Monday, 11 March 2019

Error: “unexpected error retrieving the credentials” while fetching user claims in Azure Mobile App


Introduction


Azure Mobile Apps uses tokens to authenticate users. Tokens are pieces of encoded data that contain information about a user. 
Whenever a user signs in with one of the built-in authentication mechanisms, a token is generated by the service that uniquely identifies the user.

This token is then retrieved by the client application. The client application provides this token with every request to the service. When a service request is processed, the Mobile App service examines the supplied token and validates it - if the token is valid the request is allowed and processed; if not, it returns 401 Unauthorized error.

If you have recently created an Azure mobile app, which configured to authenticate using Azure Active Directory sign-in as directed in this documentation - https://docs.microsoft.com/en-gb/azure/app-service/app-service-mobile-how-to-configure-active-directory-authentication?toc=%2fazure%2fapp-service-mobile%2ftoc.json.

You might experience issues with the following line of code in the IPrincipal extension class of azure mobile app service -

AzureActiveDirectoryCredentials aadCreds = await this.User.GetAppServiceIdentityAsync(this.Request);

This line of code is used to fetch the user claims (login credentials) from the X-ZUMO-AUTH in which the client application has presented the authentication code.


Error Message


"Message": "There was an unexpected error retrieving the credentials: 'StatusCode: 404, ReasonPhrase: 'Not Found', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:\r\n{\r\n  X-Content-Type-Options: nosniff\r\n  x-ms-request-id: eb06e72b-2c22-4b94-9118-231b01311500\r\n  Cache-Control: private\r\n  Date: Thu, 31 Jan 2019 12:41:30 GMT\r\n  P3P: CP=\"DSP CUR OTPi IND OTRi ONL FIN\"\r\n  Set-Cookie: x-ms-gateway-slice=prod; path=/; secure; HttpOnly\r\n  Server: Microsoft-IIS/10.0\r\n  Content-Length: 0\r\n}'

Fix


Microsoft has accepted this as bug. 

If an application has the site auth setting runtimeVersion set to any valid version >= 1.0.0, instead of populating the user Claims Principal with the claims from the X-ZUMO-AUTH token, it will populate them based on the claims in the token store (i.e. the claims from the original aad access token). This site auth setting started defaulting to "1.0.0" when turning on EasyAuth around the same time, which why we are only seeing this behavior on newer applications.

As a workaround, you can set "runtimeVersion" to the empty string or remove it entirely using https://resources.azure.com/. You can find it via the following path: subscriptions > (site subscription) > resource groups > (site resource group) > providers > Microsoft.Web > sites > (site name) > config > authsettings. Then you can find "runtimeVersion" under the "properties" field of the json.


This should resolve the error.



Thursday, 27 April 2017

Creating DocumentDb and Performing CRUD operations on DocumentDb via Logic Apps

Introduction


DocumentDB, as a NoSQL store, is truly schema-free. It allows you to store and query any JSON document, regardless of schema. The service provides built-in automatic indexing support – which means you can write JSON documents to the store and immediately query them using a familiar document oriented SQL query grammar. DocumentDB is designed to linearly scale to meet the needs of an application.
In this article, we learn how to perform CRUD operations on DocumentDb via Logic Apps.

Create Account in DocumentDb


For the creation of DocumentDb, we first need to create a DocumentDb account.


Ø  ID: Name of the DocumentDb account.
Ø  Resource Group: Either create new resource group or use existing.
Ø  Location: Choose the Microsoft data center you want this account to be hosted.
Once you click on create, the DocumentDb account will be created.


Create Database in DocumentDb


Next step is to add database in DocumentDb, for which you will have to open the DocumentDb account you have created. Goto Browse and Add Database.


Ø  ID: Name of the DocumentDb database

Create Collection in DocumentDb


Next step is to add collection in the database of the DocumentDb, for which you will have to open the DocumentDb account you have created. Goto Browse and Add Collection.


Ø  Collection Id: Name of the DocumentDb collection.
Ø  Storage Capacity: By default, Storage Capacity is set to 250 GB to handle partitioned collections.
Ø  Partition Key: enter a partition key for the collection. This is required for partitioned collections and optional for single partition collections.
Ø  Database: either create a new database or use an existing one.

Create and Update Documents in DocumentDb via Logic Apps


Create a new logic app. This logic app will be used to Insert and Update documents in documentdb.


