUrl = $sasUrl.Split("?")
$apimDevPortalStorageConnectionString = "BlobEndpoint="+($splitedSasUrl[0] -replace "/content", "" )+";SharedAccessSignature="+$splitedSasUrl[1]

[shashiguru]

Thanks for help @BrunoSolfo, it worked for me.

[azaslonov]

Closing the issue, looks like no more questions.