No device connection string in IoT Hub

CogniTech 15

We are building in the functionality to send cloud to device messages to trigger actions on device remotely. We are actually looking for how to create the device connection string programmatically, but when we check in IoT hub none of our devices have connection strings.

The following documentation states that they can be found on the device page in IoT hub resource in Azure, but they are not present. https://learn.microsoft.com/en-us/azure/iot-hub/c2d-messaging-dotnet#get-the-device-connection-string User's image

We actually need the information on how to recreate the connection string in PHP, but also would like to know why they do not exist in Azure?

2 answers

Sander van de Velde | MVP 31,211 Reputation points MVP

2024-02-07T22:14:29.3066667+00:00

Hello @Innov8,

welcome to this moderated Azure community forum.

This is weird, normally, the connection strings (primary/secundary) are shown next to the two keys.

I just created this test device in the West Europe region (with autogenerated symmetric keys in the Azure portal):

How did you create this device? Using the Azure portal? Or using some script? If so, Can you share it?

A connection string is not that special:

HostName=[name of iot hub].azure-devices.net;DeviceId=[device name];SharedAccessKey=[one of the two keys]

But... it is strongly recommended to make use the Device Provisioning Service to control future IoT Hub selection/migration. This way, you do not need to access all your device to migrate to another IoT Hub.

Next to that, for Cloud to Device communication like a Direct Method call, you need to have the IoT Hub connectionstring!

See also this example in the documentation.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.
Please sign in to rate this answer.
CogniTech 15 Reputation points

2024-02-07T22:21:04.53+00:00

We use the device provisioning services via REST API

CogniTech 15 Reputation points

2024-02-07T22:23:16.11+00:00

Our workflow is user creates a device on our platform. Via REST api the device is enrolled using DPS. The devices run and register using the iot hub device SDK. All of this works and we also receive the data via event grid, the issue is the primary and secondary access key, and connection strings do not exist, even if we query the api and get the device via api/query.

CogniTech 15 Reputation points

2024-02-07T22:24:44.1033333+00:00

"Next to that, for Cloud to Device communication like a Direct Method call, you need to have the IoT Hub connectionstring!" That is not what the documentation says:

https://learn.microsoft.com/en-us/azure/iot-hub/c2d-messaging-dotnet#get-the-device-connection-string

CogniTech 15 Reputation points

2024-02-07T22:38:47.81+00:00

For our use case, we need to be able to send commands directly to the devices from our UI, so we need to see the examples for the REST API. I didn't see the IoT Hub connection string info at the bottom of the docs. Will try that. Would like to know why our devices do not have keys though.

What is the format for the IoT Hub service connection string so we can programmatically build it?

Could you share the documentation for sending a cloud to device message via REST API please I cannot find it.

Sander van de Velde | MVP 31,211 Reputation points MVP

2024-02-07T22:45:08.45+00:00

Regarding the device connectionstring, this is needed for "The MessageReceiveSample sample app". If you go to the next paragraph, you send messages using the iot hub connectionstring:

static ServiceClient serviceClient; static string connectionString = "{iot hub connection string}"; static string targetDevice = "{device id}"; ... private { var commandMessage = new Message(Encoding.ASCII.GetBytes("Cloud to device message.")); await serviceClient.SendAsync(targetDevice, commandMessage); }

Sander van de Velde | MVP 31,211 Reputation points MVP

2024-02-07T22:47:58.0433333+00:00

Do not share the IoT Hub connection string outside Azure. Your UI application should have a backend API part which keeps the connection string secret and makes the actual calls to the IoT Hub. This is the most secure way to do cloud-to-device communication

---If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

CogniTech 15 Reputation points

2024-02-07T22:58:35.1733333+00:00

Thanks yes we know :) The questions are:

What is the format for the IoT Hub service connection string so we can programmatically build it? Could you share the documentation for sending a cloud to device message via REST API please I cannot find it.

Sander van de Velde | MVP 31,211 Reputation points MVP

2024-02-07T23:37:43.0933333+00:00

The Service client / cloud message example is on the same page but a bit lower, after the device is created :-) The IoT hub service connection string is found in the portal under Shared Access Policies:

The format is like

HostName=[iot hub name].azure-devices.net;SharedAccessKeyName=[policy name];SharedAccessKey=[policy primary or secondary key]

Notice the 'iothubowner' policy name is the most feature rich policy. It's recommended to make a 'clone' of one of the standard policies and share that one to other services. Then you can reject them specifically without breaking other services.

CogniTech 15 Reputation points

2024-02-08T00:13:43.3466667+00:00

Thank you for the help. Please can you provide the documentation for sending a cloud to device message via the REST API ? We have been unable to find it. Just to clarify, we are not using the SDK on our UI as there is none for the language we use, which is why we have been specifically asking for the documentation for the REST API. The documentation you have provided is for C# SDK, we need REST API and are unable to locate it.

CogniTech 15 Reputation points

2024-02-08T01:25:14.2566667+00:00

Thanks again for the help with this, sorry we have limited time on this. Please can you provide the correct documentation for sending a device command via the REST API. And please could you advise why none of our devices have keys?

CogniTech 15 Reputation points

2024-02-08T02:04:52.1366667+00:00

OK we got it working, but creating a SAS from a connection string with "service" policy fails, only "iothubowner" works.

Sander van de Velde | MVP 31,211 Reputation points MVP

2024-02-08T07:34:25.8433333+00:00

Good to hear it's working now.

Having limited time is not an excuse for not having your architecture and security right :-)

Which language are you using? The service SDK is available in multiple languages like C#, Node, Java, Python.

Regarding the policies, please read the documentation. It seems you need 'ServiceConnect' rights only if you want to do Cloud-to-Device communication.

You can create a custom policy for that. Al least make a copy of the 'iot hub owner' and share that one.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Sander van de Velde | MVP 31,211 Reputation points MVP

2024-02-08T14:47:37.07+00:00

Hello @CogniTech , I just watched the video. Nice demonstration. If you have more questions, I'm happy to answer them. If my response helped, please do "Accept Answer". All community members with similar issues will benefit by doing so. Thanks.

LeelaRajeshSayana-MSFT 13,966 Reputation points

2024-02-12T21:27:52.4266667+00:00

Hi @Innov8 Gald to know that the issue is resolved. Please do click Accept Answer and Yes for the answer, as it might be beneficial to other community members reading this thread. And, if you have any further query do let us know. Thank you
Sign in to comment
Dom 1,631 Reputation points Microsoft Employee

2024-02-08T08:20:02.89+00:00

It looks like your device is configured to authenticate using an X.509 certificate rather than a shared access key - this is why your screenshot is showing thumbprints and not keys/connection-strings.

The connection string for a device that uses X.509 authentication looks like:

"HostName=<host_name>;DeviceId=<device_id>;x509=true"

I notice as well that you're trying to send a cloud to device message - the device connection string is only for devices to connect to your hub. If you want to connect to your hub from a back-end service in order to send a cloud to device message, you need to use the IoT hub connection string - this is described further on in the article you were looking at here: https://learn.microsoft.com/azure/iot-hub/c2d-messaging-dotnet#get-the-iot-hub-connection-string. After your back-end service connects to IoT Hub, it just needs the device ID to send a C2D message.
Please sign in to rate this answer.
CogniTech 15 Reputation points

2024-02-08T13:53:30.3766667+00:00

Thanks for the info, we completed the development last night using IoT Hub connection string. Here is a demo. Thanks for the help on this yesterday.

https://www.facebook.com/akmilton.barker/videos/717456217183070/
Sign in to comment

Share via

No device connection string in IoT Hub

2 answers