Azure Storage: 403 Server failed to authenticate the request - c#

I've search here and in Google but I can't find a solution.
With my C# code I want to read a file from Azure Storage Blob.
The code (only 6 line) works very well in another project (Windows 8.1 Universal App) but not in my new Windows 10 UWP App.
This is my code:
CloudStorageAccount storageAccount = CloudStorageAccount.Parse(azureConnectionString);
CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();
CloudBlobContainer container = blobClient.GetContainerReference("container-name");
CloudBlob b1 = container.GetBlobReference("27.76914.json");
StorageFile file = await ApplicationData.Current.LocalFolder.CreateFileAsync("stefano1.json", CreationCollisionOption.ReplaceExisting);
await b1.DownloadToFileAsync(file);
The Exception:
Server failed to authenticate the request. Make sure the value of
Authorization header is formed correctly including the signature.
Using Fiddler4 I found this error on message 403:
The MAC signature found in the HTTP request 'R2t9hKsyXf470HF2LNP8T+M2nci0ddE/ojQ0r4UVjJQ=' is not the same as any computed signature
My attempts:
The application works the first time (file downloaded). The second time I get the Exception.
If I change the requested file name: the application works the first time (file downloaded). The second time I get the Exception.
The next day I get immediately the same exception (at first run)
Also if I delete bin and obj folders I get the error
If I create another application and try to download the same file (same as point 1), it works the first time, but not the second.
In a Console Application all works well.
This is the Fiddler4 Raw Request (where ***** is my Azure Storage Account Name):
GET https://*****.blob.core.windows.net/container-name/27.76914.json HTTP/1.1
x-ms-client-request-id: accee7e7-646d-417a-b734-1591cbc16a8d
x-ms-date: Thu, 03 Sep 2015 06:31:37 GMT
x-ms-version: 2015-02-21
User-Agent: WA-Storage/5.0.2 (Windows Runtime)
Authorization: SharedKey *****:R2t9hKsyXf470HF2LNP8T+M2nci0ddE/ojQ0r4UVjJQ=
Host: *****.blob.core.windows.net
If-Modified-Since: Sun, 30 Aug 2015 18:52:41 GMT
If-None-Match: "0x8D2B16C2ED82C4A"
Connection: Keep-Alive
Thank you!

This was also reported on our GitHub page here: https://github.com/Azure/azure-storage-net/issues/171
Our leading theory is that a caching proxy might be in between the client and the server affecting your requests.
We're still investigating and will let you know.

I've had a similar issue (in Java) trying to access blobs from local machine.
Trying to download a blob would work one out of two times, trying to get an InputStream never worked. In both cases the error was the same as yours.
My code always worked from a VM in the cloud.
The issue was fixed when I've changed the default protocol from HTTP to HTTPS.
When constructing your CloudStorageAccount, there is a constructor that allows you to specify the default protocol. It's also available for C# (here)
Also for the record, AZCopy will fail for a source with HTTP, with similar error.
You might give it a try.

