Hi everyone!
I've created a Service Bus namespace with support for ACS authentication/authorization.
Unfortunately I wasn't able to use the namespace using this method. Every time I try any kind of operation anUnauthorizedAccessException is thrown.
It comes with additional information that reads:
"The token provider was unable to provide a security token while accessing 'https://<namespace>sb.accesscontrol.windows.net/WRAPv0.9/'"
(...)
"Token provider returned message: 'Error:Code:401:SubCode:T2002:Detail:Audience not valid.'"
Here's what the source code looks like:
using Microsoft.ServiceBus // (...) static void Main(string[] args) { var serviceNamespace = "<namespace name>"; var issuerName = "owner"; var issuerSecrete = "<default key provided in SB and ACS control panels>"; string accessToken = RequestAccessToken (serviceNamespace, issuerName, issuerSecrete); var tokenProvider = TokenProvider.CreateSimpleWebTokenProvider (accessToken); var namespaceUri = ServiceBusEnvironment.CreateServiceUri ("sb", serviceNamespace, string.Empty); var namespaceManager = new NamespaceManager (namespaceUri, tokenProvider); namespaceManager.CreateQueue("q1"); return; } static string RequestAccessToken (string serviceNamespace, string issuerName, string issuerSecrete) { var AcsEndpoint = string.Format( "https://{0}-sb.accesscontrol.windows.net/WRAPv0.9/", serviceNamespace ); var realm = string.Format ("http://{0}.servicebus.windows.net/", serviceNamespace ); NameValueCollection identityParameters = new NameValueCollection(); identityParameters.Add("wrap_scope", realm); identityParameters.Add("wrap_name", issuerName); identityParameters.Add("wrap_password", issuerSecrete); var client = new WebClient(); byte[] AcsResponse = client.UploadValues(AcsEndpoint, identityParameters); string AcsResponseStr = Encoding.UTF8.GetString(AcsResponse); string token = AcsResponseStr .Split('&') .Single(value => value.StartsWith("wrap_access_token=", System.StringComparison.OrdinalIgnoreCase)) .Split('=')[1]; string decodedToken = System.Net.WebUtility.UrlDecode(token); return decodedToken; }
The RequestAccessToken call is always successful and returns a token which then I use feed theTokenProvider.
So everything looks fine until I call any kind of function which needs to manage, send or consume data from the namespace.
I've no idea what the problem is... The Audience looks pretty much valid to me in the ACS token (every time I test the audience is exactly the same as the Realm).
Do you have any idea of that the problems might be?
I'm under the feeling I missed something :(
Thank you very much!