Webhook validation fails with Unauthorized

[Tri16]

Hi @mrm9084

I am trying dynamic configuration using push refresh in Java spring App, for that I am creating Event grid subscription, and while deploying the web-hook URL in azure portal for my application which is deployed in azure web app, I am getting Unauthorized error and deployment of webhook fails

{"code":"Url validation","message":"Webhook validation handshake failed for https://abc.azurewebsites.net/actuator/appconfiguration-refresh. Http POST request retuned 2XX response with response body Unauthorized. When a validation request is accepted without validation code in the response body, Http GET is expected on the validation url included in the validation event(within 10 minutes). For troublehooting, visit https://aka.ms/esvalidation."}

Refered docs: https://learn.microsoft.com/en-us/azure/azure-app-configuration/enable-dynamic-configuration-java-spring-push-refresh?tabs=spring-boot-2%2Ccmd

https://learn.microsoft.com/en-us/azure/event-grid/troubleshoot-subscription-validation https://microsoft.github.io/spring-cloud-azure/docs/azure-app-configuration/2.8.0/reference/html/index.html#setting-up-web-hooks

On webhook deployment why it is giving unauthorized, ideally we are using User-assigned Managed identity, and when we try with connection string still it fails

on trying with postman:

bootstrap.properties

spring.cloud.azure.appconfiguration.stores[0].endpoint=https://abc.azconfig.io spring.cloud.azure.appconfiguration.stores[0].feature-flags.enabled=true spring.cloud.azure.appconfiguration.stores[0].monitoring.triggers[0].key=sentinel

spring.cloud.azure.appconfiguration.stores[0].monitoring.push-notification.primary-token.name=testToken spring.cloud.azure.appconfiguration.stores[0].monitoring.push-notification.primary-token.secret=tokenSecret

logging.level.com.azure=DEBUG

logging.level.com.org.springframework=DEBUG logging.level.com.tcs.isn=DEBUG

management.endpoints.web.exposure.include=appconfiguration-refresh spring.cloud.azure.appconfiguration.stores[0].selects[0].key-filter=sentinel spring.cloud.azure.appconfiguration.stores[0].monitoring.enabled=true spring.cloud.azure.appconfiguration.stores[0].monitoring.interval=5s spring.cloud.azure.appconfiguration.enabled=true spring.cloud.azure.credential.client-id=23a6c1a1-e074-4ebf-a5ac-7f5b7.... spring.cloud.azure.credential.managed-identity-enabled=true management.endpoint.refresh.enabled=true management.security.enabled=false

`pom.xml

4.0.0 com.tcs.isn app-config-poc 0.0.1-SNAPSHOT 11 ${java.version} ${java.version} 3.6.0 2.7.11 org.springframework.boot spring-boot-starter-parent ${spring-boot.version} pom import com.azure.spring spring-cloud-azure-dependencies 4.10.0 pom org.springframework.boot spring-boot-starter-web log4j log4j com.azure.spring spring-cloud-azure-feature-management-web 4.10.0 com.azure.spring spring-cloud-azure-appconfiguration-config-web 4.10.0 org.springframework.boot spring-boot-starter-actuator boot src/main/java/com/tcs/isn/Application.java appliancetype boot org.springframework.boot spring-boot-maven-plugin ${spring-boot.version} repackage Executable thin false appliancetype thin org.apache.maven.plugins maven-plugin-plugin ${version.maven-plugin-plugin} dependency-check `

[Netyyyy]

@mrm9084 Please take a look

[mrm9084]

@Tri16, it seems to be missing from the docs for mocking this, but a require field for validation is subject. It should contain the uri of the config store. To test just have it match the value of your endpoint field in your configuration file.

[github-actions[bot]]

Hi @Tri16. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[Tri16]

@mrm9084 I've added code for validation

@PostMapping("/appconfiguration-refresh") public ResponseEntity handleValidation(@RequestBody Map<String, Object> body) { String validationCode = (String) body.get("validationCode"); String topic = (String) body.get("topic");

    if (validationCode != null && topic != null) {
        return new ResponseEntity<>(validationCode, HttpStatus.OK);
    } else {
        return new ResponseEntity<>("Missing required fields", HttpStatus.BAD_REQUEST);
    }
}

but still getting Unauthorised error, when we are doing webhook validation through portal, is this a security related issue?

[mrm9084]

@Tri16, I found the bug in the library that results in this error. A new release should be out early next week with a fix. I'll update here when it is out.

[Tri16]

ok Thanks