Testing the Deployment

To test the deployment you will retrieve an access token and make an API call to ensure that the app was correctly deployed to your environment. In the test you can leverage the APIs directly, for example by using a client like Postman, or any HTTP client. The test assumes that you have registered the FIDO Connector client as described in Registering Apps.

To retrieve an access token, do the following:

  1. Go to the previously created FIDO Connector client.
  2. From your client, make an API call using the following request:
    • Method: POST
    • URL: https://login.microsoftonline.com/{your azure tenant domain}/oauth2/v2.0/token
    • Header: Content-Type - application/x-www-form-urlencoded
    • Body:
      • grant_type: client_credentials
      • client_id: Client ID created for the FIDO Connector client.
      • client_secret: Client secret from when you created the test client.
      • scope: api://fido-connector-api.{verified domain name}/.default
  3. Send the request.
  4. From the response, copy the access_token value.

To call the API, do the following:

  1. From your client, make an API call using the following request:
    • Method: GET
    • URL: https://{url of your container app}/v1/status. For base URL, copy the Application URL from your Container App.
    • Header:
      • Authorization - Bearer {access_token from previous step} Example: Bearer eyJ0…
      • Content-Type - application/json
  2. From this API call you should receive a 200 status code, with a response payload that outlines the different environment configurations that were made during setup of the components. Double-check these responses to ensure that they are correct.

Troubleshooting

The following provides basic troubleshooting steps for common deployment issues.

Where to Start?

  1. What is the error message that you are getting?
  2. Verify the environment variables and key vault values:
    1. Key Vault Administrator is required to view key vault entries.
    2. Verify secrets entries for the YubiKey as a Service API. Must be a valid token retrieved from the Customer Portal, see Creating an API Token.
  3. Review response message from the Credential API Container App.
  4. Check Container App Logs.
  5. Verify Environment Variables.
  6. Verify Azure Key Vault values.

Verifying Shipment Status in Storage Browser

  1. Sign in to the Azure portal.
  2. Go to the Resource Group.
  3. Go to Storage Account > Storage Browser > Tables.
  4. Click the fprshipments table.
  5. Find the desired shipment by shipmentId.
  6. Verify that the state of the shipment is complete. A shipmentId status that is not updated to “complete” will continue to retry. Once you investigate and resolve the issue, the status can be manually updated to “complete”.
  7. If a shipmentId has encountered an error during processing, it will be recorded in the fprshipments table fields error_kind and error_message.
  8. Once you have investigated and resolved the issue, the shipment will be reprocessed during the next scheduled run to “complete” status. Alternatively, the status can be manually updated to “complete” if the cause of the error cannot be resolved.

Note

The shipment status and processing error recorded in the fprshipments table can also be obtained by calling the API as described in Get Shipment Request Status in the API Reference. You can find more details to understand the error in Checking FIDO Connector Logs.

Verifying Delivery Status of YubiKey PIN

By default FIDO Pre-reg is configured to send emails to the end user’s manager. If the manager relationship for the end user is not set up, or the manager does not have an email address configured, the PIN delivery will fail.

To verify that the PIN delivery was successful, do the following:

  1. Sign in to the Azure portal.
  2. Go to Resource Group > Logic App.
  3. In the left menu, click Development tools > Run history.
  4. Verify that you have a record with Status “Succeeded”.
  5. If the status is “Succeeded”:
    1. Open the history record.
    2. Select the connector for “HTTP - Get User Manager Details”.
    3. In the Parameters tab of the Outputs section, verify that Body has a field for the “mail” attribute populated with the email address of the end user’s manager.
  6. If the status is “Failed”:
    1. Open the history record.
    2. Review which connector had an error and investigate the details of the error by clicking the connector.

Checking FIDO Connector Logs

Implementations of the FIDO Connector (v 2.1.0 and later) using the ARM template, are deployed with the Azure Logs API configured, and you can use Log Analytics in Azure Monitor to run queries using the KQL (Kusto Query Language) to identify errors when troubleshooting.

  1. Sign in to the Azure portal.

  2. In the search bar at the top of the page, type “Log Analytics workspaces” and select it from the list of matching results under Services.

  3. Click the workspace with the name of the Container app for your FIDO Connector, logs-<Container_App_Name>.

  4. In the workspace’s left menu, click Logs.

  5. Switch the Agent toggle in the top-right corner of the page to “OFF”. Recent portal builds open Logs in Agent mode, instead of a query editor. If you see a “Hello! I can help you explore and explain your Log Analytics workspace telemetry” message, you are not in query mode, and pasting KQL produces an AI summary instead of a query result.

  6. If not already done, select “KQL mode” instead of “Simple mode” in the drop-down in the top right of the page.

  7. You should now have an empty KQL editor with a Run button at the top, and a Tables tree to the left.

  8. In the KQL editor, paste the following query and click Run:

    ContainerAppConsoleLogs
 | where TimeGenerated > ago(30m)
 | project TimeGenerated, ContainerAppName, ContainerName, RevisionName, Log
 | order by TimeGenerated desc
 | take 50

  9. A successful query returns a Results table with log lines in the Log column. For more information, see Log Analytics in Azure Monitor (Microsoft documentation).