Azure SignalR Negotiation. Azure Func and Azure AD authentication.

[tbuha]

I would like to use negotiation for Angular App, based on Azure Func and Azure Active Directory authentication, with specified UserId for SignalRConnectionInfo.

How to specify UserId and Authorization Bearer token?

IHttpConnectionOptions does not have any members for http headers. I just see only one possibility to override HttpClient, but why for such simple task I need to override the whole class?

Please explain how to implement it properly.

Thanks, Taras

[wanlwanl]

Hi @tbuha , take a look at this Azure Function Chat Room Sample With Authentication sample.

You can set User ID like this:

SignalRConnectionInfo(HubName = "authchat", UserId = "{headers.x-ms-client-principal-name}")

For more information, please see document for accessing user claims

[tbuha]

Hi @realwanpengli

Thanks for the reply.

I have a looked on your example. Example shows separate calls for negotiate and hubConnection initialization with predefined accessToken.

In my situation I would like to use build in functionality.

Signalr js lib has an build in option to negotiate AzureSignalR SignalRConnectionInfo in IHttpConnectionOptions skipNegotiation?: boolean;

Is it possible to set skipNegotiation = false and to specify UserId?

Another question is about accessToken validation and refresh?

1. Open web browser.
2. Start hubConnection connected to Azure SignalR Service.
3. PC go sleep.
4. Turn on PC.
5. Hub connection will be broken because of not valid accessToken.

Do I need to get a new accessToken and start a new hubConnection?

Thanks, Taras

[wanlwanl]

Hi Taras,

In my situation I would like to use build in functionality.

You can call negotiation function endpoint and wait for the access token, then add the token inaccessTokenFactory.

For signalr js client, you can define your access token to azure signalr in accessTokenFactory.

Azure SignalR function binding helps you to generate access token for azure signalr.

If you are using Azure Func and AAD turned on, the limited tokens you can get is list in this sections: Access user claims and Retrieve tokens in app code. You can specify the user id from this field in header. It is the easiest way to specify a user ID. If you want to add more claim, use ClaimTypeList.

But if you want to get any header's field in the azure signalr function binding (AAD should be turned off), you can get any header's field like this:

[SignalRConnectionInfo(HubName = "simplechat", UserId = "{headers.x-ms-signalr-userid}")].

But you have to implement the authentication by yourself. For more infomation, see here.

Could you describe more for your scenario? We'd like to help you to find the best practice for you.

---

For the 2nd question, PC go sleep for how long? Is there any error message? e.g. JWT expiration?

[sffamily]

Hi @tbuha , I'm the Product Manager of Azure SignalR Service, found on this thread that you have been developing with Azure Functions with the serverless chatroom example. We have a new internal preview for supporting raw WebSocket in serverless scenarios that further improves the classic samples like chatroom, thinking you might be interested to try it out and offer us some feedback. If you are interested please ping me at zhshang at microsoft dot com. Thanks. -Zhidi

[oswaldozapata]

Hi guys, I am looking for a solution to refresh my expired access token, It seems like this is going to be a manual task.. I am using functionMonkey/azure functions, I would like to have direct answerd to my question: what the build in process should be to refresh an expired access token?

.SignalR(signalR => signalR .Negotiate<SignalRNegotiateCommand>("/negotiate",AuthorizationTypeEnum.TokenValidation, notificationMethods))

I am calling negotiate from my angular app, this call returnsthe access token, I get properly connected to the signalr server which is an azure implementation, but, once my token has expired the connection returns 401 error which means my access token is not valid anymore. I thought this process to renew the access token should be an automatic process hidden behind the @microsoft/signalr library. please if you can help me to understand this. thanks in advance.

[vicancy]

Here provides details about 401 and reconnect suggestions. I am closing the issue as the solution is provided, please feel free to reopen the issue if you have further concerns.