What is this?

Some time ago, I got this message when executing a Custom Connector from a Logic App. The response was very strange, and was returned in that object way that an HTTP action sometimes does:

{
'$content-type': 'application/octet-stream',
'$content': 'eyJjb2RlIjogIkFwaURpc2FibGVkIiwgIm1lc3NhZ2UiOiAiQVBJIGhhcyBiZWVuIGRpc2FibGVkIGR1ZSB0byBpbmFjdGl2aXR5LiBQbGVhc2UgdXBkYXRlIHRoZSBDdXN0b20gQ29ubmVjdG9yIHRvIGVuYWJsZSBpdCBhZ2Fpbi4ifQ=='
}

Running the $content thing thru a Base64 decoder I got back:

{'code': 'ApiDisabled', 'message': 'API has been disabled due to inactivity. Please update the Custom Connector to enable it again.'}

The connector had been … disabled?!!! Does this seem familiar?

What to do (short term)

The very short version is to update the connector. To basically force Azure to deploy it again. To solve this I simply added a space in the description-field and clicked Update Connector. Done.

Why did this happen?

I raised a ticket with MS Support and got a very clear answer: They used to disable connectors that had not been used for 30 days. Why? They did not say, only that they no longer have that policy. I think it was due to the datacenter being close to overloaded (thanks Covid-19) and they wanted to remove unused resources.

What to do (long term)

You need to look at your connectors and find all those that have not been used for a while. The Enfo support team checked the run history of all Logic Apps that uses Custom Connectors. If a Logic App had not been run for a long time, they updated the connector behind it. I think you should do this as well. In our case it was easy, two Logic Apps had not been run for two months and all others are running on a daily basis.

Get to updating your connectors.

What is this?

I do not know how many times I have looked for an article explaining the just make it work part of how to authenticate to Azure from an application calling an Azure API. I usually find myself in a very long article on scope and OAUTH vs OAUTH2 vs OpenID.

This is more for me as documentation and perhaps for you as well, and it will not go thru why you should configure anything in a particular way. It is just a make it work.

If you do not know how to create an App Registration (necessary for login) or how to get the information used below, I have created a post here.

The three stages of logging in

1. Get the information you need.
2. Login to get a Token
3. Use the Token in an API-call.

Getting the information you need

You will need:

1. A Client ID
2. A Client Secret
3. The Azure Tenant ID
4. Know which resource you are using

The 1, 2 and 3

The Client ID and the Tenant ID you can get from the App Registration Overview page of your app.

The client secret is either something you previously saved or something you created. Take a look at my post. Click on “Create the App Secret” in the Table of contents at the top if you need more information on how to create a secret.

The resource

This is the only tricky part.

• If you need to manipulate about 90% of Azure you use https://management.azure.com/
• If you are login into Storage Account you should/could use https://storage.azure.com/

Postman

The number one client for calling and testing APIs.

Login to get a Token (with Postman)

Gather all the information you have above and lets get to configuring. You can use variables and environment settings for these.

• Set the URI to: https://login.microsoftonline.com/[Tenant ID Goes here]/oauth2/token
• Set the verb to POST.
• Set the format of the body to form-data
• Fill in the data:
  • client_id: Your Client ID
  • client_secret: Your client secret (password)
  • resource: see heading just above this
  • grant_type: client_credentials
• Click Send and receive your access-token.

  

  Bonus content for Postman

  If you want to be fancy, add a script to the test part and assign the token to a local variable for use in other calls.

  pm.test(pm.info.requestName, () => {
  pm.response.to.not.be.error;
  pm.response.to.not.have.jsonBody('error');
  });
  pm.environment.set("<your variable>", pm.response.json().access_token);

  Use the token in the API-call (with Postman)

  Now that you have your token, you can use it in other calls.

• Simply click Authorization
• In the dropdown select Bearer Token and paste your token in the token-field to the right. If you used the fancy script, use the variable instead.

  

• Done!

What is this?

There are a lot of articles out there on how to setup an App Registration in Azure. Most of them contains a lot of useful information on why, rather than how.

This article is only about the how.

What you need to do

1. Log into Azure
2. Find the App Registration page.
3. Create the App registration
4. Create the App Secret
5. Where to find information you will probably need later.

The process

Login to Azure

Come on you know this. Why are you even reading this step?

Find the App Registration Page

The easiest way of doing this is to use the search field at the top of the page. Just type App Reg and it should pop up.

Select it.

Create the App Registration

On the start page for App Registration, click New Registration at the top left.

• Give it a useful name. Better than MyDemoApp
• Make sure the top radio button is selected.
• Leave the Redirect URI blank and click the Register Button

  

Create the App Secret

The session

I am a co-admin of the Azure Meetup Stockholm group. We usually host sessions on anything Azure related at an office and usually in the evening. Due to the current situation, corona, we decided to move the sessions to YouTube. I did my first session this Monday (1st of June 2020).

The session is on how you can achieve full redundancy between different Azure data centers in the event of an outage, the challenges this poses and a proposed solution. It also contains a fair bit on more hard core computer science, trying to explain why it is impossible to reach 100%.

Session link.

This request is not authorized to perform this operation using this permission?! WTF?!

The issue

You are using AAD with OAUTH to access Azure Storage, configured as a DataLake. You get an error that looks like this:

This request is not authorized to perform this operation using this permission.

According to other sites the reason might bee that you have not added your user (or application) to the correct group, or according to others that the storage is configured with a firewall and lastly according to the official documentation it might be a malformed token among other things.

The solution

All those other reasons might be correct but I found another thing: The Datalake resource type is not registered for your subscription. I know, I do not know why you need to do that either but here goes.

The TLDR

Open the subscription on the root level, find resource providers and add Microsoft.DatalakeStore

The full story

The resource is not configured as usable from your subscription and it has to be enabled, or registered. This is the more hardcore way of not allowing certain services to be used in a subscription.

1. Find the affected subscription. I usually use the menu on the left or search for it in the search-box.
2. In the left menu of the subscription, scroll down to settings and find the “Resource providers” setting and click it

   

3. In the filterbox at the top of the list type datalake and you will get this list.

   

4. Select the Microsoft.DatalakeStore option. (Marked #2 in the picture)
5. Click Register (Marked #3 in the picture). The picture is taken after the registration was done.
6. Wait, done, retry your API-call.

There might be access issues with registering providers in a subscription. You have to be an Owner or a contributor to do it but the good news is that it only needs to be done once per subscription.