I have an Event Hub and I want to restrict who can and cannot publish and consume events. The publishing of events works as described here: https://learn.microsoft.com/en-us/rest/api/eventhub/get-azure-active-directory-token
I am able to publish events by supplying a JWT to my Event Hub: https://${Hub-NameSpace}.servicebus.windows.net/${EventHub}/messages
Example:
curl --location --request POST 'https://${Hub-NameSpace}.servicebus.windows.net/${EventHub}/messages' \
--header 'Authorization: Bearer ${TOKEN}' \
--header 'Content-Type: application/atom+xml;type=entry;charset=utf-8' \
--data-raw '{"Data":"Data"}'
However, when I try and consume using the same URL (sending a GET instead of a POST), I receive the following:
<Error>
<Code>400</Code>
<Detail>The requested HTTP operation is not supported in an EventHub. TrackingId: SystemTracker:EventHub:, Timestamp:2022-07-15T00:04:56</Detail>
</Error>
Example:
curl --location --request GET 'https://${Hub-NameSpace}.servicebus.windows.net/${EventHub}/messages' \
--header 'Authorization: Bearer ${TOKEN}' \
--header 'Content-Type: application/atom+xml;type=entry;charset=utf-8'
I am aware that I can consume using the Shared Access Policy endpoints, but I was wondering if I could also do it using the Authentication Token from AAD. I have a feeling that I should only need to provide the Consumer Group, but I cannot find any documentation on doing this.
In the previously linked article it states:
This article gives you an example of getting an Azure Active Directory (Azure AD) token that you can use to send events to and receive events from a Service Bus namespace.
However it shows no examples on receiving events.
Receiving events is not supported using the Event Hubs REST API.
In order to consume events, you'll need to either use the AMQP or Kafka protocols. The easiest path to do so is using one of the official SDKs. More information can be found in the Event Hubs Getting Started Guide.