Not getting hub OnConnected/OnDisconnectedAsync calls

[johnkwaters]

I switched from SignalR (AspNetCore RC1) to AzureSignalR
I use authenticated hubs (using JWT Bearer tokens in header)
When a client connects, I add the connection to a group for its Tenant (a multitenant solution, tenant is a claim in the JWT).
However - in the AzureSignalR version, my hub does not get these events.

My code defines
public override async Task OnConnectedAsync()

I noticed the sample code in FlightMap does not use async,
public override Task OnConnectedAsync()

Changing my code to use this signature still doesnt work.

Found the angular client was requesting HttpTransportType.WebSockets. When removing that ... it works!

[xscript]

I am a little confused. So it works now?

[davidfowl]

Are you saying you don't get any connection events when using websockets and the azure signalr service?

[johnkwaters]

I found that if the client specifies HttpTransportType WebSockets, I dont get any connection events. If I leave it unspecified, I do.

[davidfowl]

Thats extremely odd. Did you look at the logs on the server and client?

[johnkwaters]

Mu code is kind of in ripped up floorboards state right now. I will check it again in the next few days and let you know what I see. Sorry for the delay.

[johnkwaters]

So got back into this now.. if I use local SignalR, it works, if I use Azure SignalR it doesnt.
The hub is authorized, i.e. it has an [Authorize] attribute.
The angular client calls a login API, gets a JWT, then sends this on the connect call. I see it coming though, and I have a middleware that places it in the Authorization HTTP header, with Bearer . The JWT has some claims, including the TenantId of the client. So when the OnConnectedAsync is called, I can get the Tenant of the caller from the claim and I add the connection to a Group for that Tenant.
However, when I switch to Azure SignalR, I no longer get the OnConnectedAsync call.
So it has something to do with the Hub being [Authorize] decorated.
I see their are some options in the AddAzureSignalR for a claims provider.... do I use that?

Note the original text above talks about websockets, but this is happening no matter what. The angualr client is now using

"@aspnet/signalr": "^1.0.0-rc1-update1",

The client connection logic looks like this;

`import {EventEmitter} from "@angular/core";
import {each} from 'lodash-es';
import {AppConstants} from "../../constants/app.constants";
import {HubEvent} from "../../models/hub-event.model";
import {SessionData} from "../../interfaces/api/session-data.interface";
import {AppSession} from "../core/app-session.service";
import {HubConnection, HttpTransportType, HubConnectionBuilder} from "@aspnet/signalr";

export abstract class BaseHub {
eventBus: EventEmitter = new EventEmitter();

private _hubConnection: HubConnection;
private _hubName: string;
private _events: Array;

constructor(hubName: string, events: Array) {
const sessionData: SessionData = AppSession.get();

this._hubName = hubName;
this._events = events;

this._hubConnection = new HubConnectionBuilder()
.withUrl(`${AppConstants.signalR.baseUrl}/${this._hubName}?token=${sessionData.token}`)
.build();

this.subscribeToEvents();

this._hubConnection.start();

}

invoke(hubEvent: HubEvent) {
this._hubConnection.invoke(hubEvent.name, hubEvent.data);
}

private subscribeToEvents(): void {
each(this._events, (event) => {
this.setupHubEventListener(event);
});
}

private setupHubEventListener(eventName: string) {
const evt = eventName;
this._hubConnection.on(evt, (data: any) => {
this.eventBus.emit(
new HubEvent(evt, data)
);
});
}
}`

The server is a dotnetcore app, target framework netcoreapp2.1, with these packages
<PackageReference Include="AutoMapper" Version="6.2.2" /> <PackageReference Include="AutoMapper.Extensions.Microsoft.DependencyInjection" Version="3.2.0" /> <PackageReference Include="EPPlus" Version="4.5.1" /> <PackageReference Include="GeoTimeZone" Version="3.2.0" /> <PackageReference Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.2.1" /> <PackageReference Include="Microsoft.AspNetCore.All" Version="2.1.0-rc1-final" /> <PackageReference Include="Microsoft.Azure.SignalR" Version="1.0.0-preview1-10009" /> <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="2.1.0-rc1-final" /> <PackageReference Include="NodaTime" Version="2.3.0" /> <PackageReference Include="Swashbuckle.AspNetCore.SwaggerGen" Version="2.4.0" /> <PackageReference Include="Swashbuckle.AspNetCore.SwaggerUI" Version="2.4.0" />
The startup code is

`
public void ConfigureServices(IServiceCollection services)
{
services
.AddOptions()
.AddConfig(ConfigurationRoot)
.AddCORS()
.AddEF(ConfigurationRoot)
.ConfigureApplicationInjection()
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
var tokenOptions = ConfigurationRoot.GetSection("Authentication").Get();

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidIssuer = tokenOptions.Issuer,
                    ValidAudience = tokenOptions.Audience,
                    IssuerSigningKey = new SymmetricSecurityKey(
                        Encoding.UTF8.GetBytes(tokenOptions.SigningKey))
                };
            });
        services
            .AddMvc()
            .AddJsonOptions(opt =>
            {
                opt.SerializerSettings.NullValueHandling = NullValueHandling.Include;
                opt.SerializerSettings.DefaultValueHandling = DefaultValueHandling.Include;
                opt.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
            });

#if !AZURESIGNALR
services.AddSignalR();
#else
var signalRConnectionString =
ConfigurationRoot.GetSection("Azure:SignalR").GetValue("ConnectionString");
services.AddSignalR().AddAzureSignalR(signalRConnectionString);
#endif
services.AddSwagger();
services.AddAutoMapper();
}
`

