Trouble Adding User to Group in Azure Web PubSub - Getting 403 Forbidden Error

Question

I am working on a project that involves adding users to groups in Azure Web PubSub using the WebPubSubServiceClient in C#. However, I am facing an issue and could use some guidance.

When attempting to add a user to a group, I encounter the following error:

Result: Error occurred while adding user to group
Exception: Azure.RequestFailedException: Service request failed.
Status: 403 (Forbidden)

Code Snippet:

var service = new WebPubSubServiceClient(new Uri($"https://{hostName}.webpubsub.azure.com"), hub, new DefaultAzureCredential());
service.AddUserToGroup(groupName, request.ConnectionContext.UserId);

Tried also

var service = new WebPubSubServiceClient(connectionString, hub);
service.AddUserToGroup(groupName, request.ConnectionContext.UserId);

Context:

I have confirmed that the hub and groupName exist. The request.ConnectionContext.UserId is correctly set. I am using the Azure.WebPubSub Contributor role.

I am calling this code in Azure Function App.

Url Template I am using : https://domain/{event}

Answer 1

The code below generates a client access URL, connects a user to a group, and sends a message to the connected user using the Azure Web PubSub service.

  string userId = req.Query["userId"];
       string tokenLifetime = req.Query["tokenLifetime"];

       // Create a WebPubSubServiceClient
       var service = new WebPubSubServiceClient(connectionString, hubName);

       // Generate Client Access URL based on query parameters
       var url = GenerateClientAccessUrl(service, userId, tokenLifetime);

       // Connect the user to a group
       string groupName = "group1"; // Replace with your desired group name
       ConnectUserToGroup(service, userId, groupName);

       // Send a message to the connected user
       string messageContent = "Hello, user!"; // Replace with your desired message content
       if (SendMessageToUser(service, userId, messageContent))
       {
           log.LogInformation("Message sent successfully.");
           return new OkObjectResult($"Client Access URL: {url}, Message sent successfully.");
       }
       else
       {
           log.LogError("Failed to send message.");
           return new BadRequestObjectResult($"Failed to send message. Client Access URL: {url}");
       }
   }

   private static string GenerateClientAccessUrl(WebPubSubServiceClient service, string userId, string tokenLifetime)
   {
       // Example: Generate Client Access URL with user ID
       if (!string.IsNullOrEmpty(userId))
       {
           return service.GetClientAccessUri(userId: userId).ToString();
       }

       // Example: Generate Client Access URL with token lifetime
       if (!string.IsNullOrEmpty(tokenLifetime) && TimeSpan.TryParse(tokenLifetime, out var lifetime))
       {
           return service.GetClientAccessUri(expiresAfter: lifetime).ToString();
       }

       // Default: Generate Client Access URL without additional parameters
       return service.GetClientAccessUri().ToString();
   }

   private static void ConnectUserToGroup(WebPubSubServiceClient service, string userId, string groupName)
   {
       // Connect the user to the specified group
       service.SendToAll(
           JsonConvert.SerializeObject(new
           {
               type = "addToGroup",
               group = groupName,
               user = userId
           })
       );
   }

   private static bool SendMessageToUser(WebPubSubServiceClient service, string userId, string messageContent)
   {
       try
       {
           // Send a message to the specified user
           service.SendToUser(
               userId,
               JsonConvert.SerializeObject(new
               {
                   type = "message",
                   content = messageContent
               })
           );

           return true; // Message sent successfully
       }
       catch (Exception ex)
       {
           // Handle the exception as needed
           return false; // Failed to send message
       }
   }
}

• The code reference for client authentication from the MSDOC.

 [FunctionName("negotiate")]
 public static WebPubSubConnection Run(
     [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)] HttpRequest req,
     [WebPubSubConnection(Hub = "simplechat", UserId = "{headers.x-ms-client-principal-name}")] WebPubSubConnection connection,
     ILogger log)
 {
     log.LogInformation("Connecting...");
     return connection;
 }

• For full code refer to the document provided above.