[BUG] Azure Service Bus: 'Listen' claim(s) are required to perform this operation

[ahrytsiuk]

Describe the bug
We use Spring Cloud Stream binder for Azure Service Bus.

<dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-stream-binder-servicebus</artifactId>
</dependency>

After we upgraded spring-cloud-azure-dependencies BOM

<dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-dependencies</artifactId>
    <version>${spring-cloud-azure.version}</version>
    <type>pom</type>
    <scope>import</scope>
</dependency>

from from 5.17.1 to 5.18.0 we start seeing error in the logs (no code changes were made).

Exception or Stack Trace

{
   "@timestamp":"2024-12-12T10:26:40.293704942Z",
   "@version":"1",
   "message":"{\"az.sdk.message\":\"onLinkRemoteClose\",\"connectionId\":\"MF_930e45_1733999191076\",\"errorCondition\":\"amqp:unauthorized-access\",\"errorDescription\":\"Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://sb-r....servicebus.windows.net/.../subscriptions/...'. TrackingId:884f5ba335064977a02d0084d8b5f866_G22, SystemTracker:gateway10, Timestamp:2024-12-12T10:26:39\",\"linkName\":\"....\",\"entityPath\":\"...\"}",
   "logger_name":"com.azure.core.amqp.implementation.handler.ReceiveLinkHandler2",
   "thread_name":"reactor-executor-2",
   "level":"INFO",
   "level_value":20000
}

{
   "@timestamp":"2024-12-12T10:26:40.362354504Z",
   "@version":"1",
   "message":"{\"az.sdk.message\":\"Receiver emitted terminal error.\",\"exception\":\"Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://....servicebus.windows.net/.../subscriptions/...'. TrackingId:884f5ba335064977a02d0084d8b5f866_G22, SystemTracker:gateway10, Timestamp:2024-12-12T10:26:39, errorContext[NAMESPACE: sb-rndce-dev-511.servicebus.windows.net. ERROR CONTEXT: N/A, PATH: .../subscriptions/email-group, REFERENCE_ID: ..., LINK_CREDIT: 0]\",\"messageFlux\":\"mf_fbfb3c_1733999191075\",\"connectionId\":\"MF_930e45_1733999191076\",\"linkName\":\"..../subscriptions/....\",\"entityPath\":\"...\"}",
   "logger_name":"com.azure.core.amqp.implementation.MessageFlux",
   "thread_name":"receiverPump-3",
   "level":"WARN",
   "level_value":30000,
   "stack_trace":"com.azure.core.amqp.exception.AmqpException: Unauthorized access. 'Listen' claim(s) are required to perform this operation. Resource: 'sb://sb....windows.net/...'. TrackingId:884f5ba335064977a02d0084d8b5f866_G22, SystemTracker:gateway10, Timestamp:2024-12-12T10:26:39, errorContext[NAMESPACE: sb-rndce-dev-511.servicebus.windows.net. ERROR CONTEXT: N/A, PATH: .../subscriptions/email-group, REFERENCE_ID: ..., LINK_CREDIT: 0]\n\tat com.azure.core.amqp.implementation.ExceptionUtil.toException(ExceptionUtil.java:90)\n\tat com.azure.core.amqp.implementation.handler.LinkHandler.handleRemoteLinkClosed(LinkHandler.java:120)\n\tat com.azure.core.amqp.implementation.handler.LinkHandler.onLinkRemoteClose(LinkHandler.java:63)\n\tat com.azure.core.amqp.implementation.handler.ReceiveLinkHandler2.onLinkRemoteClose(ReceiveLinkHandler2.java:176)\n\tat org.apache.qpid.proton.engine.BaseHandler.handle(BaseHandler.java:176)\n\tat org.apache.qpid.proton.engine.impl.EventImpl.dispatch(EventImpl.java:108)\n\tat org.apache.qpid.proton.reactor.impl.ReactorImpl.dispatch(ReactorImpl.java:324)\n\tat org.apache.qpid.proton.reactor.impl.ReactorImpl.process(ReactorImpl.java:291)\n\tat com.azure.core.amqp.implementation.ReactorExecutor.run(ReactorExecutor.java:91)\n\tat reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:68)\n\tat reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:28)\n\tat java.base/java.util.concurrent.FutureTask.run(Unknown Source)\n\tat java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)\n\tat java.base/java.lang.Thread.run(Unknown Source)\n"
}

Expected behavior
Service should connect to ASB without error.

Unfortunately I wasn't able to find anything in the release notes what could cause this error.

Could you please tell if we need to add some configuration after upgrading?

Edits

• Updated affected version from 5.14.0 to 5.17.1

[github-actions]

@anuchandy @conniey @lmolkova

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[yunbozhang-msft]

Hi team,

We also encounter this issue after upgrade to 5.18,

reactor.core.Exceptions$ErrorCallbackNotImplemented: com.azure.core.amqp.exception.AmqpException: Unauthorized access. 'Send' claim(s) are required to perform this operation.

[conniey]

If you bump the version to 5.19.0, do you still get this error? If so, could you provide a repro where this occurs?

[github-actions]

Hi @ahrytsiuk. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[ahrytsiuk]

Hello @conniey, yes issue is still reproducible with 5.19.0. Let me prepare minimal reproducible example.