Trigger


Request: This trigger serves as an endpoint that you call via an HTTP Request to invoke your logic app. 



Ø  HTTP POST to this URL: This URL will be created automatically once you save the logic app and it will be used as an endpoint by the REST client to invoke this logic app.
Ø  Request Body JSON Schema: This is an optional property, which validates the incoming request. Useful for helping subsequent workflow steps know which properties to reference.

Actions


1)      Create and Update Document
This action can be used under DocumentDb activity for inserting new documents and updating the existing document.





Ø  Database ID: Specify the database where the document should be created or updated.
Ø  Collection ID: Specify the collection where the document should be created or updated.
Ø  Document: The document, which needs to be inserted, in our case it will be the body of the request made by the REST client.
Ø  IsUpsert: If set to true, the document will be replaced if it exists else created.

2)      Send an email

This action can be used under Outlook 365 connector, to trigger an email.



Ø  Body: Body of the message.
Ø  Subject: Subject of the message.
Ø  To: The email addresses of the recipients.
We used Boomerang is the REST client to trigger the logic apps available as an extension in google chrome: https://chrome.google.com/webstore/detail/boomerang-soap-rest-clien/eipdnjedkpcnlmmdfdkgfpljanehloah?hl=en




The logic apps run was successful and the document was inserted in the collection specified. 



We received a mail in the specified email address as well with message body.


Upon checking, the collection we could see that the document has be successfully created in the collection specified.


Similarly, same document was successfully updated in documentdB in the next hit.




Upon checking, the collection we could see that the document has be successfully updated in the collection specified.


Read Documents from DocumentDb via Logic Apps



Create a new logic app. This logic app will be used to read documents from documentdb.


Trigger


Request: This trigger serves as an endpoint that you call via an HTTP Request to invoke your logic app. 



1)      HTTP POST to this URL: This URL will be created automatically once you save the logic app and it will be used as an endpoint by the REST client to invoke this logic app.
2)      Request Body JSON Schema: This is an optional property, which validates the incoming request. Useful for helping subsequent workflow steps know which properties to reference.

Actions

1)      Get Document

This action can be used under DocumentDb connector for fetching the documents from the DocumentDb.




Ø  Database ID: Specify the database where the document should be created or updated.
Ø  Collection ID: Specify the collection where the document should be created or updated.
Ø  Document ID: The ID of the document, which needs to fetched from the documentDb.

2)      Response

This action type contains the entire response payload from an HTTP request and includes a statusCode, body, and headers:




Ø  Status Code: The HTTP status code
Ø  Headers: A JSON object of any response headers to include
Ø  Body: The response body

We used Boomerang is the REST client to trigger the logic apps available as an extension in google chrome: https://chrome.google.com/webstore/detail/boomerang-soap-rest-clien/eipdnjedkpcnlmmdfdkgfpljanehloah?hl=en




The logic apps run was successful and it was able to fetch the document with the document id ‘abc3’ from the documentDb.




The response was displayed back on the Boomerang.


Delete Documents from DocumentDb via Logic Apps



Create a new logic app. This logic app will be used to delete documents from documentdb.


Trigger


Request: This trigger serves as an endpoint that you call via an HTTP Request to invoke your logic app. 



1)      HTTP POST to this URL: This URL will be created automatically once you save the logic app and it will be used as an endpoint by the REST client to invoke this logic app.
2)      Request Body JSON Schema: This is an optional property, which validates the incoming request. Useful for helping subsequent workflow steps know which properties to reference.

Actions


1)      Delete a Document

This action can be used under DocumentDb connector for deleting the documents from the DocumentDb.



Ø  Database ID: Specify the database where the document should be created or updated.
Ø  Collection ID: Specify the collection where the document should be created or updated.
Ø  Document ID: The ID of the document, which needs to deleted from the documentDb.

3)      Response

This action type contains the entire response payload from an HTTP request and includes a statusCode, body, and headers:



Ø  Status Code: The HTTP status code
Ø  Headers: A JSON object of any response headers to include
Ø  Body: The response body

We used Boomerang is the REST client to trigger the logic apps available as an extension in google chrome: https://chrome.google.com/webstore/detail/boomerang-soap-rest-clien/eipdnjedkpcnlmmdfdkgfpljanehloah?hl=en




The logic apps run was successful and it was able to delete the document with the document id ‘abc2’ from the documentDb.




The response was displayed back on the Boomerang.




Moreover, the document was not visible anymore in the collection.