Search code examples
c#azure-functionsazureservicebusmasstransitazure-managed-identity

MassTransit RequestClient Timeout on Azure - Possible Issue with Response Queue and Managed Identity

I am using MassTransit with Azure Service Bus in a Function App where I have a producer API sending messages via RequestClient<T>, and a consumer running in the Function App processing those messages and responding back. Everything works fine when debugging locally, but when deployed to Azure, the producer times out waiting for a response.

Expected Behavior

The producer sends a request using RequestClient<T> and expects a response. The consumer processes the message and responds back using context.RespondAsync(response). The producer should receive the response without timing out.

What I Have Already Checked

The MassTransit bus is started and working – My Function App has other consumers that process messages correctly.

Queues are separate for each consumer – I am not mistakenly sharing queues between multiple consumers.

In general all the configurations are ok because everything works fine when running locally.

I suspect the issue could be with the temporary response queue that MassTransit creates automatically.

Permissions issue with Managed Identity? – The Function App uses Managed Identity to connect to Azure Service Bus. Perhaps the Managed Identity does not have permissions to read from the response queue? I gave "owner" permission to the user assigned managed identities assigned to the producer API and the function App on the entire service bus namespace but it didn't fix the issue.

Producer config:

cfg.AddRequestClient<ConfirmBankTransferPurchaseMessage>(
            new Uri("queue:confirm-banktransfer-purchase"), TimeSpan.FromMinutes(2));
cfg.AddRequestClient<ConfirmBankTransferPaymentMessage>(
            new Uri("queue:confirm-banktransfer-payment"), TimeSpan.FromMinutes(2));

Consumer config:

busConfigurator.ReceiveEndpoint("confirm-banktransfer-purchase", e => e.ConfigureConsumer<ConfirmBankTransferPurchaseConsumer>(busContext));
busConfigurator.ReceiveEndpoint("confirm-banktransfer-payment", e => e.ConfigureConsumer<ConfirmBankTransferMidtermPaymentConsumer>(busContext));

My Questions

Does MassTransit require specific permissions for its temporary response queues when using Managed Identity on Azure?

If so, how can I ensure my Managed Identity has access to these queues?

Is there a way to debug the temporary response queue in MassTransit to confirm if messages are getting stuck there?

Would configuring a static response queue instead of a temporary one help? If so, how?

Any help would be greatly appreciated! Thanks in advance!

Solution

  • Yes, MassTransit requires specific permissions for its temporary response queues when using Managed Identity on Azure. The Managed Identity needs permissions to create, read, and delete these temporary queues. You should ensure that the Managed Identity has the "Azure Service Bus Data Owner" role assigned to it.To assign yourself this role, you'll need the User Access Administrator role, or another role that includes the Microsoft.Authorization/roleAssignments/write action

    Instead of MassTransit generating response queues dynamically, explicitly configure one: Producer Configuration:

    cfg.AddRequestClient<ConfirmBankTransferPurchaseMessage>( new Uri("queue:confirm-banktransfer-purchase"), TimeSpan.FromMinutes(2), c => c.UseResponseAddress(new Uri("queue:static-response-queue")) );

    Consumer Configuration:

    busConfigurator.ReceiveEndpoint("static-response-queue", e => { e.Consumer<ResponseConsumer>(); });

    To debug the temporary response queues in MassTransit, you can enable detailed logging. This will help you see if messages are getting stuck in the response queue. use this git for Request/Response pattern on multiple queues

    Output