And

`
public void Configure(IApplicationBuilder app)
{
app
.UseTokenInQueryString()
.UseAuthentication()
.UseConfigureSession()
.UseSwagger(
c =>
{
c.PreSerializeFilters.Add(
(swagger, httpReq) => swagger.Host = httpReq.Host.Value);
})
.UseSwaggerUI(c =>
{
// when running in a Docker container this is null and needs adjusting
var basePath = Environment.GetEnvironmentVariable("ASPNETCORE_APPL_PATH") ?? "/";
c.SwaggerEndpoint(basePath + "swagger/v1/swagger.json", "V1 Docs");
c.DocExpansion(DocExpansion.None);
})
.UseDeveloperExceptionPage()
.UseHttpException()
.UseCors("AllowAllCorsPolicy")
.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller=Home}/{action=Index}/{id?}");
})
#if !AZURESIGNALR
.UseSignalR(
#else
.UseAzureSignalR(
#endif
routes => { routes.MapHub("/stophub"); });

        var config = new MapperConfiguration(cfg => {
            cfg.AddProfile<MappingProfile>();
        });
    }

`
My CORS policy is

public static IServiceCollection AddCORS(this IServiceCollection services) { services.AddCors(action => action.AddPolicy("AllowAllCorsPolicy", builder => builder .AllowAnyOrigin() .AllowAnyHeader() .AllowAnyMethod() .AllowCredentials())); return services; }

Here is my middleware that moves the token from the query string to the header

` public class GetTokenFromQueryStringMiddleware
{
private readonly RequestDelegate _next;

    /// <summary>
    /// constructor
    /// </summary>
    /// <param name="next">the next middleware in chain</param>
    public GetTokenFromQueryStringMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    /// <summary>
    /// sets the header
    /// </summary>
    /// <param name="context">Current HTTP context</param>
    /// <returns></returns>
    public async Task InvokeAsync(HttpContext context)
    {
        if (string.IsNullOrWhiteSpace(context.Request.Headers["Authorization"]))
        {
            if (context.Request.QueryString.HasValue)
            {
                var token = context.Request.QueryString.Value.Split('&')
                    .SingleOrDefault(x => x.Contains("token"))?.Split('=')[1];
                if (!string.IsNullOrWhiteSpace(token))
                {
                    context.Request.Headers.Add("Authorization", new[] { $"Bearer {token}" });
                }
            }
        }
        await _next.Invoke(context);
    }
}`

Sorry about the formatting, that add code feature works so so!

[johnkwaters]

I found it I remove the Authorize attribute on my Hub it works. But of course, I dont want to do that.

I am looking at the wss connection to the Azure SignalR service from the angular client

wss://northstardevsignalr.service.signalr.net:5001/client/?hub=stopshub&id=5N_GqVK2qAhTz1lagtMjNQ&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyaWQiOjEzLCJ1c2VybmFtZSI6ImFyY3RpY0Bub3J0aHN0YXIuYXBwIiwidGVuYW50aWQiOjUsInJvbGUiOiJUZW5hbnRBZG1pbiIsImV4cCI6MTUyNzEzNDM0OCwiaXNzIjoibm9ydGhzdGFyYXBpIiwiYXVkIjpbIm5vcnRoc3RhciIsImh0dHBzOi8vbm9ydGhzdGFyZGV2c2lnbmFsci5zZXJ2aWNlLnNpZ25hbHIubmV0OjUwMDEvY2xpZW50Lz9odWI9c3RvcHNodWIiXSwibmJmIjoxNTI3MTMwNzQ4LCJpYXQiOjE1MjcxMzA3NDh9.ZBnidJ4qAPceXFTrUcbIr_cmxMCpunxqP0P_s1zvR50

It looks like it is passing the JWT sent in my connect call over to Azure SignalR. Wondering if maybe then Azure SignalR somehow uses this when connecting back to my hub. But I dont know how...and however it does it is maybe not passing my Authorize requirement?

[xscript]

The Authorize requirement still runs in your app server.
By default, all claims of an Authenticated user will be passed to SignalR Service. Then SignalR Service will pass all claims in the JWT back to your app server to build a new connection.
From the token you pasted here, I can see tenantid claim exists and has the value of 5.
I am trying to figure out what is the gap here.

[johnkwaters]

Thanks!
To sum up the findings so far: when using Authorize and SignalR Azure OnConnectedAsync is not called. When using plain vanilla signalr, it is. If I remove Authorize, it is called. The authorization itself appears to be working fine, the tokens flying around in the logs look correct.
One more observation - I tried adding a handler for the getclaims function in the Azure SignalR options, and could see that the claims principal passed into that func already had the correct claims.

[johnkwaters]

"Then SignalR Service will pass all claims in the JWT back to your app server to build a new connection" - how does it pass them back - the way it does this seems to not pass the Authorize muster. My app is happy if it finds the JWT on the querystring in a variable called token, or access_token, or if it is in the Authorization: Bearer http header. How does the service pass the claims when building the new connection?

[johnkwaters]

And looking at the debug console I dont see any token authentication failing. I dont see any failures at all. On the middle tier or the client.

[johnkwaters]

I looked at the token too and it has all the correct claims in it.

[xscript]

This is pretty weird. We have a sample using authorized hub too. I tried it again today and it works well.
You can find the code here. I changed it a little to use a policy. Client can successfully connected to server.

[johnkwaters]

Its not the same auth scheme though. You are using github and cookies... my auth pipeline uses JwtBearer

[johnkwaters]

How about you see if your code works with a JWT and Bearer Auth, no cookies or GitHub oauth?
Also - how does the Azure SignalR service establish it's connection? I dont see that incoming request...