Related

Connect to Azure blob storage on custom domain

I have problem downloading files from this blob storage on our custom domain with HTTPS.
I can download it through the browser if I make anonymous access on the custom domain.
I can download it through the Nuget package called Azure.Storage.Blobs with this connection string.
DefaultEndpointsProtocol=https;AccountName=websocketechoblobdev;AccountKey=xxxx;EndpointSuffix=core.windows.net
If I try to download it through the Nuget package called Azure.Storage.Blobs with this connection string.
DefaultEndpointsProtocol=https;AccountName=websocketechoblobdev;AccountKey=xxxx;BlobEndpoint=https://websocketechotest.opnbibliotheca.com
I get this error:
Response x-ms-client-request-id 'e0e7c66d-0629-43f3-85a7-79034ae77d03' does not match the original expected request id, 'e18050d9-6057-43fe-aaa0-5e41e9aa410c'.
Status: 200 (OK)
Headers:
Content-MD5: /iAiKhL83XuGqgNErvqdpg==
X-Cache: REDACTED
x-ms-request-id: 89bbe80a-101e-002f-048f-3e59dc000000
x-ms-client-request-id: e0e7c66d-0629-43f3-85a7-79034ae77d03
x-ms-version: 2021-04-10
x-ms-creation-time: Mon, 14 Mar 2022 12:29:32 GMT
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
x-ms-server-encrypted: true
X-Azure-Ref-OriginShield: REDACTED
X-Azure-Ref: REDACTED
Accept-Ranges: bytes
Content-Length: 3459
Content-Type: application/x-pkcs12
Date: Wed, 23 Mar 2022 10:28:19 GMT
ETag: '0x8DA05B64AED6E28'
Last-Modified: Mon, 14 Mar 2022 12:29:32 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
I found out that it works the first time I download the file but it fails with the exception above after that, it doesn't help to restart the program.
It has something to do with it being HTTPS, if I set it up to HTTP it works.
Thanks
• Kindly please check the CNAME records created for the custom domain link used for blob storage in the second connection string as it should point to the hostname of your blob storage endpoint. Thus, creating the appropriate DNS records required for redirecting the access requests to the blob storage endpoint will ensure that the communication is successful, validated, and authentic.
For more information on the above to map the custom domain correctly to the Azure blob storage, please refer to the documentation link below: -
https://learn.microsoft.com/en-us/azure/storage/blobs/storage-custom-domain-name?tabs=azure-portal#map-a-custom-domain-with-zero-downtime
• Secondly, would request you to please ‘Empty the cache and hard refresh’ the browser from where you are trying to access the Azure blob storage. Also, even though you might be trying to download the files from the blob storage through a program code using the connection string, please ensure that the code editor has been cleared of all the cache and temporary files and then the files from the blob storage are downloaded. This might negate the issue of the ‘x-ms-client-request-id’ header attribute being altered before leaving the ‘Azure.Storage.Blobs’ SDK.
• Finally, please take note that the custom domain name for any component of Azure storage only works for HTTP and not for HTTPS while the anonymous access enabled for the Azure blob containers from which files are to be downloaded are made publicly accessible as they are only supported for custom domain name access.

Unable to create a Team programmatically

I have successfully created Office 365 Group, added members and owners and now I am trying to provision a Team for this group. How am I supposed to provision it using MS Graph in .NET Console App?
I tried the following code but I am not getting my Team.
var team = new Team
{
GuestSettings = new TeamGuestSettings
{
AllowCreateUpdateChannels = false,
AllowDeleteChannels = false
}
};
await graphServiceClient.Groups[groupID].Team.Request().CreateAsync(team);
Response from the above code
Message: No HTTP resource was found that matches the request URI 'https://api.teams.skype.com/v1.0/groups('da87fc59-403b-4b0f-973f-f812d41143aa')/team'.
Inner error
Error Screenshot
Edit: I am using latest NUGET package for MS Graph extensions.
Edit 2: Tried to do following instead.
await graphServiceClient.Groups[groupID].Team.Request().PutAsync(team);
Got this:
Code: UnauthorizedAccess
Message: Failed to execute Aad backend request GetTenantSubscribedSkusRequest. Request Url: https://graph.windows.net/dc7b2a82-XXXX-XXXX-XXXX-46122279d033/subscribedSkus?api-version=1.6, Request Method: GET, Response Status Code: Unauthorized, Response Headers: ocp-aad-diagnostics-server-name: HmmXXX+7Su9HNJVjwqsmVjPsrXXXXXXXX/iNwuI3H74=
request-id: 9257706c-XXXX-XXXX-XXXX-bbf33b98da7d
client-request-id: f263695b-XXXX-XXXX-XXXX-9fdf185fXXXX
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Wed, 19 Jun 2019 13:20:18 GMT
Any suggestions?
Microsoft document says
If the group was created less than 15 minutes ago, it's possible for
the Create team call to fail with a 404 error code due to replication
delays. The recommended pattern is to retry the Create team call three
times, with a 10 second delay between calls.
I faced this issue and after the retry logic as suggested above it works fine all the time
Make sure you are using a Delegated authentication context (a user must be signed in) with the permission Group.ReadWrite.All
Make sure you have consented to the application permissions (from the API permissions screen of the application registration, you'll find a Grant Consent button all the way down)
Use the PutAsync method (today, as you mentioned, you must create the Office 365 group first and then enable Teams)
Can you confirm that the group actually gets created? "No HTTP resource was found that matches the request URI" often means that the graphServiceClient.Groups[groupID] doesn't work. Which is likely around permissions.
I noticed I have the same problem with application permissions. The one thing I have found that will unblock the code to work again is to create a team through the Graph Explorer and then I am good for a couple days.
Then the error comes back again and I create another team through the explorer and I can start creating like before. This tells me it is not a code problem but an issue on the Teams graph connection somewhere.
It was a service bug. Works now.
Link to service bug on GitHub

