Event grid subscription webhook end point handshake is getting failed

Kumar Negi, Dhananjay 0

Event grid subscription webhook end point handshake is getting failed. Call Automation code and Devtunnel is up and running in application server. getting below error -

Deployment has failed with the following error: {"code":"URL validation","message":"Webhook validation handshake failed for https://2fmn1qwr-5006.inc1.devtunnels.ms/. Http POST request failed with response code Unknown. For troubleshooting, visit https://aka.ms/esvalidation. Activity id:9604ba58-76de-4d9c-8a95-3b5920668ab9, timestamp: 9/26/2024 5:34:22 AM (UTC)."}

2 answers

JananiRamesh-MSFT 27,341 Reputation points

2024-09-26T08:55:53.61+00:00

@Kumar Negi, Dhananjay Thanks for reaching out. Using the Activity id i verified the backend logs it indicates the service side error for above is: Handshake failed for endpoint with base URL: https://2fmn1qwr-5006.inc1.devtunnels.ms/ due to exception. Will resort to Manual Verification. response body: , isTimeout: False, errorMessage=The remote server returned an error: (401) Unauthorized.

401 indicates that the webhook endpoint is failing to authenticate the validation request and is returning a 401 Unauthorized error. Why is that happening? Can you check your logs?
Please sign in to rate this answer.
JananiRamesh-MSFT 27,341 Reputation points

2024-09-27T03:30:51.9733333+00:00

@Kumar Negi, Dhananjay Just checking if you had a chance to look at my previous response. if so, can you please update it?

Kumar Negi, Dhananjay 0 Reputation points

2024-09-27T10:00:21.2733333+00:00

Hi Ramesh, thanks for the reply. is there anything to do with payload, header value is being sent from event grid to the devtunnel? or it could be the firewall on devtunnel side. Meanwhile, I am checking with firewall team in parallel.

Kumar Negi, Dhananjay 0 Reputation points

2024-09-27T10:01:05.9466667+00:00

meanwhile, checking with firewall team as well

JananiRamesh-MSFT 27,341 Reputation points

2024-09-27T10:36:47.61+00:00

@Kumar Negi, Dhananjay Thanks for getting back, When Event Grid sends a validation event to your webhook endpoint, it includes specific headers and a payload. The header aeg-event-type: SubscriptionValidation is used to indicate a validation event. Ensure that your webhook endpoint is correctly handling this header and responding appropriately. please refer: https://learn.microsoft.com/en-us/azure/event-grid/end-point-validation-event-grid-events-schema

Verify that the webhook endpoint https://2fmn1qwr-5006.inc1.devtunnels.ms/ is publicly accessible and not behind any firewall or network restrictions that might block the validation request from Event Grid also If your webhook endpoint requires authentication, ensure that it is configured to accept requests without authentication for the validation handshake. The 401 Unauthorized error indicates that the endpoint is failing to authenticate the validation request.

do let me know incase of further queries, I would be happy to assist you.

Kumar Negi, Dhananjay 0 Reputation points

2024-09-30T06:29:57.6433333+00:00

Hi Ramesh,

Tanks for the reply!

I'm currently following call-automation-open-ai-sample (https://github.com/Azure-Samples/communication-services-python-quickstarts/tree/main/callautomation-openai-sample) . What shall be the validation api we would need to integrate with the payload so that we get the validation from the Event Grid? we have followed the specified steps and after we try to validate the Event Grid webhook, it is giving us the mentioned error.

JananiRamesh-MSFT 27,341 Reputation points

2024-09-30T08:42:08.43+00:00

Kumar Negi, Dhananjay Thanks for getting back, to validate the Event Grid webhook, you need to implement the validation request event in your webhook endpoint. The validation request event is a POST request that contains a validation code in the request body. The endpoint should extract the validation code from the request body and return it in the response body.

In the call-automation-open-ai-sample, you can implement the validation request event in the webhook_handler function in the app.py file. You can add the following code to handle the validation request event:

if request.method == 'POST': event = request.get_json() if event['eventType'] == 'Microsoft.EventGrid.SubscriptionValidationEvent': validation_code = event['data']['validationCode'] response_data = { 'validationResponse': validation_code } return jsonify(response_data)

This code checks if the incoming request is a POST request and if it is a validation request event. If it is a validation request event, it extracts the validation code from the request body and returns it in the response body.

Once you have implemented the validation request event, you can retry the validation request. If the validation request is successful, the Event Grid service will mark the subscription as validated and start delivering events to the webhook endpoint.

If you need further assistance, i would recommend you create support ticket with us If you don't have a support plan, please let me know

Kumar Negi, Dhananjay 0 Reputation points

2024-10-04T06:39:02.6133333+00:00

Hi Ramesh,

After using above code, We are not able to use POST method. Getting ERROR as Method Not Allowed and in Postman getting Error as 401Unauthorized for POST (while getting 200 for GET request). So not getting any Json file with validation code. and By default, we are getting GET method, but this method does not have any Json file (response is NoneType).

