azureazure-functionsazure-eventgridrole-based-access-control

Unauthorized error send message from function app to eventgrid when Debugging but OK when run in Azure


I have a function app with a function that sends message to event grid. The function app is RBAC enrolled and authorized. A function in this same function app is subscribed to this event grid topic. When I publish the app to Azure and run it remote it works just fine, but when I run it locally debugging in VS2022 I get unauthorized access to send message. Debuggin in VS2022 works fine for other Azure related stuff we do.

enter image description here

enter image description here

enter image description here

When I execute in debug mode in VS2022 the function app to send data to event grid I get unauthorized error:

//Name of the endpoint of Event grid topic
    string topicEndpoint = transformAlgoSendRMessage_TopicEP;
    //Creating client to publish events to eventgrid topic
    EventGridPublisherClient client = new EventGridPublisherClient(new Uri(topicEndpoint), new DefaultAzureCredential());
    //Creating a sample event with Subject, Eventtype, dataVersion and data
    EventGridEvent egEvent = new EventGridEvent("TransformTelemetry", "TransformAlgorithm.broadcastTransform", "1.0", machinePartTransformTelemetry);
    // Send the event
    
    try
    {
        await client.SendEventAsync(egEvent);
        if (b_debug_contractor)
            log.LogInformation("SendRTransformMessage sent transformdata - PosX:" + machinePartTransformTelemetry[1]);
    }
    catch (Exception e)
    {
        log.LogError("Failed to send SendRTransformMessage. " + e.Message);
    }

Unauthorized Error:

Status: 401 (The principal associated with access token presented with the incoming request does not have permission to send data to /subscriptions/mysubscriptionid/resourceGroups/myRG/providers/Microsoft.EventGrid/topics/myfunctionapp. Report '3840bb30-0b52-4869-a3ce-40ef9119ed42:2:11/28/2022 7:44:09 PM (UTC)' to our forums for assistance or raise a support ticket.)
[2022-11-28T19:44:07.324Z] ErrorCode: Unauthorized
[2022-11-28T19:44:07.324Z]
[2022-11-28T19:44:07.324Z] Content:
[2022-11-28T19:44:07.325Z] {
[2022-11-28T19:44:07.325Z]     "error": {
[2022-11-28T19:44:07.326Z]         "code": "Unauthorized",
[2022-11-28T19:44:07.326Z]         "message": "The principal associated with access token presented with the incoming request does not have permission to send data to /subscriptions/mysubscriptionid/resourceGroups/myRG/providers/Microsoft.EventGrid/topics/myfunctionapp. Report '3840bb30-0b52-4869-a3ce-40ef9119ed42:2:11/28/2022 7:44:09 PM (UTC)' to our forums for assistance or raise a support ticket.",
[2022-11-28T19:44:07.327Z]         "details": [{
[2022-11-28T19:44:07.327Z]             "code": "Unauthorized",
[2022-11-28T19:44:07.328Z]             "message": "The principal associated with access token presented with the incoming request does not have permission to send data to /subscriptions/mysubscriptionid/resourceGroups/myRG/providers/Microsoft.EventGrid/topics/myfunctionapp. Report '3840bb30-0b52-4869-a3ce-40ef9119ed42:2:11/28/2022 7:44:09 PM (UTC)' to our forums for assistance or raise a support ticket."
[2022-11-28T19:44:07.328Z]     }]
[2022-11-28T19:44:07.329Z]   }
[2022-11-28T19:44:07.329Z] }
[2022-11-28T19:44:07.330Z]
[2022-11-28T19:44:07.330Z] Headers:
[2022-11-28T19:44:07.330Z] Server: Microsoft-HTTPAPI/2.0
[2022-11-28T19:44:07.331Z] Strict-Transport-Security: REDACTED
[2022-11-28T19:44:07.331Z] x-ms-request-id: 3840bb30-0b52-4869-a3ce-40ef9119ed42
[2022-11-28T19:44:07.332Z] Date: Mon, 28 Nov 2022 19:44:08 GMT
[2022-11-28T19:44:07.332Z] Content-Length: 941
[2022-11-28T19:44:07.333Z] Content-Type: application/json; charset=utf-8

mysubscriptionid is as shown in the function app screen: enter image description here

I'm on Microsoft Visual Studio Community 2022 (64-bit) - Current Version 17.4.1


Solution

  • The exception was caused by a log statement in the try statement, irrelevant to send to eventgrid, I can't tell how this stopped from being authorized, now it works.

    if (b_debug_contractor)
            log.LogInformation("SendRTransformMessage sent transformdata - PosX:" + machinePartTransformTelemetry[1]);