Azure Service Bus UnauthorizedException when using Managed Identity

When using Managed Identity to authenticate towards Azure Service Bus we get an UnauthorizedException when publishing a message with following error message: Microsoft.Azure.ServiceBus.UnauthorizedException: ‘claim is empty. TrackingId:daa79edb-af0f-42d0-8583-b5d6006d1815_G5, SystemTracker:NoSystemTracker, Timestamp:2020-03-13T08:22:50’

Gist to reproduce: https://gist.github.com/mathiasbl/9c779c8d09a3a2807b0d10679959d81b How to setup managed identity: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-managed-service-identity My app and myself have the service bus owner role.

MassTransit.Azure.ServiceBus.Core: 5.5.6

Stack: 2020-03-12 {“Message”:“claim is empty. TrackingId:dc3767cf-a902-4014-bd6d-df8e7f81ac26_G7, SystemTracker:NoSystemTracker, Timestamp:2020-03-12T09:45:23”, “IsTransient”:false, “Data”:{}, “TargetSite”:“Void MoveNext()”, “StackTrace”:" at Microsoft.Azure.ServiceBus.Management.ManagementClient.SendHttpRequest(HttpRequestMessage request, CancellationToken cancellationToken) at Microsoft.Azure.ServiceBus.Management.ManagementClient.GetEntity(String path, String query, Boolean enrich, CancellationToken cancellationToken) at Microsoft.Azure.ServiceBus.Management.ManagementClient.GetTopicAsync(String topicPath, CancellationToken cancellationToken) at Microsoft.Azure.ServiceBus.Management.ManagementClient.TopicExistsAsync(String topicPath, CancellationToken cancellationToken) at MassTransit.Azure.ServiceBus.Core.Contexts.NamespaceManager.<>c__DisplayClass25_01.<<RunOperation>b__0>d.MoveNext() --- End of stack trace from previous location where exception was thrown --- at Microsoft.Azure.ServiceBus.RetryPolicy.RunOperation(Func1 operation, TimeSpan operationTimeout) at Microsoft.Azure.ServiceBus.RetryPolicy.RunOperation(Func1 operation, TimeSpan operationTimeout) at MassTransit.Azure.ServiceBus.Core.Contexts.NamespaceManager.RunOperation[T](Func1 operation) at MassTransit.Azure.ServiceBus.Core.Contexts.ServiceBusNamespaceContext.CreateTopic(TopicDescription topicDescription) at MassTransit.Azure.ServiceBus.Core.Pipeline.ConfigureTopologyFilter1.ConfigureTopology(NamespaceContext context) at MassTransit.Azure.ServiceBus.Core.Pipeline.ConfigureTopologyFilter1.<>c__DisplayClass6_0.<<Send>b__0>d.MoveNext() — End of stack trace from previous location where exception was thrown — at GreenPipes.PipeExtensions.OneTimeSetup[T](PipeContext context, Func2 setupMethod, PayloadFactory1 payloadFactory) at MassTransit.Azure.ServiceBus.Core.Pipeline.ConfigureTopologyFilter1.Send(NamespaceContext context, IPipe1 next) at GreenPipes.Agents.AsyncPipeContextPipe1.Send(TContext context) at GreenPipes.Agents.PipeContextSupervisor1.GreenPipes.IPipeContextSource<TContext>.Send(IPipe1 pipe, CancellationToken cancellationToken) at GreenPipes.Agents.PipeContextSupervisor1.GreenPipes.IPipeContextSource<TContext>.Send(IPipe1 pipe, CancellationToken cancellationToken) at GreenPipes.Agents.PipeContextSupervisor1.GreenPipes.IPipeContextSource<TContext>.Send(IPipe1 pipe, CancellationToken cancellationToken) at MassTransit.Azure.ServiceBus.Core.Pipeline.JoinContextFactory3.<>c__DisplayClass8_0.<<CreateJoinContext>g__Join|0>d.MoveNext() — End of stack trace from previous location where exception was thrown — at MassTransit.Azure.ServiceBus.Core.Pipeline.TopicSendEndpointContextFactory.CreateSharedContext(Task1 context, CancellationToken cancellationToken) at GreenPipes.Agents.PipeContextSupervisor1.GreenPipes.IPipeContextSource<TContext>.Send(IPipe1 pipe, CancellationToken cancellationToken) at GreenPipes.Agents.PipeContextSupervisor1.GreenPipes.IPipeContextSource<TContext>.Send(IPipe1 pipe, CancellationToken cancellationToken) at GreenPipes.Agents.PipeContextSupervisor1.GreenPipes.IPipeContextSource<TContext>.Send(IPipe1 pipe, CancellationToken cancellationToken) at MassTransit.Transports.PublishEndpoint.Publish[T](CancellationToken cancellationToken, T message, PublishEndpointPipeAdapter1 adapter) at MassTransit.Transports.PublishEndpoint.Publish[T](CancellationToken cancellationToken, T message, PublishEndpointPipeAdapter`1 adapter)

[phatboyg]

Right, it causes issues with RBAC I guess. And click on one of the topics and it will show you.

[mathiasbl]

Seems like MassTransit 5.x.x is using “~” to separate namespace and the message name while 6.x.x is using “/”. The “/” and “~” is causing issues when using RBAC.

Topic: https://stackoverflow.com/questions/58288680/rbac-issues-using-masstransit-with-azure-service-bus-and-msi-authentication