HTTP 403 Server failed to authenticate the request when downloading Blob image from azure [duplicate]

I've search here and in Google but I can't find a solution.
With my C# code I want to read a file from Azure Storage Blob.
The code (only 6 line) works very well in another project (Windows 8.1 Universal App) but not in my new Windows 10 UWP App.
This is my code:
CloudStorageAccount storageAccount = CloudStorageAccount.Parse(azureConnectionString);
CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();
CloudBlobContainer container = blobClient.GetContainerReference("container-name");
CloudBlob b1 = container.GetBlobReference("27.76914.json");
StorageFile file = await ApplicationData.Current.LocalFolder.CreateFileAsync("stefano1.json", CreationCollisionOption.ReplaceExisting);
await b1.DownloadToFileAsync(file);
The Exception:
Server failed to authenticate the request. Make sure the value of
Authorization header is formed correctly including the signature.
Using Fiddler4 I found this error on message 403:
The MAC signature found in the HTTP request 'R2t9hKsyXf470HF2LNP8T+M2nci0ddE/ojQ0r4UVjJQ=' is not the same as any computed signature
My attempts:
The application works the first time (file downloaded). The second time I get the Exception.
If I change the requested file name: the application works the first time (file downloaded). The second time I get the Exception.
The next day I get immediately the same exception (at first run)
Also if I delete bin and obj folders I get the error
If I create another application and try to download the same file (same as point 1), it works the first time, but not the second.
In a Console Application all works well.
This is the Fiddler4 Raw Request (where ***** is my Azure Storage Account Name):
GET https://*****.blob.core.windows.net/container-name/27.76914.json HTTP/1.1
x-ms-client-request-id: accee7e7-646d-417a-b734-1591cbc16a8d
x-ms-date: Thu, 03 Sep 2015 06:31:37 GMT
x-ms-version: 2015-02-21
User-Agent: WA-Storage/5.0.2 (Windows Runtime)
Authorization: SharedKey *****:R2t9hKsyXf470HF2LNP8T+M2nci0ddE/ojQ0r4UVjJQ=
Host: *****.blob.core.windows.net
If-Modified-Since: Sun, 30 Aug 2015 18:52:41 GMT
If-None-Match: "0x8D2B16C2ED82C4A"
Connection: Keep-Alive
Thank you!
This was also reported on our GitHub page here: https://github.com/Azure/azure-storage-net/issues/171
Our leading theory is that a caching proxy might be in between the client and the server affecting your requests.
We're still investigating and will let you know.
I've had a similar issue (in Java) trying to access blobs from local machine.
Trying to download a blob would work one out of two times, trying to get an InputStream never worked. In both cases the error was the same as yours.
My code always worked from a VM in the cloud.
The issue was fixed when I've changed the default protocol from HTTP to HTTPS.
When constructing your CloudStorageAccount, there is a constructor that allows you to specify the default protocol. It's also available for C# (here)
Also for the record, AZCopy will fail for a source with HTTP, with similar error.
You might give it a try.

