Authorization Token Error JWT Issuer Configuration

Question

Authorization Token Error JWT Issuer Configuration

Leonardo CHIODI 5

I am recovering a token from my service principal (which has the rights to my endpoint). I then pass it to my headers post request to my endpoint and get the following response :

(401) Jwt issuer is not configured

Please check this guide to understand why this error code might have been returned

https://docs.microsoft.com/en-us/azure/machine-learning/how-to-troubleshoot-online-endpoints#http-status-codes

I am doing as said here https://learn.microsoft.com/en-us/azure/machine-learning/how-to-authenticate-online-endpoint?view=azureml-api-2&tabs=python

I've wandered the microsoft documentation and haven't found anything about the jwt issuer not being configured.

User's image

Ramr-msft 17,826 Reputation points

2023-06-01T12:27:00.6766667+00:00
@Leonardo CHIODI Thanks for the question. Here is the sample for authenticating online endpoints.

Access to retrieve the key or token for an online endpoint is restricted by Azure role-based access controls (Azure RBAC). To retrieve the authentication key or token, your security principal (user identity or service principal) must be assigned one of the following roles:

Owner

Contributor
romungi-MSFT 48,906 Reputation points Microsoft Employee Moderator

2023-06-01T12:50:28.83+00:00

@Leonardo CHIODI Is the online endpoint deployed to use auth_mode to aml_token? The default is key as per the reference. I think the error message indicates the token may not be issued, did you also try to print the same before using it with the endpoint?
Leonardo CHIODI 5 Reputation points

2023-06-01T13:03:01.8133333+00:00

I did set the auth_mode="aml_token" in my ManagedOnlineEndpoint.
Vidya Sagar Kalapala 0 Reputation points

2023-06-20T15:05:50.38+00:00

@Leonardo CHIODI I have the same issue. I have decoded the token and found that issuer is "https://sts.windows.net/tenant-id". But seems like Azure ML endpoint expects the issuer to be "azureml". So as I understood, we need to retrieve the token from Azure ML workspace itself.

Please correct me if I am wrong.
Leonardo CHIODI 5 Reputation points

2023-06-21T08:45:16.4166667+00:00

Don't use the SP token but the one from the endpoint :
access_token = ml_client.online_endpoints.get_keys(name=endpoint_name).access_token
Vidya Sagar Kalapala 0 Reputation points

2023-06-21T09:29:40.88+00:00

Hi @Leonardo CHIODI Thanks for your response. Could you let me know why can't we use the SP token? Do you have any idea? Basically we are trying to make a call from Azure logic app, so I don't think we can use this code and retrieve the ML token.
Abbas Sayyed 0 Reputation points Microsoft Employee

2023-08-29T18:56:34.1933333+00:00

@Leonardo CHIODI Do you have an update please ? I'm trying to access via SP token on postman.

Is there an team where I can route IcM ?

1 answer

Your answer

Ramr-msft 17,826 Reputation points

2023-06-01T12:27:00.6766667+00:00

@Leonardo CHIODI Thanks for the question. Here is the sample for authenticating online endpoints.

Access to retrieve the key or token for an online endpoint is restricted by Azure role-based access controls (Azure RBAC). To retrieve the authentication key or token, your security principal (user identity or service principal) must be assigned one of the following roles:

Owner

Contributor
romungi-MSFT 48,906 Reputation points Microsoft Employee Moderator

2023-06-01T12:50:28.83+00:00

@Leonardo CHIODI Is the online endpoint deployed to use auth_mode to aml_token? The default is key as per the reference. I think the error message indicates the token may not be issued, did you also try to print the same before using it with the endpoint?
Leonardo CHIODI 5 Reputation points

2023-06-01T13:03:01.8133333+00:00

I did set the auth_mode="aml_token" in my ManagedOnlineEndpoint.
Vidya Sagar Kalapala 0 Reputation points

2023-06-20T15:05:50.38+00:00

@Leonardo CHIODI I have the same issue. I have decoded the token and found that issuer is "https://sts.windows.net/tenant-id". But seems like Azure ML endpoint expects the issuer to be "azureml". So as I understood, we need to retrieve the token from Azure ML workspace itself.

Please correct me if I am wrong.
Leonardo CHIODI 5 Reputation points

2023-06-21T08:45:16.4166667+00:00

Don't use the SP token but the one from the endpoint :
access_token = ml_client.online_endpoints.get_keys(name=endpoint_name).access_token
Vidya Sagar Kalapala 0 Reputation points

2023-06-21T09:29:40.88+00:00

Hi @Leonardo CHIODI Thanks for your response. Could you let me know why can't we use the SP token? Do you have any idea? Basically we are trying to make a call from Azure logic app, so I don't think we can use this code and retrieve the ML token.
Abbas Sayyed 0 Reputation points Microsoft Employee

2023-08-29T18:56:34.1933333+00:00

@Leonardo CHIODI Do you have an update please ? I'm trying to access via SP token on postman.

Is there an team where I can route IcM ?

Answer 1

Leonardo CHIODI 5

Don't use the one from the SP, use
access_token = ml_client.online_endpoints.get_keys(name=endpoint_name).access_token

Vidya Sagar Kalapala 0 Reputation points

2023-06-21T09:52:10.9366667+00:00

Any idea why SP token wouldn't work? We have raised an MS ticket on this and is in progress.
Abbas Sayyed 0 Reputation points Microsoft Employee

2023-08-29T18:57:05.91+00:00

Do you have update ?

Share via

Authorization Token Error JWT Issuer Configuration

1 answer

Your answer