CustomProvider CreateManagedServiceIdentityTokenProvider

#1

Dear,

We don’t want to use credentials in the connectionstring any more so we are looking in to use a custom token provider. In the endpointConfiguration I add a CustomTokenProvider:

var tokenProvider = TokenProvider.CreateManagedServiceIdentityTokenProvider();
endpointConfiguration.Transport.CustomTokenProvider(tokenProvider);

I added the application identity to bij service bus credentials.

But i get the following error:
[11/03/2020 11:40:45] A host error has occurred during startup operation ‘GUID’.
[11/03/2020 11:40:45] Microsoft.Azure.ServiceBus: Value cannot be null.
[11/03/2020 11:40:45] Parameter name: ServiceBusConnection doesn’t have a valid token provider.

Is there something that i miss? Or is there more documentation how to use the CustomTokenProvider?

Thank you in advance

John

#2

Hi John,

What’s the connection string you’re providing the transport with?
Please mask sensitive information.

#3

Hallo Sean,

Endpoint=sb://----.-----.servicebus.windows.net/

Thank you for your reply

#4

There are different token providers. Without specifying via connection string which one do you want to use, the underlying SDK will attempt to use SAS token.

It should be Endpoint=sb://----.-----.servicebus.windows.net/;Authentication=Managed Identity.

#5

Now i’m getting
Value cannot be null.
Parameter name: provider

#6

Ok, but then this is not the security what i’m looking for. I want to use the management identity in azure so we don’t have to use any token in the connections strings.

using Microsoft.Azure.ServiceBus.Primitives

transport.CustomTokenProvider(TokenProvider.CreateManagedServiceIdentityTokenProvider());

Will not work then.

#7

UPDATE: see more detailed reply here.

I might have not been clear on this.

You do not need any SAS tokens, keys, or anything else. Your connection string indicates what namespace you’re using and specifying that the authentication to use is Managed Identity. The token provider still needs to be registered and that’s TokenProvider.CreateManagedServiceIdentityTokenProvider(). With those two it works.

How do you validate it doesn’t work? Where do you run it?

#8

I use it like this and it works great:

transport.CustomTokenProvider(TokenProvider.CreateManagedIdentityTokenProvider());

Connection string: Endpoint=sb://*****.servicebus.windows.net/

I also have a reference to Microsoft.Azure.Services.AppAuthentication

#9

Let me clarify.

There’s no need to include the reference to Microsoft.Azure.Services.AppAuthentication. It’s a dependency for Azure Service Bus SDK/client which is transitively brought into your project when the ASB transport is used.

The combination of the connection string (w/o key and token) and a specified TokenProvider should work.

The connection string with the Authentication=Managed Identity part is necessary when the application is compiled to work with the ASB transport that is configured using connection string only and the code cannot be updated and redeployed (ServiceControl for example).

To sum it up, there are two options:

  1. Use connection string and specify the authentication option in the connection string.
  2. Provide the connection string with the namespace FQDN and in the code register a token provider.

Hope that clarifies this.