Azure-docs: Internal Server Error while using Resource Token using Java Async API (AsyncDocumentClient)

[sauravsarangi]

Hi Team,

I created a Resource Token Broker App which uses the Java Async/Sync clients to create a User and then create a Permission (for operation ALL) for that user using the Master Key. Then I get the resource token from the permission and with that I am creating a AsyncDocumentClient object passing the resource token in withMasterKeyOrResourceToken(token) method of the builder. The AsyncDocumentClient object is obtained without a problem using the Resource Token.
The problem arises when I am trying to execute any operation (a query or create a record etc.) using the AsyncDocumentClient object generated above. _An Internal Server Error (500)_ is being thrown if try to Create or query a record in the collection.

Please note that I am trying to execute the operation on the same Collection as the one the Permission was generated for. And this error comes up for any operation (be it read, write or query).The Complete Stack Trace of the Error is following:

{"code":"InternalServerError","message":"Message: {\"Errors\":[\"An unknown error occurred while processing this request.\"]}\r\nActivityId: c0f9d3ad-09a3-436c-8a78-f83176e6a966, Request URI: /apps/11854371-0a19-4fb1-9ac4-c649c99c6ee7/services/f2c217f7-2978-424a-8d27-e07ddf81bcd8/partitions/0c5b1845-c5c3-493c-9007-1d8d3bbfc85f/replicas/132025170763284322p/, RequestStats: \r\nRequestStartTime: 2019-06-05T18:49:36.4024194Z, RequestEndTime: 2019-06-05T18:49:36.4024194Z, Number of regions attempted: 1\r\nResponseTime: 2019-06-05T18:49:36.4024194Z, StoreResult: StorePhysicalAddress: rntbd://cdb-ms-prod-centralus1-fd14.documents.azure.com:16744/apps/11854371-0a19-4fb1-9ac4-c649c99c6ee7/services/f2c217f7-2978-424a-8d27-e07ddf81bcd8/partitions/0c5b1845-c5c3-493c-9007-1d8d3bbfc85f/replicas/132025170763284322p/, LSN: 917995, GlobalCommittedLsn: 917995, PartitionKeyRangeId: , IsValid: True, StatusCode: 500, SubStatusCode: 0, RequestCharge: 0, ItemLSN: -1, SessionToken: 0#917995#2=-1, UsingLocalLSN: False, TransportException: null, ResourceType: Document, OperationType: Create\r\n, SDK: Microsoft.Azure.Documents.Common/2.4.0.0, StatusCode: InternalServerError","additionalErrorInfo":null}

============================================================
Please note that the document client used in the code has been generated using a Resource Token which is ("type=resource&ver=1&sig=iHW8H/XhgDopjgumE+WmVg==;wHrUcSlYWPljpwzj4Aa/37m7n6a2CSNFgZWfxvhBOEFKwaDDnF1JgiRgdHa9VGqHZjJLhDEKnR9RA1Q+FlAoeIyIvS0w4WvUeHUZNDOWZd3Q6eDdj0iJwAf1qqIIuxi7jPapMjJNo7il8VHu9k4O1qr1TH/0JsN31M7fNblAq44lfxU4H/Ev2HNaungn+6KtGQVhyPtPB77fNH7L/eJES0TtMrFVorKy4RHsslnnPswk/HNKFnUswtw0CSmD1QUpf4DvN+rKSxm8tdGd7tgHAg==;")

The Code to create a document in the collection looks like the following:

ExecutorService executor = Executors.newSingleThreadExecutor();
Scheduler schedulerForBlockingWork = Schedulers.from(executor);

            Employee e = new Employee();
            e.setId(UUID.randomUUID().toString());
            e.setTimeStamp(new Timestamp(new Date().getTime()).toString());
            e.setStatus("Resource Token");
            e.setUpdateCount("0");

        Observable<ResourceResponse<Document>> createObservable =
                client.createDocument(collectionPath, e, null, false)
                    .subscribeOn(schedulerForBlockingWork);

        createObservable
            .observeOn(schedulerForBlockingWork)
            .subscribe(
                    page -> {

                            System.out.println("status is "+page.getResource().getId());
                    },
                    // terminal error signal
                    err -> {
                        err.printStackTrace();
                    },