Problems calling Magento SOAP V2 Service in C#

I'm hosting a magento webshop on my local machine using IIS 7.5 and PHP 5.6 (testing). The shop is working just fine, but now I want to create a separate application using visual studio 2013. These are the steps that I've taken:
I've added the domain name "www.domain.com.local" to my hosts file directing to my localhost (www.domain.com.local -> 127.0.0.1)
I've created a new website on my IIS and added a new binding (www.domain.com.local - see 1)
I've added WinCache extension with the PHP Manager and set the PHP version to 5.6
Enable WS-I Compliance in the magento backend (System > Configuration > Magento Core Api)
Create a SOAP Role and User (Resource Access = All)
Open visual studio 2013 and create a new Console Application
Adding a new Service Reference (http://www.domain.com.local/index.php/api/v2_soap/?wsdl)
Trying to login - This is not working like it should be
Here is my piece of code:
class Program
{
static void Main(string[] args)
{
MainAsync(args).Wait();
}
static async Task MainAsync(string[] args)
{
using (var proxy = new Mage_Api_Model_Server_Wsi_HandlerPortTypeClient())
{
try
{
var loginResponse = await proxy.loginAsync("soap-admin", "xxxxxxxxx"); // api key
var sessionId = loginResponse.result;
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
}
Console.ReadLine();
}
}
}
And this is the error I'm getting:
The content type text/xml; charset=utf-8,text/xml; charset=utf-8 of the response message does not match the content type of the binding (text/xml; charset=utf-8). If using a custom encoder, be sure that the IsContentTypeSupported method is implemented properly. The first 297 bytes of the response were: '<?xml version="1.0" encoding="utf-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="urn:Magento">
<SOAP-ENV:Body>
<ns1:loginResponseParam>
<result>13fa067676759c3ce8ddd61c386b6d5c</result>
</ns1:loginResponseParam>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
'.
So as you can see, I'm getting my sessionId but keep getting this error. I've also used fiddler to investigate and getting a correct response: HTTP 200 OK. Does someone knows what the problem could be? Is it IIS related? localhost related?
(When I add the url as web reference it works just fine - old webservice method).
Related topics I've read and tried (without success):
C# SOAP - Error in deserializing body of reply message (Magento API)
C#+Magento API V2:The content type text/xml; charset=utf-8,text/xml; charset=UTF-8 of the response message does not match
If got this answer from Rian at Magento Stack Exchange. All credits go to Rian
The solution:
The problem you're experiencing is that .NET/C# is having trouble parsing the content type Magento is sending along with it's response. SOAP is notoriously finicky about receiving just the right stuff in just the right format. Couple that with PHP's rather poor implementation of the protocol and you're in for a lot of fun.
I'm looking at a Magento 1.9 for the following information:
After some digging I found that the header for the SOAP calls are set in app/code/core/Mage/Api/Model/Server/V2/Adapter/Soap.php on line 52.
51. ->clearHeaders()
52. ->setHeader('Content-Type','text/xml; charset='.$apiConfigCharset)
53. ->setBod...
Note that that Content-Type header matches your text/xml; charset=utf-8 desired charset. Adjusting line 52 to:
52. ->setHeader('Content-Type','text/xml; charset='.$apiConfigCharset, true)
tells Magento to force overwriting that header if it's already set.
Make sure to make a copy of the file with it's full path to the app/code/local/Mage/... to avoid overwriting core files. You'll thank me when you want to upgrade Magento at some point.
Also, make sure to look carefully, there's two setHeader() calls in that file.
And finally, there's also a WS-I compliant SOAP adapter available, the same fix applies to that file. You can find it in app/code/core/Mage/Api/Model/Server/Wsi/Adapter/Soap.php.

Error posting to Amazon Web Services Kinesis with .NET SDK

I was hoping one of you could help me with the use of AWS Kinesis. I have been pouring over the documentation and I am still unable to post a "blob" of data to a Kinesis stream.
In the API the standard POST request is as follows.
POST / HTTP/1.1
Host: kinesis.<region>.<domain>
x-amz-Date: <Date>
Authorization: AWS4-HMAC-SHA256 Credential=<Credential>, SignedHeaders=contenttype;
date;host;user-agent;x-amz-date;x-amz-target;x-amzn-requestid, Signature=<Signature>
User-Agent: <UserAgentString>
Content-Type: application/x-amz-json-1.1
Content-Length: <PayloadSizeBytes>
Connection: Keep-Alive
X-Amz-Target: Kinesis_20131202.PutRecord
{
"StreamName": "exampleStreamName",
"Data": "XzxkYXRhPl8x",
"PartitionKey": "partitionKey"
}
Using "Postman" a google chrome app to make Http requests and filling in the appropriate information for the above fields I cannot for the life of me figure out how to make a successful data post to a stream. I was unable to do this successfully so i went on to do use the .NET SDK for visual studio.
I made a quick command line c# console application I am still having some issues.
My code:
http://pastebin.com/cyJeC0vU
The error message, System.Xml.XmlException was unhandled, appears on line 61 of the code: http://pastebin.com/HEG7DmMw
Has anyone had a successful experience using AWS Kinesis. I would love to pick your brain / repay you somehow for a bit of tutoring.
Thanks again for all of your help!
The error you're getting indicates that the response from the service was not able to be parsed. There is a clue in that the SDK switched from the JSON parser to the XML parser because the response looked like XML. This usually indicates that you are behind a proxy which requires authentication, and the proxy is giving you an HTML error message.
You can verify this by firing up a protocol analyzer like Fiddler and watching the request traffic. If your proxy requires credentials, here is some documentation about using the AWS SDK for .NET with proxies:
Configuring Credentials for Your AWS SDK for .NET Application

Categories