Can downstream device connect using SAS token signed by Shared Access policy?

Question

While using Azure IoT Edge as a transparent gateway, can downstream devices authenticate using SAS tokens using the Shared Access Policy keys? (device, iothubowner etc?). We have being able to successfully connect using SAS tokens signed by the device primary keys, but trying to do so with Shared Access Policy keys doesn't seem to work.

Note: The devices are using MQTT

Answer 1

Yes, this should work if the device is not a child device of the Edge Device in IoTHub. Look at these links to find out more about how to add devices as a child device of an Edge Device https://aka.ms/exofdocs and https://aka.ms/iot-edge-offline .

This is because, if the leaf device is a child device, EdgeHub will try to authenticate it locally, and for that it only uses the device's key.

If the leaf device is not a child device of the Edge Device, then you should be able to connect to the EdgeHub using the device/iothub scoped key, since then the EdgeHub will authenticate the device with IoTHub. Note that the connection string should be of the format – HostName=.azure-devices.net;DeviceId=;SharedAccessKeyName=;SharedAccessKey=;GatewayHostName=

Answer 2

I don't think that script (which is an eventhub script) creates the right SAS tokens for IoT Hub. The easiest way to do it is to do it from the Azure Cloud CLI (in the azure portal, click on the ">_" button up in the top nav bar.. then you can run this command:

az iot hub generate-sas-token -n [your iothub name] --policy device --key-type primary --duration [duration in seconds you want the token to be valid]

Try using that SAS token. I tested this tonight with the python paho.mqtt client and it worked fine. It connected to IoT Edge and successfully sent messages to both a module and IoT Hub.