Azure / azure-sdk-for-java

This repository is for active development of the Azure SDK for Java. For consumers of the SDK we recommend visiting our public developer docs at https://docs.microsoft.com/java/azure/ or our versioned developer docs at https://azure.github.io/azure-sdk-for-java.
MIT License
2.25k stars 1.93k forks source link

[BUG] Unable to list Virtual Networks in an Subscription #40302

Open ArchismanRakshit opened 1 month ago

ArchismanRakshit commented 1 month ago

Describe the bug We are trying to list all the virtual networks for a subscription using the Azure Resource Manager SDK, but the SDK responds with an empty value. If we filter the virtual networks with a Resource Group in the request, then we are getting a correct response and can fetch the virtual networks properly.

We are facing this issue only for a particular subscription "/subscriptions/3e17d1cf-4884-464a-b070-cf240f785b10/". For other subscriptions the API calls are working as intended.

We had raised an Azure Support ticket with tracking id: 2405070010004108 where we were advised to raise a bug report in the Azure Java SDK Github Repo.

Code Snippet For the API calls from our application, we first initialize the Azure Resource Manager instance as follows:

HttpClient client = new OkHttpAsyncHttpClientBuilder()
                        .connectionTimeout(Duration.ofMinutes(5))
                        .readTimeout(Duration.ofMinutes(5)).build();

AzureResourceManager azureInstance = AzureResourceManager.configure().withRetryPolicy(new RetryPolicy(new FixedDelay(AZURE_SDK_RETRY_POLICY_MAX_RETRIES, delay)))
      .withHttpClient(client)
      .withLogLevel(HttpLogDetailLevel.NONE)
      .authenticate(credentials, profile)
      .withSubscription(this.subscription);

Using this initialized Azure Resource Manager object, we make a call to get all networks in the subscription using:

PagedIterable<Network> networkPagedIterable = azureInstance.networks().list();

This call is returning an empty response even though there are networks in the Azure subscription.

But if we make a call filtering via the resource group, we are getting the correct response from the Azure API

PagedIterable<Network> networkPagedIterable = azureInstance.networks().listByResourceGroup(resourceGroup);

Expected behavior networks().list() API call should return the list of all the virtual networks in the subscription.

Setup (please complete the following information):

Information Checklist Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

github-actions[bot] commented 1 month ago

Thank you for your feedback. Tagging and routing to the team member best able to assist.

weidongxu-microsoft commented 1 month ago

I cannot reproduce in local with 2.21.0 (azure-core-http-okhttp 1.11.21) -- but that's on my test subscription image

You can enable logging via https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/resourcemanager#enabling-logging Check what service responses.

Do you (or the service principal) have enough permission/RBAC on that subscription?

Also try 2.38.0 (and latest azure-core / azure-core-management). It should use later api-version on network backend.

weidongxu-microsoft commented 1 month ago

You may also directly send a REST API call (curl or postman, or even Azure CLI with --debug) to

https://management.azure.com/subscriptions/3e17d1cf-4884-464a-b070-cf240f785b10/providers/Microsoft.Network/virtualNetworks?api-version=2022-05-01

with an auth token via OAuth2.

We want to check whether this is SDK problem (that service returns the result, but SDK didn't give it back to you), or backend problem (service didn't return any virtual network in response).

ArchismanRakshit commented 1 month ago

@weidongxu-microsoft Thanks for the suggestion on the REST API call. Since this is a customer subscription, we will need to work with them to generate credentials for us which we can use to make a direct REST API call. I will update this thread with the findings once we are able to test this out.

We checked and confirmed that our Service principal has enough permission on the subscription to list the virtual networks