Add authentication to Azure Device Streams - azure

Question

We want to use IOT hub and use device streams to proxy our internal Web API for maintenance purposes. This works quite fine, but we also need some kind of authorization. The shared access policy is not fine-grained enough for this purpose.
I would rather use some kind of authentication token (JWT) to pass in the request that can be checked by the device itself. If the token can be validated and the use has the proper rights, then the connection is accepted and otherwise it's reject. The only value that can be configured is the name, so I need to encode the token in the name. The client code could look something like this:
Client code
var deviceStreamRequest = new DeviceStreamRequest(streamName: "WebAPI?token=<JWT-token here>");
var result = await serviceClient.CreateStreamAsync(deviceId, deviceStreamRequest, cancellationToken).ConfigureAwait(false);
Device code
var streamRequest = await deviceClient.WaitForDeviceStreamRequestAsync(cancellationToken).ConfigureAwait(false);
if (streamRequest != null)
{
var token = GetTokenFromName(streamRequest.Name);
if (!CheckClaim(token, "WebAPI"))
{
await deviceClient.RejectDeviceStreamRequestAsync(streamRequest, cancellationToken).ConfigureAwait(false);
return;
}
await deviceClient.AcceptDeviceStreamRequestAsync(streamRequest, cancellationToken).ConfigureAwait(false);
// ...
}
The DeviceStreamRequest class does contain an AuthenticationToken, but it seems to be the authentication token that is used to connect back to IOT using the websocket and cannot be used for other purposes.
I there a better way to pass the token then using the name?

Answer 1

The current version of the Microsoft.Azure.Devices.DeviceStreamRequest didn't allow to populate a request payload to the device like we have in the device direct method. The request payload is the best place for sending an additional (or business) data to the device related to the streaming preprocessing such as the B2B decisions, etc.
Note, that using a streamName for passing your token is not the correct way, see the following code snippet from the .Net Reflector:
public override Task<DeviceStreamResponse> CreateStreamAsync(string deviceId, DeviceStreamRequest deviceStreamRequest, CancellationToken cancellationToken)
{
return this.CreateStreamAsync(GetDeviceStreamUri(deviceId, deviceStreamRequest.StreamName), deviceStreamRequest, cancellationToken);
}
where, the GetDeviceStreamUri has the following implementation:
private static Uri GetDeviceStreamUri(string deviceId, string streamName)
{
deviceId = WebUtility.UrlEncode(deviceId);
object[] args = new object[] { deviceId, streamName };
return new Uri("/twins/{0}/streams/{1}?api-version=2018-08-30-preview".FormatInvariant(args), UriKind.Relative);
}
As you can see the above Uri, there is already hardcoded query parameter such as ?api-version=2018-08-30-preview
However, there is a workaround for your solution based on the using an underlying communication (no using the SDK package), for instance, the REST APIs. Note, that this feature is still in the preview.
For demonstration of the iot device streaming, I am using my Azure IoT Hub Tester.
The following screen snippet shows the invoker POST request to the IoT Hub for device streaming:
As you can see, the Microsoft.Azure.Devices.DeviceStreamRequest can handled only the stream name and two headers such as iothub-streaming-response-timeout-in-seconds and iothub-streaming-connect-timeout-in-seconds.
Posting this reqest, the IoT Hub will send the message to the device. The following screen snippet shows a received message in my virtual MQTT device1:
Now, the device1 can evaluate a message payload to make a decision for either the accepting (code 202) or rejecting (code 4xx, etc.) the streaming process. Note, that there is a response time limit (in my example is 15 seconds) from the invoker call.
Once, the device accepted this streaming process, the invoker will receive the response from the IoT Hub with details in the headers for creating a websocket communication and payload from the device. The following is an example of the headers:
iothub-streaming-is-accepted: True
iothub-streaming-url: wss://centralus.centralus-001.streams.azure-devices.net:443/bridges/ih/rk2019-iot/d/device1/sid/****
iothub-streaming-auth-token: ***
iothub-streaming-ip-address: 0.0.0.0
Based on that, the invoker can evaluate a device response payload before creating a websocket communication.