search

paolosalvatori / ServiceBusExplorer

The Service Bus Explorer allows users to connect to a Service Bus namespace and administer messaging entities in an easy manner. The tool provides advanced features like import/export functionality or the ability to test topic, queues, subscriptions, relay services, notification hubs and events hubs.
MIT License
2.01k stars 585 forks source link

Use when having restricted rights #723

Open paritoshnagar2016 opened 1 year ago

paritoshnagar2016 commented 1 year ago

Hi Team,

We are looking forward to use service bus explorer but need to make sure that developers should be able to move messages from DLQ to Active Queue but not able to add/delete/manage queues or topics. When I can trying to use SAS token explorer only allows when I am selecting manage policy and this would open up for developers to add/delete queues, is there way to restrict the same.

Thank You

SeanFeldman commented 1 year ago

Potentially related to #607

ErikMogensen commented 1 year ago

@paritoshnagar2016, as far as I know SBE works properly when the connection string used has Listen and Send rights. You have to test that though since there are often changes and this use case is not tested.

According to https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-sas#shared-access-authorization-policies you need the Manage right to be able to delete and create queues.

Please reply to this thread whether it works or not after you have tested it.

Kunter-Bunt commented 1 year ago

@ErikMogensen I have retested this and do receive 401 errors upon connecting: image image

ErikMogensen commented 1 year ago

I tried it and had the same error. It is the namespaceManager.GetQueuesAsync() method that fails. There is no mention about rights requirements at the method documentation. I can not think of a way of solving this, unless the tool gets support for RBAC authentication, as Sean posted.

I believe this was working in the past, in that case there has been a change in the service.

TomasMalecek commented 10 months ago

This looks like a duplicate of #615.