[EventHub]"azure.eventhub.exceptions.AuthenticationError: Unable to open authentication session on connection EHProduce" on UsGov and China cloud

[v-xuto]

We are running live Tests against other clouds like US Gov and Azure China Cloud. The goal is to check whether new azure sdk package work with other clouds or not.

Error Description:
When running the Test Samples sync_samples/authenticate_with_azure_named_key_credential.py on UsGov and China cloud, it runs failed and the error message is shown as following, for more details please check here:

Error Track:
The code that failed is here：

Expected Behavior:
In file test-resources.json, EVENT_HUB_HOSTNAME is available in UsGov and China Cloud.

@benbp , @jameszliao-msft , @lmazuel , @lilyjma , @ramya-rao-a and @annatisch for notification.

[v-xuto]

@yunhaoling What are your ideas on this issue?

[yunhaoling]

hey @v-xuto , could you give some guidance on creating resources on the UsGov and China cloud? e.g. links would be helpful

[v-xuto]

@yunhaoling Creating resources is the same as in the public cloud. I don't understand your question too much.
@benbp What are your thoughts on this issue?

[yunhaoling]

@v-xuto , sorry for not making it clear.

so when I tried to create EH resource on portal.azure.come, I didn't find a location with name "China" or "US Gov" in it:

so I'm wondering whether it needs a separate dedicated subscription or the China/US Gov cloud has its own portal.

[v-xuto]

@yunhaoling The China/US Gov cloud has its own portal.

• US Gov cloud: https://portal.azure.us/
• China cloud: http://portal.azure.cn/

[yunhaoling]

thanks @v-xuto , I'll try it!

[benbp]

@yunhaoling when using the SDK you have to specify the right endpoint suffixes and tenant ids/authority hosts. Often this involves updating the ARM template to use the parameter serviceBusEndpointSuffix instead of a hardcoded value, and making sure the test credential builder uses the right tenant and authority host. Let me know if you need help.

[v-xuto]

@benbp - To resolve this issue, please help add a parameter variable to suffix .servicebus.windows.net. And in the pipeline environment, configure the corresponding endpoint suffix values for usgov and china cloud.

UsGov - .servicebus.usgovcloudapi.net
China - .servicebus.chinacloudapi.cn

[v-xuto]

@benbp Any progress? Please help configure eventHubEndpointSuffix on different clouds.

[benbp]

@v-xuto this is already available as serviceBusEndpointSuffix, for example:

    "ArmTemplateParameters": {
        "azureAuthorityHost": "https://login.chinacloudapi.cn/",
        "keyVaultDomainSuffix": ".vault.azure.cn",
        "keyVaultEndpointSuffix": ".vault.azure.cn",
        "keyVaultSku": "standard",
        "azConfigEndpointSuffix": ".azconfig.azure.cn",
        "cognitiveServicesEndpointSuffix": ".cognitiveservices.azure.cn",
        "storageEndpointSuffix": "core.chinacloudapi.cn",
        "serviceBusEndpointSuffix": ".servicebus.chinacloudapi.cn",
        "enableStorageVersioning": false,
        "textAnalyticsSku": "S"
    }

[v-xuto]

@benbp Okay. Thanks. Are you sure you set the parameter serviceBusEndpointSuffix about different clouds?

Because after I modified the file sdk/eventhub/test-resources.json, some tests in UsGov still reported the same error: azure.eventhub.exceptions.AuthenticationError: Unable to open authentication session on connection EHProduce" . For more details please check here.

However, I directly update .servicebus.windows.net to .servicebus.usgovcloudapi.net. It passed in UsGov cloud. For more details please check here:
.
So, the setting of this parameter serviceBusEndpointSuffix should not take effect. Please help to confirm again.

[benbp]

@v-xuto Ok I think there was an issue with Azure Pipelines not refreshing it's cache of the subscription configuration secrets. Sorry I didn't notice that earlier. I refreshed the cache and re-ran your failed pipeline jobs, but for some reason I think it's picking up your latest changes with the usgovcloudapi hardcoded instead of the problem commit with the serviceBusEndpointSuffix value.

[v-xuto]

@benbp After I update .servicebus.windows.net to parameters('serviceBusEndpointSuffix') and re-run pipeline, the same error was reported. The problem was not resolved. Please help me to confirm again. For more details please check here.

[benbp]

@v-xuto I'm doing some testing but the issue should be fixed now. My updating scripts were targeting the wrong secret :( I'm going to prioritize some work to move these values into a more observable place so you can update and inspect them yourself, and also support logging non-secret arm parameter values.

[v-xuto]

@benbp Thanks for your help. This issue has fixed. This is the result. I will close this issue.