Azure中国区EventHub触发器Azure Function报获取分区ID未授权错误

问题背景 #

• Stack Overflow上存在若干相关问题帖，但均未涉及本次遇到的授权错误场景。
• 使用C#开发的搭载EventHub触发器的Azure Function在Azure中国区运行失败，相同代码在Azure全球版可正常运行。
• 已确认触发器连接字符串配置正确，分别尝试了具备Listen和Manage权限的密钥，问题仍然存在。

完整报错信息 #

Microsoft.Azure.WebJobs.Host.Listeners.FunctionListenerException: The listener for function 'FilterFunctionEventhubTrigger' was unable to start.

 ---> Microsoft.Azure.EventHubs.Processor.EventProcessorConfigurationException: Encountered error while fetching the list of EventHub PartitionIds

 ---> System.UnauthorizedAccessException: Unauthorized

   at Microsoft.Azure.EventHubs.Amqp.Management.AmqpServiceClient.GetRuntimeInformationAsync()

   at Microsoft.Azure.EventHubs.EventHubClient.GetRuntimeInformationAsync()

   at Microsoft.Azure.EventHubs.Processor.PartitionManager.GetPartitionIdsAsync()

   --- End of inner exception stack trace ---

   at Microsoft.Azure.EventHubs.Processor.PartitionManager.GetPartitionIdsAsync()

   at Microsoft.Azure.EventHubs.Processor.PartitionManager.GetPartitionIdsAsync()

   at Microsoft.Azure.EventHubs.Processor.PartitionManager.InitializeStoresAsync()

   at Microsoft.Azure.EventHubs.Processor.PartitionManager.StartAsync()

   at Microsoft.Azure.EventHubs.Processor.EventProcessorHost.RegisterEventProcessorFactoryAsync(IEventProcessorFactory factory, EventProcessorOptions processorOptions)

   at Microsoft.Azure.WebJobs.EventHubs.EventHubListener.StartAsync(CancellationToken cancellationToken)

   at Microsoft.Azure.WebJobs.Host.Listeners.FunctionListener.StartAsync(CancellationToken cancellationToken, Boolean allowRetry) in C:\projects\azure-webjobs-sdk-rqm4t\src\Microsoft.Azure.WebJobs.Host\Listeners\FunctionListener.cs:line 68

   --- End of inner exception stack trace --

项目csproj配置 #

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFramework>netcoreapp3.1</TargetFramework>
    <AzureFunctionsVersion>v3</AzureFunctionsVersion>
    <RootNamespace>sss_af_filter</RootNamespace>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Azure.Messaging.EventHubs" Version="5.6.0" />
    <PackageReference Include="Microsoft.ApplicationInsights.DependencyCollector" Version="2.18.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions" Version="4.0.1" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.EventHubs" Version="4.2.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Logging.ApplicationInsights" Version="3.0.27" />
    <PackageReference Include="Microsoft.NET.Sdk.Functions" Version="3.0.11" />
    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.10.0" />
    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
    <PackageReference Include="System.Data.SqlClient" Version="4.8.2" />
    <PackageReference Include="xunit" Version="2.4.1" />
    <PackageReference Include="xunit.runner.visualstudio" Version="2.4.3">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
      <PrivateAssets>all</PrivateAssets>
    </PackageReference>
  </ItemGroup>
  <ItemGroup>
    <None Update="host.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="local.settings.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <CopyToPublishDirectory>Never</CopyToPublishDirectory>
    </None>
  </ItemGroup>
</Project>

解决思路 #

1. 修复包依赖冲突：当前项目同时引用了新一代Azure.Messaging.EventHubs v5.6.0和旧版的Microsoft.Azure.WebJobs.Extensions.EventHubs v4.2.0，v4版本的EventHubs扩展底层依赖的是旧版Microsoft.Azure.EventHubs包，两代SDK混用会在中国区环境下出现端点解析、鉴权逻辑不兼容的问题。建议卸载Azure.Messaging.EventHubs包，或者将Microsoft.Azure.WebJobs.Extensions.EventHubs升级到v5.x以上版本，保持SDK版本一致。
2. 修正连接字符串域名后缀：Azure中国区EventHub的默认域名后缀是servicebus.chinacloudapi.cn，不要误填为全球版的servicebus.windows.net，如果连接字符串是从全球版复制的需要手动修改域名部分。
3. 检查Checkpoint存储账户配置：EventHub触发器的检查点功能依赖Azure存储账户，中国区存储账户的连接字符串域名后缀为core.chinacloudapi.cn，如果存储账户同样部署在中国区，需要确认存储连接字符串配置正确，没有误填全球版后缀。
4. 校验权限配置范围：确认你使用的Listen/Manage权限是在对应Event Hub实例级别授予的，而不是仅在命名空间级别授予部分权限，同时确认密钥没有过期、命名空间没有启用IP白名单拦截Function的出站IP。
5. 调整传输协议规避端口拦截：中国区部分网络环境会拦截AMQP默认端口5671，你可以在连接字符串末尾追加;TransportType=AmqpWebSockets走443端口传输，避免端口拦截导致的鉴权失败。

内容的提问来源于stack exchange，提问作者Patrick