Leaf设备经透明边缘网关连IoT Central时遇RefusedNotAuthorized错误

我通过透明边缘网关让Leaf设备向IoT Central发送消息时，持续遇到RefusedNotAuthorized异常。网关与Leaf设备通过同一设备连接组完成预配，所有证书均使用同一根CA和中间CA证书生成。

Leaf设备配置 #

Leaf设备采用官方示例项目，配置变量如下：

export IOTHUB_HOSTNAME="iotc-xxxxxxxxxxxxxxxxxxxxx.azure-devices.net"
export IOTEDGE_GATEWAY_HOSTNAME="arkham.localdomain"
export DEVICE_ID="leaf-device-cert"
export DEVICE_IDENTITY_X509_CERTIFICATE_PEM_PATH="/certs/iot-edge-device-identity-leaf-device-cert-full-chain.cert.pem"
export DEVICE_IDENTITY_X509_CERTIFICATE_KEY_PEM_PATH="/private/iot-edge-device-identity-leaf-device-cert.key.pem"
export IOTEDGE_TRUSTED_CA_CERTIFICATE_PEM_PATH="/certs/azure-iot-test-only.root.ca.cert.pem"
export MESSAGE_COUNT="2"
export DEVICE_CLIENT_PROTOCOL="Mqtt"

边缘网关配置 #

边缘网关配置文件内容：

hostname = "arkham.localdomain"
trust_bundle_cert = "file:///var/aziot/certs/azure-iot-test-only.root.ca.cert.pem"

auto_reprovisioning_mode = "AlwaysOnStartup"
[provisioning]
source = "dps"
global_endpoint = "https://global.azure-devices-provisioning.net/"
id_scope = "XXXXXXXXXXX"

[provisioning.attestation]
method = "x509"
registration_id = "edge-gateway-device-cert"

identity_cert = "file:///var/aziot/certs/iot-edge-device-identity-edge-gateway-device-cert-full-chain.cert.pem"
identity_pk = "file:///var/aziot/secrets/iot-edge-device-identity-edge-gateway-device-cert.key.pem"

[agent]
name = "edgeAgent"
type = "docker"
imagePullPolicy = "on-create" # "on-create" or "never". Defaults to "on-create"

[agent.config]
image = "mcr.microsoft.com/azureiotedge-agent:1.5"

[edge_ca]
cert = "file:///var/aziot/certs/iot-edge-device-ca-edge-gateway-device-ca-full-chain.cert.pem"
pk = "file:///var/aziot/secrets/iot-edge-device-ca-edge-gateway-device-ca.key.pem"

edgeHub环境变量尝试 #

我尝试了两种edgeHub环境变量配置：

• Leaf设备未关联网关时：

"edgeHub": {
    "env": {
        "NestedEdgeEnabled": {
            "value": "false"
        },
        "AuthenticationMode": {
            "value": "CloudAndScope"
        }
    }
}

• Leaf设备关联网关时：

"edgeHub": {
    "env": {
        "NestedEdgeEnabled": {
            "value": "true"
        },
        "AuthenticationMode": {
            "value": "Scope"
        }
    }
}

错误信息 #

两种配置均返回相同错误：

Sending message: 0, Data: [{MyFirstDownstreamDevice "messageId":0,"temperature":21,"humidity":67}]CONNECT failed: RefusedNotAuthorized

edgeHub日志 #

edgeHub日志输出如下：

[INF] [Microsoft.Azure.Devices.Edge.Hub.Core.DeviceScopeAuthenticator] - Client leaf-device-cert in device scope not authenticated locally.

[DBG] [Microsoft.Azure.Devices.Edge.Hub.Core.Authenticator] - leaf-device-cert authentication failure

[ERR] [Microsoft.Azure.Devices.Edge.Hub.Mqtt.DeviceIdentityProvider] - Unable to generate identity for clientId leaf-device-cert and username arkham.localdomain/leaf-device-cert/?api-version=2020-09-30&DeviceClientType=.NET/1.42.3+2a97dd06e82cb67c5be8a7c7d189bef8048a3a86 (.NET 8.0.10; Ubuntu 24.04.1 LTS; X64)

[INF] [EdgeHub] - "ClientNotAuthenticated, Client ID: leaf-device-cert; Username: arkham.localdomain/leaf-device-cert/?api-version=2020-09-30&DeviceClientType=.NET/1.42.3+2a97dd06e82cb67c5be8a7c7d189bef8048a3a86 (.NET 8.0.10; Ubuntu 24.04.1 LTS; X64), 22250e14"

内容的提问来源于stack exchange，提问作者Gareth