DevGateway SSL Errors when trying to forward request

[joe-statsig]

Trying to get the BE server setup and create a sample item.

After running the BE server and Dev Gateway and trying to create a sample workload item, it appears that the DevGateway receives an error forwarding the request to my localhost with the error:

[2024-11-12 16:11:56.344] [Information] Start forwarding request to https://127.0.0.1:5001/workload/workspaces/<workspace id>/items/Org.WorkloadSample.SampleWorkloadItem/<item id>?api-version=2016-10-01 (ActivityId: bbe4b930-6caa-4cc9-bec2-60c13bdff876) (RequestId: c5abadda-34d5-140a-6d7e-3f348c461d03) [2024-11-12 16:11:56.359] [Error] Relay Listener got error from forwarding call sb://pbip-westus-wl-proxy-relay-3.servicebus.windows.net/d8c2d63d-9b94-4775-8c32-62b7990b6d6f_org.workloadsample_workload/Microsoft.Fabric.Workload/Platform/workspaces/<workspaceid>/items/Org.WorkloadSample.SampleWorkloadItem/<itemid>?api-version=2016-10-01 [2024-11-12 16:11:56.359] Exception: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception) at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions) at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) --- End of inner exception stack trace --- at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request) at System.Threading.Tasks.TaskCompletionSourceWithCancellation1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Microsoft.Fabric.Relay.RelayListener.b__7_0(RelayRequest relayRequest)`

I had generated dev certificates via: dotnet dev-certs https --trust

On the frontend side, there's an error about the display name I used already being taken, but no duplicate display name existing

[anitamayorov]

Hi @joe-statsig , this happens because the .Net HTTP client handling of self-signed certificates. Can you try and use the http option? Meaning define the WorkloadEndpointURL in your workload-dev-mode.json as an http endpoint, note that if you are using the sample from GitHub the ports are defined in appsettings.json file.

Regarding the 'name already exists' error - it is a known issue happens due to a retry mechanism after the first request (with the actual 'real' error fails). We are working on fixing this, no ETA.

[joe-statsig]

Thanks @anitamayorov ! Switching to HTTP allowed the Dev Gateway to connect to my local service.

I am getting one more error right now in the Boilerplate app though:

fail: Boilerplate.Services.AuthenticationService[0] Token validation failed: Microsoft.IdentityModel.Tokens.SecurityTokenInvalidAudienceException: IDX10214: Audience validation failed. Audiences: '<APP (Client) ID>'. Did not match: validationParameters.ValidAudience: 'api://localdevinstance/<Tenant ID>/Org.WorkloadSample' or validationParameters.ValidAudiences: 'null'. at Microsoft.IdentityModel.Tokens.Validators.ValidateAudience(IEnumerable1 audiences, SecurityToken securityToken, TokenValidationParameters validationParameters)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateAudience(IEnumerable1 audiences, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateTokenPayload(JwtSecurityToken jwtToken, TokenValidationParameters validationParameters, BaseConfiguration configuration) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateJWS(String token, TokenValidationParameters validationParameters, BaseConfiguration currentConfiguration, SecurityToken& signatureValidatedToken, ExceptionDispatchInfo& exceptionThrown) --- End of stack trace from previous location --- at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, JwtSecurityToken outerToken, TokenValidationParameters validationParameters, SecurityToken& signatureValidatedToken) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken) at Boilerplate.Services.AuthenticationService.ValidateAadTokenCommon(String token, OpenIdConnectConfiguration openIdConnectConfiguration, Boolean isAppOnly) in C:\Users\fabricappdev\source\repos\Microsoft-Fabric-workload-development-sample\Backend\src\Services\AuthenticationService.cs:line 293 fail: Boilerplate.Exceptions.HttpResponseExceptionFilter[0] Failed to authenticate the request

[anitamayorov]

Hi @joe-statsig , can you please verify you have the correct setup of the application's resourceId (audience) in all of the following places:

1. Backend - WorkloadManifest.xml
2. Backend - appsetting.json
3. Frontend - .env.dev
4. Your application in Entra ID , see step (2) https://learn.microsoft.com/en-us/fabric/workload-development-kit/authentication-tutorial#configure-your-application-in-microsoft-entra-id-manually