                    // terminal completion signal
                    () -> {
                        System.out.println("Completed");
                    });

Please help me out on this. Let me know if you need anything else from me.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 6278ead7-854a-a291-89f3-299432737ffb
• Version Independent ID: b2b292bb-1beb-aaef-157c-7b70f5c96bdb
• Content: Learn how to secure access to data in Azure Cosmos DB
• Content Source: articles/cosmos-db/secure-access-to-data.md
• Service: cosmos-db
• GitHub Login: @rimman
• Microsoft Alias: rimman

[mimckitt]

@sauravsarangi please share the link to the document you are following so we can better assist.

[sauravsarangi]

https://docs.microsoft.com/en-us/azure/cosmos-db/secure-access-to-data

[mimckitt]

Thanks for that. We will have our CosmosDB team take a look and get back to you.

[Mike-Ubezzi-MSFT]

Which API are you consuming with this code and please provide version info for all packages used in the project: Azure Cosmos DB Async Java SDK for SQL API: Release notes and resources (link).

The pre-existing SQL API Java SDK does not support asynchronous operations.

[sauravsarangi]

groupId: com.microsoft.azure
artifactId azure-cosmosdb
version: 2.4.5
This is the Async JAVA SDK version.

[christopheranderson]

I'm Chris from the Cosmos DB engineering team.

@sauravsarangi - 500 errors are unexpected and we should treat this as a livesite issue. Even if you do have a problem with your code, we never plan on returning 500.

We should move this to a more private channel as I might have more privacy sensitive question to ask and it will be easier to engage my colleagues on email. Could you please email me at chrande (at) microsoft.com with all these details (and your DatabaseAccountName) and I'll engage our ops team with you directly to take a look and figure out what is wrong?

Thanks,
Chris

[Mike-Ubezzi-MSFT]

Are you using Cosmos DB API for MongoDB or SQL(Core) API? I see a port number that indicates possibly a Mongo deployment.

Additionally, I see a couple of items I need to clarify:

I am showing 2.4.3 as I am not seeing 2.4.5?
The Async Java SDK provides the following SDK Usage recommendations (link)

1. Use a singleton Azure Cosmos DB client for the lifetime of your application:
   Each AsyncDocumentClient instance is thread-safe and performs efficient connection management and address caching. To allow efficient connection management and better performance by AsyncDocumentClient, it is recommended to use a single instance of AsyncDocumentClient per AppDomain for the lifetime of the application.

1. Use Appropriate Scheduler (Avoid stealing Event loop IO Netty threads)
   The Async Java SDK uses netty for non-blocking IO. The SDK uses a fixed number of IO netty event loop threads (as many CPU cores your machine has) for executing IO operations. The Observable returned by API emits the result on one of the shared IO event loop netty threads. So it is important to not block the shared IO event loop netty threads. Doing CPU intensive work or blocking operation on the IO event loop netty thread may cause deadlock or significantly reduce SDK throughput.

For example the following code executes a cpu intensive work on the event loop IO netty thread:

`Observable> createDocObs = asyncDocumentClient.createDocument(
collectionLink, document, null, true);

createDocObs.subscribe(
resourceResponse -> {
//this is executed on eventloop IO netty thread.
//the eventloop thread is shared and is meant to return back quickly.
//
// DON'T do this on eventloop IO netty thread.
veryCpuIntensiveWork();
});`

The short answer might be to try using the master key in your Async Java code to see if that connects. If it doesn't connect, can you try v. 2.4.3.

[SnehaGunda]

@Mike-Ubezzi-MSFT do you want to redirect this issue to Chirs and askcosmosdb alias and track it there and close this one.

[Mike-Ubezzi-MSFT]

@sauravsarangi Please reach out to AskCosmosDB per Chris's instructions above and this will be handled directly by the engineering team. Thank you!

[sauravsarangi]

@Mike-Ubezzi-MSFT
I am aware of that part of the documentation.
The code works with Master key. But the whole idea was to restrict access to certain Collections for different users and hence Resource Tokens. I need to connect to the db and execute operations on the Collection with Resource Tokens.

I have tried version 2.4.3 but encountered same issue.
This is for SQL API.