How can I debug Dfm.MsSql / durablefunctionsmonitor.dotnetbackend Authentication

[rncwnd79]

Hi,

suddenly the authentication stopped working. So I wanted to debug Auth.ValidateIdentityAsync and see how the AllowedAppRoles are being matched with the roles claim.

What I tried
Dfm.MsSql.csproj:

  ...
  <ItemGroup>
    <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.0" />
    <PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.4.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.DurableTask" Version="2.13.3" />
    <PackageReference Include="Microsoft.DurableTask.SqlServer.AzureFunctions" Version="1.3.0" />
	  <!--PackageReference Include="durablefunctionsmonitor.dotnetbackend" Version="6.5.0" /-->
  </ItemGroup>
  <ItemGroup>
    <ProjectReference Include="..\..\durablefunctionsmonitor.dotnetbackend\durablefunctionsmonitor.dotnetbackend.csproj" />
  </ItemGroup>
  ...

Now when I start to debug in Visual Studio 2022, only the default Functions webpage is displayed, and the log show:

[2024-10-16T11:33:23.085Z] Starting JobHost
[2024-10-16T11:33:23.096Z] Starting Host (HostId=y105n00but-786125418, InstanceId=076227f3-0884-40bf-ad4d-f3751d1aac34, Version=4.834.3.22875, ProcessId=3700, AppDomainId=1, InDebugMode=False, InDiagnosticMode=False, FunctionsExtensionVersion=(null))
[2024-10-16T11:33:23.110Z] Loading functions metadata
[2024-10-16T11:33:23.117Z] Reading functions metadata (Host)
[2024-10-16T11:33:23.502Z] 0 functions found (Host)
[2024-10-16T11:33:23.611Z] Reading functions metadata (Custom)
[2024-10-16T11:33:23.751Z] 1 functions found (Custom)
[2024-10-16T11:33:23.830Z] 0 functions loaded
[2024-10-16T11:33:23.898Z] Generating 0 job function(s)
[2024-10-16T11:33:23.941Z] No job functions found. Try making your job classes and methods public. If you're using binding extensions (e.g. Azure Storage, ServiceBus, Timers, etc.) make sure you've called the registration method for the extension(s) in your startup code (e.g. builder.AddAzureStorage(), builder.AddServiceBus(), builder.AddTimers(), etc.).
[2024-10-16T11:33:23.968Z] HttpOptions
[2024-10-16T11:33:23.970Z] {
[2024-10-16T11:33:23.972Z]   "DynamicThrottlesEnabled": false,
[2024-10-16T11:33:23.973Z]   "EnableChunkedRequestBinding": false,
[2024-10-16T11:33:23.978Z]   "MaxConcurrentRequests": -1,
[2024-10-16T11:33:23.979Z]   "MaxOutstandingRequests": -1,
[2024-10-16T11:33:23.969Z] Initializing function HTTP routes
[2024-10-16T11:33:23.981Z] No HTTP routes mapped
[2024-10-16T11:33:23.982Z]
[2024-10-16T11:33:23.980Z]   "RoutePrefix": ""
[2024-10-16T11:33:23.984Z] }
[2024-10-16T11:33:23.989Z] Host initialized (883ms)
[2024-10-16T11:33:23.993Z] Host started (893ms)
[2024-10-16T11:33:23.995Z] Job host started
[2024-10-16T11:33:27.987Z] Host lock lease acquired by instance ID '000000000000000000000000A4E58D67'.

What's the trick?

Thanks for looking into this.

[scale-tone]

Try adding these into your .CSPROJ file: <PropertyGroup> <!-- Tells microsoft.net.sdk.functions to include DFM's dll to metadata generation --> <FunctionsInDependencies>true</FunctionsInDependencies> <!-- Fix for Azure/azure-functions-host#5894 --> <_FunctionsSkipCleanOutput>true</_FunctionsSkipCleanOutput> </PropertyGroup> For the context, when you add DfMon's NuGet package, those settings are added by this .targets file: DurableFunctionsMonitor/durablefunctionsmonitor.dotnetbackend/durablefunctionsmonitor.dotnetbackend.targets at main · microsoft/DurableFunctionsMonitor (github.com) <https://github.com/microsoft/DurableFunctionsMonitor/blob/main/durablefunctionsmonitor.dotnetbackend/durablefunctionsmonitor.dotnetbackend.targets> , but since you're now referencing it as a project, you don't get them.

