Azure-iot-sdk-csharp: Device group provisioning not working.

[DataWerkt]

I've managed to get the certifcates installed with the C SDK cert generation tool. Unfortunately the result is like shown below.

Enter the PFX password for C:\Users\MatthijsHoogwerf\azure-iot-sdk-c\tools\CACertificates\TestDevice1.pfx:

Found certificate: BAFC3540746261DDD6F347B54475D38E47D8B8ED CN=Azure IoT CA TestOnly Root CA; PrivateKey: False
Found certificate: B8059A3D2F001AE6BE4DEFB5AFB63EBACB60B035 CN=TestDevice1; PrivateKey: True
Using certificate B8059A3D2F001AE6BE4DEFB5AFB63EBACB60B035 CN=TestDevice1
RegistrationID = TestDevice1
ProvisioningClient RegisterAsync . . .
Unhandled Exception: Microsoft.Azure.Devices.Provisioning.Client.ProvisioningTransportException: AMQP transport exception: service error.
Service Error: 400004 - BadRequest (TrackingID: 1b4631cd468447a5915d235c47fe4bc5-G:0-TimeStamp:07/03/2018 09:08:00 Time: 2018-07-03T09:08:00.7520099Z)

   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.ValidateOutcome(Outcome outcome)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<RegisterDeviceAsync>d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<RegisterAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at ProvisioningDeviceClientX509.Program.<RunSample>d__3.MoveNext() in C:\Users\MatthijsHoogwerf\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509\Program.cs:line 45
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at ProvisioningDeviceClientX509.Program.Main(String[] args) in C:\Users\MatthijsHoogwerf\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509\Program.cs:line 105

See attached document for the complete set of steps taken.

(C SDK) Certificate installation steps and (C# SDK) device provisioning.docx

[CIPop]

Thanks for the report @DataWerkt : I'll need to give the e2e flow a try - something might have regressed in either our code or the cert generation tool.

[ChrWeinert]

Hello,
I run into the same issue. Is there a timeline for a solution?

[CIPop]

@ChrWeinert @DataWerkt I wasn't able to repro when I set the registrationID/deviceID to xdevice2.

I believe using upper-case in the device name is the issue here:

Using certificate B8059A3D2F001AE6BE4DEFB5AFB63EBACB60B035 CN=TestDevice1

Try using testdevice1 instead.

Unfortunately, this is a hard to debug issue caused by a discrepancy between the registrationId requirements and deviceId requirements.

Some other observations:

1. I see you're missing the OPENSSL_CONFIG environment variable from the steps (maybe the installer set it or the tool doesn't really need it?)
2. I used https://slproweb.com/download/Win64OpenSSL-1_0_2o.exe instead of the one you've selected.
3. You shouldn't need to run the sample as administrator since you are loading the certificate from disk (password protected).

I will add another check within our sample to help future developers catch and identify the issue sooner.

@alextolp @rajeevmv @nberdy @tameraw This is a tough problem to figure out today: the server error is ambiguous and it can only be detected at run-time.
Here are some proposals to avoid future confusion:

• A. Enhance the server side error in the case where the name is not matching the expected format. (Current error is Service Error: 400004 - BadRequest (TrackingID: 1b4631cd468447a5915d235c47fe4bc5-G:0-TimeStamp:07/03/2018 09:08:00 Time: 2018-07-03T09:08:00.7520099Z))
• B. Change the current SecurityClient behavior to check and throw if the registrationId is not matching the requirements: "The registration ID is alphanumeric, lowercase, and may contain hyphens."

I think A would have less impact and allow us to change the server behavior in the future. B would lock-in the current behavior on the client side.

[ChrWeinert]

I changed the device Name to lowercase and now the device is assigned to an IoT Hub, but open the Connection will result in a timeout.

At the Moment it seems that the registration is working, but why must the device name be lowercase? Adding an IoT Device using the web Frontend (Portal.azure.com) uppercase is supported?

[DataWerkt]

@CIPop changing the devicename did the trick for me as well. Thanks for the suggestion.

I do agree with @ChrWeinert that the code and portal behavior should match.

[nberdy]

@ChrWeinert We made the decision to not allow uppercase letters in order to make some of our future work much easier to implement. I know IoT Hub allows uppercase letters in the device ID, but that will cause them difficulties to implement the same future work.

