Create registration for Azure Notification Hub in Postman

Here is an example of a pre-request script for postman that generates the needed header:

function getAuthHeader(resourceUri, keyName, key) {

    var d = new Date();
    var sinceEpoch = Math.round(d.getTime() / 1000);

    var expiry = (sinceEpoch + 3600);

    var stringToSign = encodeURIComponent(resourceUri) + '\n' + expiry;

    var hash = CryptoJS.HmacSHA256(stringToSign, key);
    var hashInBase64 = CryptoJS.enc.Base64.stringify(hash);

    var sasToken = 'SharedAccessSignature sr=' + encodeURIComponent(resourceUri) + '&sig=' + encodeURIComponent(hashInBase64) + '&se=' + expiry + '&skn=' + keyName;

    return sasToken;
}

postman.setEnvironmentVariable('azure-authorization', getAuthHeader(request['url'], "mySharedAccessKeyName", "mySharedAccessKey"));
postman.setEnvironmentVariable('current-date',new Date().toUTCString());

To use it do the following:

1. add this pre-request script to your postman request
2. replace mySharedAccessKeyName , mySharedAccessKey with your credentials
3. add a header Authorization: {{azure-authorization}}
4. add a header x-ms-date: {{current-date}}

Your "Authorization" header is not correct.

As stated in the Azure Notification Hubs REST API documentation, e.g. for creating a registration, the "Authorization" header has to contain the "Token generated as specified in Shared Access Signature Authentication with Service Bus"...

The token format is specified in the documentation for Shared Access Signature Authentication with Service Bus as the following:

SharedAccessSignature sig=<signature-string>&se=<expiry>&skn=<keyName>&sr=<URL-encoded-resourceURI>

• URL-encoded-resourceURI: The url you send the POST request to (in your case "https://mysite.servicebus.windows.net/mysite-notif/registrations/?api-version=2015-01")
• keyName: In your case the default key name "DefaultFullSharedAccessSignature"
• expiry: The expiry is represented as the number of seconds since the epoch 00:00:00 UTC on 1 January 1970.
• signature-string: The signature for the SAS token is computed using the HMAC-SHA256 of a string-to-sign with the PrimaryKey property of an authorization rule. The string-to-sign consists of a resource URI and an expiry, formatted as follows:
  • StringToSign = <resourceURI> + "\n" + expiry;
  • resourceURI should be the same as URL-encoded-resourceURI (also URL encoded)
  • Compute the HMAC-SHA256 of StringToSign using the SAS key (what you replaces with [mykey] in your example). Use the URL encoded result for signature-string then.

After spending over an hour trying to understand why the steps above didn't work, I realized if you are using the code from https://code.msdn.microsoft.com/Shared-Access-Signature-0a88adf8 It has two things that are not defined at the top of the code. Key and KeyName.

The Key is the part that alluded me because at first glance on the other post here I thought it was the same. Its not.

In Azure: Go to your Notification Hub, Then Click > Settings> Access Policies then on the Policy that has Manage Permission. Add a policy if you need to. Once you Click on the Access Policy. It shows Connection String, Primary and Secondary. Copy the Primary to your Clipboard and throw it in notepad. It will look something like this..

Endpoint=sb://mysite.servicebus.windows.net/;SharedAccessKeyName=DefaultFullSharedAccessSignature;SharedAccessKey=hc7qZ+pMG6zltjmASDFrskZO+Yv52D55KQUxUTSO0og=

SharedAccessKeyName = KeyName

SharedAccessKey = Key

Yea it looks obvious all spelled out here but you cannot see this information in AZURE portal unless you copy it.

So Just to be totally Clear, in the header you generate the key "sig" by combining + "\n" + expiry which Baris did point out, but then you sign it with the Key not the KeyName..

I may sounds like an idiot spelling this out but this process is not an easy one.

Hope it helps someone else.