…

On Wed, Oct 16, 2024 at 1:35 PM rncwnd79 ***@***.***> wrote: Hi, suddenly the authentication stopped working. So I wanted to debug Auth.ValidateIdentityAsync and see how the AllowedAppRoles are being matched with the roles claim. *What I tried* Dfm.MsSql.csproj: ... <ItemGroup> <PackageReference Include="Microsoft.Data.SqlClient" Version="5.2.0" /> <PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.4.0" /> <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.DurableTask" Version="2.13.3" /> <PackageReference Include="Microsoft.DurableTask.SqlServer.AzureFunctions" Version="1.3.0" /> <!--PackageReference Include="durablefunctionsmonitor.dotnetbackend" Version="6.5.0" /--> </ItemGroup> <ItemGroup> <ProjectReference Include="..\..\durablefunctionsmonitor.dotnetbackend\durablefunctionsmonitor.dotnetbackend.csproj" /> </ItemGroup> ... Now when I start to debug in Visual Studio 2022, only the default Functions webpage is displayed, and the log show: [2024-10-16T11:33:23.085Z] Starting JobHost [2024-10-16T11:33:23.096Z] Starting Host (HostId=y105n00but-786125418, InstanceId=076227f3-0884-40bf-ad4d-f3751d1aac34, Version=4.834.3.22875, ProcessId=3700, AppDomainId=1, InDebugMode=False, InDiagnosticMode=False, FunctionsExtensionVersion=(null)) [2024-10-16T11:33:23.110Z] Loading functions metadata [2024-10-16T11:33:23.117Z] Reading functions metadata (Host) [2024-10-16T11:33:23.502Z] 0 functions found (Host) [2024-10-16T11:33:23.611Z] Reading functions metadata (Custom) [2024-10-16T11:33:23.751Z] 1 functions found (Custom) [2024-10-16T11:33:23.830Z] 0 functions loaded [2024-10-16T11:33:23.898Z] Generating 0 job function(s) [2024-10-16T11:33:23.941Z] No job functions found. Try making your job classes and methods public. If you're using binding extensions (e.g. Azure Storage, ServiceBus, Timers, etc.) make sure you've called the registration method for the extension(s) in your startup code (e.g. builder.AddAzureStorage(), builder.AddServiceBus(), builder.AddTimers(), etc.). [2024-10-16T11:33:23.968Z] HttpOptions [2024-10-16T11:33:23.970Z] { [2024-10-16T11:33:23.972Z] "DynamicThrottlesEnabled": false, [2024-10-16T11:33:23.973Z] "EnableChunkedRequestBinding": false, [2024-10-16T11:33:23.978Z] "MaxConcurrentRequests": -1, [2024-10-16T11:33:23.979Z] "MaxOutstandingRequests": -1, [2024-10-16T11:33:23.969Z] Initializing function HTTP routes [2024-10-16T11:33:23.981Z] No HTTP routes mapped [2024-10-16T11:33:23.982Z] [2024-10-16T11:33:23.980Z] "RoutePrefix": "" [2024-10-16T11:33:23.984Z] } [2024-10-16T11:33:23.989Z] Host initialized (883ms) [2024-10-16T11:33:23.993Z] Host started (893ms) [2024-10-16T11:33:23.995Z] Job host started [2024-10-16T11:33:27.987Z] Host lock lease acquired by instance ID '000000000000000000000000A4E58D67'. What's the trick? Thanks for looking into this. — Reply to this email directly, view it on GitHub <#215>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABJR4FTEUNKCAD5RHXDJQQ3Z3ZFQHAVCNFSM6AAAAABQBIBCRWVHI2DSMVQWIX3LMV43ERDJONRXK43TNFXW4OZXGMZDMMRSGY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[rncwnd79]

Thanks so much.
Here is what I found out:

The Entra ID JWT contains this:

...
"roles": [
    "DFM.Read"
],
...

but principal.Claims contains this:
http://schemas.microsoft.com/ws/2008/06/identity/claims/role

The default configuration of DFM_ROLES_CLAIM_NAME = roles, so after setting DFM_ROLES_CLAIM_NAME = http://schemas.microsoft.com/ws/2008/06/identity/claims/role authentication works.

Strange:
On another stage we configured DFM_ROLES_CLAIM_NAME = app_roles, and the JWT also contains app_roles. This works since months.
No custom claims are configured on the app registration / enterprise application. Something supernatural seems to happen...

[scale-tone]

Great to know that it works now.

I can only confirm, that roles claim can appear to have different names in different environments and scenarios, and that's precisely why DfMon has DFM_ROLES_CLAIM_NAME setting.