Kumar Negi, Dhananjay 0 Reputation points

2024-10-04T06:40:40.5+00:00

@app.route("/", methods=["POST","GET"]) async def handle_event(): if request.method == 'POST': event = await request.get_json() # Use await since Quart is async if event.get('eventType') == 'Microsoft.EventGrid.SubscriptionValidationEvent': validation_code = event['data'].get('validationCode') if validation_code: response_data = { 'validationResponse': validation_code } return jsonify(response_data), 200 return jsonify({'message': 'Invalid event or event type.'}), 400 elif request.method == 'GET': # Respond to GET requests (for testing) return jsonify({'message': 'GET request received, please use POST.'}), 405 else: # Return 405 Method Not Allowed for any method other than POST return jsonify({'message': 'Method not allowed.'}), 405

JananiRamesh-MSFT 27,341 Reputation points

2024-10-05T16:32:54.8366667+00:00

Kumar Negi, Dhananjay Thanks for getting back, We might need a closer look to troubleshoot this issue. If you don't have a support plan, let me know. I can enable a one-time support ticket for your subscription. So that our support professionals can get in touch with you and troubleshoot this issue further.

Kumar Negi, Dhananjay 0 Reputation points

2024-10-07T04:41:11.4366667+00:00

Hi Ramesh,

Thanks for your reply. Please create a ticket for us.

Thanks

Dhananjay

JananiRamesh-MSFT 27,341 Reputation points

2024-10-07T10:26:27.2466667+00:00

Kumar Negi, Dhananjay Thanks for getting back, can you please refer to my private comment and share the details to assist you further

Kumar Negi, Dhananjay 0 Reputation points

2024-10-09T08:26:02.7033333+00:00

Hi Ramesh,

We have progressed and are able to handshake with the webhook. Though, we are facing one issue which is as follows:

azure.core.exceptions.ClientAuthenticationError: (7509) HMAC-SHA256 validation failed Code: 7509 Message: HMAC-SHA256 validation failed

We have provided authentication tokens and information as per the resources we have created for ACS, could you please help us resolving this issue?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Chaturvedi, Rupal 0 Reputation points

2024-10-09T10:35:52.4133333+00:00

hi @JananiRamesh-MSFT ,

We are able to answer the incoming call using ACS solving every error.

Currently we are facing the cognitive endpoint error which is as follows:

call connected : data={'operationContext': 'Goodbye', 'resultInformation': {'code': 401, 'subCode': 8565, 'message': 'Action failed due to a Cognitive Services authentication error. Please check your authorization input and ensure it is correct.'}, 'version': '2023-10-15', 'callConnectionId': '0a008480-4e01-4c4d-ba90-5223f92e362b', 'serverCallId': 'aHR0cHM6Ly9hcGkuZmxpZ2h0cHJveHkuc2t5cGUuY29tL2FwaS92Mi9jcC9jb252LXVzZWEyLTA1LXByb2QtYWtzLmNvbnYuc2t5cGUuY29tL2NvbnYvWmpZWGlPWGxQa0NpWDM5ZFZuOVNOUT9pPTEwLTYwLTI1LTIyJmU9NjM4NjM2NjgxNDU5MDM5MTkz', 'correlationId': 'e3bccb4b-1e9b-44bf-99c1-6fa99dd3e7c6', 'publicEventType': 'Microsoft.Communication.PlayFailed'}

I'm putting the valid endpoint of the resource which I have created for the cognitive service but still I'm getting code 401. Could you please help me with this.
Please sign in to rate this answer.
JananiRamesh-MSFT 27,341 Reputation points

2024-10-09T14:23:00.5266667+00:00

@Chaturvedi, Rupal Kumar Negi, Dhananjay Thanks for getting back, as mentioned earlier 401 unauthorized indicates that the webhook endpoint is failing to authenticate the validation request.

Ensure that the authentication tokens provided are correct and not expired in the request headers. Verify that the tokens match the expected format and values required by Cognitive Services

azure.core.exceptions.ClientAuthenticationError: (7509) HMAC-SHA256 validation failed Code: 7509 Message: HMAC-SHA256 validation failed error typically occurs when the signature of the request does not match the expected signature.

where you able to call the cognitive endpoint directly could you please verify it via postman or any other tool?

https://learn.microsoft.com/en-us/azure/event-grid/authenticate-with-access-keys-shared-access-signatures

Chaturvedi, Rupal 0 Reputation points

2024-10-10T08:05:02.7966667+00:00

@JananiRamesh-MSFT , Thanks for your reply.

Currently the credentials which we are using to implement the azure communication services ask for the below credentials endpoints:

CALLBACK_URI_HOST: your dev tunnel endpoint

COGNITIVE_SERVICE_ENDPOINT: The Cognitive Services endpoint

ACS_CONNECTION_STRING: Azure Communication Service resource's connection string.

AZURE_OPENAI_SERVICE_KEY: Open AI's Service Key

AZURE_OPENAI_SERVICE_ENDPOINT: Open AI's Service Endpoint

AZURE_OPENAI_DEPLOYMENT_MODEL_NAME: Open AI's Model name

AGENT_PHONE_NUMBER: Agent Phone Number to transfer call.

It doesn't include any field to provide authentication for Cognitive service endpoint. Could you please help me what are we missing.

JananiRamesh-MSFT 27,341 Reputation points

2024-10-11T06:59:01.45+00:00

@Chaturvedi, Rupal Kumar Negi, Dhananjay Thanks for getting back, this needs further investigate as mentioned earlier i have enabled one-time free support ticket on your subscription id and shared you the steps to create a support ticket in the private chat.
If you run into any issues, feel free to let me know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Event grid subscription webhook end point handshake is getting failed

2 answers

Your answer