@alextolp Can we add a work item to make that error code a little clearer? Even something like 40004 UppercaseLettersNotAllowed would help a lot.

[alextolp]

@nberdy @ChrWeinert @CIPop the pattern we've been using is to return friendly errors for service APIs and error codes for device APIs because devices are unable to understand friendly errors unless it's a dev operating a simulated device. For troubleshooting that could work for simulated devices as well as ones out in the field we recommend enabling diagnostics via the Azure Portal.

[CIPop]

Thanks @alextolp! Closing as by design.
I've enhanced the samples to always verify that the registration ID is correct: https://github.com/Azure-Samples/azure-iot-samples-csharp/blob/master/provisioning/Samples/device/Common/ProvisioningDeviceClientSample.cs#L28

__For anyone hitting this issue in the future:__
To debug issues during development time, please enable diagnostics via the Azure Portal.

[shruthika-ziosk]

Hi I have same error IotHubUnauthorizedAccess. generated certs using same tool, uploaded cert to dps and create group enrollment. but not able register device

Found certificate: 27994AD7BE55EDA926965A5AB144C70CA94F5288 CN=Azure IoT Hub CA Cert Test Only; PrivateKey: False
Found certificate: 2EBD20B467EE942708BA48FA7969143C92668019 CN=testdms1; PrivateKey: True
Using certificate 2EBD20B467EE942708BA48FA7969143C92668019 CN=testdms1
RegistrationID = testdms1
ProvisioningClient RegisterAsync . . .

Microsoft.Azure.Devices.Provisioning.Client.ProvisioningTransportException: 'AMQP transport exception'
AmqpException: {"errorCode":401002,"trackingId":"195bb51c-5fdc-41c7-b02e-d7e04519b8a0","message":"IotHubUnauthorizedAccess","timestampUtc":"2018-10-24T19:08:11.831984Z"}

Can you please help/guide how to resolve this? the RegistrationID is also lowercase.

[alextolp]

@shruthika-ziosk can you double check if you have CA boolean set in your basic constraint extension?

DPS does not allow CA certificates to be used for client auth.

[crpietschmann]

This is an old issue, but I'm getting it when I try to run the device/X509Sample with a certificate and .pfx I generated locally using OpenSSL.

Here's the error I'm getting:

*****
Found certificate: E7D3831605D817D3FAE5E84AD1F22AEB36EC225A O=Internet Widgits Pty Ltd, S=Some-State, C=AU; PrivateKey: True
Using certificate E7D3831605D817D3FAE5E84AD1F22AEB36EC225A O=Internet Widgits Pty Ltd, S=Some-State, C=AU
RegistrationID = 
ProvisioningClient RegisterAsync . . . Unhandled exception. Microsoft.Azure.Devices.Provisioning.Client.ProvisioningTransportException: AMQP transport exception
 ---> Microsoft.Azure.Amqp.AmqpException: The link address '0ne00090436/registrations/' did not match any of the expected formats.
   at Microsoft.Azure.Amqp.ExceptionDispatcher.Throw(Exception exception)
   at Microsoft.Azure.Amqp.AsyncResult.End[TAsyncResult](IAsyncResult result)
   at Microsoft.Azure.Amqp.AmqpObject.OpenAsyncResult.End(IAsyncResult result)
   at Microsoft.Azure.Amqp.AmqpObject.EndOpen(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.AmqpClientLink.OpenAsync(TimeSpan timeout)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.CreateLinksAsync(AmqpClientConnection connection, String linkEndpoint, String productInfo)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.RegisterAsync(ProvisioningTransportRegisterMessage message, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.RegisterAsync(ProvisioningTransportRegisterMessage message, CancellationToken cancellationToken)
   at Microsoft.Azure.Devices.Provisioning.Client.Samples.ProvisioningDeviceClientSample.RunSampleAsync() in /Users/Chris/Desktop/IoT/azure-iot-samples-csharp-master/provisioning/Samples/device/Common/ProvisioningDeviceClientSample.cs:line 31
   at Microsoft.Azure.Devices.Provisioning.Client.Samples.Program.Main(String[] args) in /Users/Chris/Desktop/IoT/azure-iot-samples-csharp-master/provisioning/Samples/device/X509Sample/Program.cs:line 74

I submitted a new Issue in the project for this, since it's a little different than the errors this issue covered a year or so ago. https://github.com/Azure/azure-iot-sdk-csharp/issues/1109