AddCertificate_Orchestrator

[paulallington]

I am having problems with issuing certificates. The function is generating the following error, and I can't work out why. I'm pretty sure it's permissions, but I have definitely set permissions everywhere as in the readme, but it's still not working

Orchestrator function 'AddCertificate_Orchestrator' failed: The activity function 'UpdateSiteBinding' failed: "Failed to deserialize exception from TaskActivity: {"$type":"Microsoft.Azure.Management.WebSites.Models.DefaultErrorResponseException, Microsoft.Azure.Management.Websites","Request":{"$type":"Microsoft.Rest.HttpRequestMessageWrapper, Microsoft.Rest.ClientRuntime","Method":{"$type":"System.Net.Http.HttpMethod, System.Net.Http","Method":"PUT"},"RequestUri":"https://management.azure.com/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/myapp/providers/Microsoft.Web/sites/myapp-app/slots/stage?api-version=2021-01-15","Properties":{"$type":"System.Collections.Generic.Dictionary`2[[System.String, System.Private.CoreLib],[System.Object, System.Private.CoreLib]], System.Private.CoreLib"},"Content":"{\r\n "properties": {\r\n "enabled": true,\r\n "hostNameSslStates": [\r\n {\r\n "name": "myapp-app-stage.azurewebsites.net",\r\n "sslState": "Disabled",\r\n "hostType": "Standard"\r\n },\r\n {\r\n "name": "estage.myapp.co.uk",\r\n "sslState": "SniEnabled",\r\n "thumbprint": "881A4C668543DA8DDDADA118BB7C25873FC06887",\r\n "toUpdate": true,\r\n "hostType": "Standard"\r\n },\r\n {\r\n "name": "mstage.myapp.co.uk",\r\n "sslState": "SniEnabled",\r\n "thumbprint": "881A4C668543DA8DDDADA118BB7C25873FC06887",\r\n "toUpdate": true,\r\n "hostType": "Standard"\r\n },\r\n {\r\n "name": "stage.clubmate.co.uk",\r\n "sslState": "SniEnabled",\r\n "thumbprint": "881A4C668543DA8DDDADA118BB7C25873FC06887",\r\n "toUpdate": true,\r\n "hostType": "Standard"\r\n },\r\n {\r\n "name": "stage.myapp.co.uk",\r\n "sslState": "SniEnabled",\r\n "thumbprint": "881A4C668543DA8DDDADA118BB7C25873FC06887",\r\n "toUpdate": true,\r\n "hostType": "Standard"\r\n },\r\n {\r\n "name": "myapp-app-stage.scm.azurewebsites.net",\r\n "sslState": "Disabled",\r\n "hostType": "Repository"\r\n }\r\n ],\r\n "serverFarmId": "/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/myapp/providers/Microsoft.Web/serverfarms/myapp-App",\r\n "reserved": true,\r\n "isXenon": false,\r\n "hyperV": false,\r\n "siteConfig": {\r\n "numberOfWorkers": 1,\r\n "linuxFxVersion": "DOTNETCORE|6.0",\r\n "acrUseManagedIdentityCreds": false,\r\n "alwaysOn": true,\r\n "http20Enabled": false,\r\n "functionAppScaleLimit": 0,\r\n "minimumElasticInstanceCount": 1\r\n },\r\n "scmSiteAlsoStopped": false,\r\n "clientAffinityEnabled": false,\r\n "clientCertEnabled": false,\r\n "clientCertMode": "Required",\r\n "hostNamesDisabled": false,\r\n "customDomainVerificationId": "25C5D3F56C45B4E5A395C0B42FB4090CDE8A76770C36E78C91E8B5B68ECE420A",\r\n "containerSize": 0,\r\n "dailyMemoryTimeQuota": 0,\r\n "httpsOnly": true,\r\n "redundancyMode": "None",\r\n "storageAccountRequired": false,\r\n "keyVaultReferenceIdentity": "SystemAssigned",\r\n "virtualNetworkSubnetId": "/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/CoreServices/providers/Microsoft.Network/virtualNetworks/CoreVNet/subnets/default"\r\n },\r\n "kind": "app,linux",\r\n "location": "UK South"\r\n}","Headers":{"$type":"System.Collections.Generic.Dictionary2[[System.String, System.Private.CoreLib],[System.Collections.Generic.IEnumerable1[[System.String, System.Private.CoreLib]], System.Private.CoreLib]], System.Private.CoreLib","x-ms-client-request-id":["45cdb584-ded6-49e9-801c-d80e23db6458"],"Accept-Language":["en-US"],"Authorization":["Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjJaUXBKM1VwYmpBWVhZR2FYRUpsOGxWMFRPSSIsImtpZCI6IjJaUXBKM1VwYmpBWVhZR2FYRUpsOGxWMFRPSSJ9.eyJhdWQiOiJodHRwczovL21hbmFnZW1lbnQuYXp1cmUuY29tIiwiaXNzIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvZTcyOThlNjItMTMyOC00ZTAyLWE5YjQtZmIxMDMxYWIxMDJjLyIsImlhdCI6MTY2MzAxNTgwNiwibmJmIjoxNjYzMDE1ODA2LCJleHAiOjE2NjMxMDI1MDYsImFpbyI6IkUyWmdZR2k3dkU3a3V1VE81dXNSWjg1VlM5Mk9BQUE9IiwiYXBwaWQiOiI4ZTAwMzM0OC0yNzcwLTQzMGQtYmIwYy0zMjg5MzJhNmY2YTEiLCJhcHBpZGFjciI6IjIiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC9lNzI5OGU2Mi0xMzI4LTRlMDItYTliNC1mYjEwMzFhYjEwMmMvIiwiaWR0eXAiOiJhcHAiLCJvaWQiOiI4NmFlNTNkYS05ODZiLTRjNWQtYWQ2Ny00OTgyY2M1YWE0ZjMiLCJyaCI6IjAuQUFBQVlvNHA1eWdUQWs2cHRQc1FNYXNRTEVaSWYza0F1dGRQdWtQYXdmajJNQk1SQUFBLiIsInN1YiI6Ijg2YWU1M2RhLTk4NmItNGM1ZC1hZDY3LTQ5ODJjYzVhYTRmMyIsInRpZCI6ImU3Mjk4ZTYyLTEzMjgtNGUwMi1hOWI0LWZiMTAzMWFiMTAyYyIsInV0aSI6ImlVZ0I5YzdNTmt1VDNJQTNqVFFKQVEiLCJ2ZXIiOiIxLjAiLCJ4bXNfbWlyaWQiOiIvc3Vic2NyaXB0aW9ucy9jNzA5YWU5MS0xNDVjLTQ5ZTktYjM2Zi04Njg3ZDIwZjRhMDEvcmVzb3VyY2Vncm91cHMvQ29yZVNlcnZpY2VzL3Byb3ZpZGVycy9NaWNyb3NvZnQuV2ViL3NpdGVzL2Z1bmMtYWNtZS1ib3QtaXp2ayIsInhtc190Y2R0IjoxNDM5OTczOTI4fQ.AGqj5Vcujf75jGD-Bbv1M5LxPX8ULHg5-92gXMKm1AcyHVi__Rq4cxDq88q1gQLLQvST9UpoW3oni0S6zeVmpK87IUUN23yYvC3bHuxqk0Ru1T9_G_alW5hjgzWOMJ6k2w4dH_UU9vznX35cT_JhWpViQFUS3BE79n9TlPCqNDur4n3h9VsnGu7xQ8cEdZ0d55Qws2R0I3LaxsFTaO49qB_LIHhM8LBO2kA91wzEH5i14njzmXaEJjxH858-6gg2I-VjUDNs816_UOTqg_CerHhoarnjZfM5IHS0WjBs45IodONGbLjAv-mIYaXazeKRmqqlPbOSmM56_pLM9sH7Bg"],"User-Agent":["FxVersion/4.700.22.30802","OSName/Windows","OSVersion/Microsoft.Windows.10.0.14393","Microsoft.Azure.Management.WebSites.WebSiteManagementClient/3.1.2"],"Request-Context":["appId=cid-v1:74f1dca5-ead1-45b8-a417-6cf4998a9edb"],"Request-Id":["|c25acc31222f4c42809b912fe79f7442.ff8b07d3ac09124b."],"traceparent":["00-c25acc31222f4c42809b912fe79f7442-ff8b07d3ac09124b-00"],"Content-Type":["application/json; charset=utf-8"],"Content-Length":["2469"]}},"Response":{"$type":"Microsoft.Rest.HttpResponseMessageWrapper, Microsoft.Rest.ClientRuntime","StatusCode":403,"ReasonPhrase":"Forbidden","Content":"{"error":{"code":"LinkedAuthorizationFailed","message":"The client '86ae53da-986b-4c5d-ad67-4982cc5aa4f3' with object id '86ae53da-986b-4c5d-ad67-4982cc5aa4f3' has permission to perform action 'Microsoft.Web/sites/slots/write' on scope '/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/myapp/providers/Microsoft.Web/sites/myapp-app/slots/stage'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/CoreServices/providers/Microsoft.Network/virtualNetworks/CoreVNet/subnets/default' or the linked scope(s) are invalid."}}","Headers":{"$type":"System.Collections.Generic.Dictionary2[[System.String, System.Private.CoreLib],[System.Collections.Generic.IEnumerable1[[System.String, System.Private.CoreLib]], System.Private.CoreLib]], System.Private.CoreLib","Cache-Control":["no-cache"],"Pragma":["no-cache"],"x-ms-failure-cause":["gateway"],"x-ms-request-id":["14b2f92f-e0e2-413f-8952-2b216d334f78"],"x-ms-correlation-request-id":["14b2f92f-e0e2-413f-8952-2b216d334f78"],"x-ms-routing-request-id":["UKSOUTH:20220912T210412Z:14b2f92f-e0e2-413f-8952-2b216d334f78"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains"],"X-Content-Type-Options":["nosniff"],"Date":["Mon, 12 Sep 2022 21:04:11 GMT"],"Connection":["close"],"Content-Type":["application/json; charset=utf-8"],"Expires":["-1"],"Content-Length":["653"]}},"Body":{"$type":"Microsoft.Azure.Management.WebSites.Models.DefaultErrorResponse, Microsoft.Azure.Management.Websites","error":{"$type":"Microsoft.Azure.Management.WebSites.Models.DefaultErrorResponseError, Microsoft.Azure.Management.Websites","code":"LinkedAuthorizationFailed","message":"The client '86ae53da-986b-4c5d-ad67-4982cc5aa4f3' with object id '86ae53da-986b-4c5d-ad67-4982cc5aa4f3' has permission to perform action 'Microsoft.Web/sites/slots/write' on scope '/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/myapp/providers/Microsoft.Web/sites/myapp-app/slots/stage'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/c709ae91-145c-49e9-b36f-8687d20f4a01/resourceGroups/CoreServices/providers/Microsoft.Network/virtualNetworks/CoreVNet/subnets/default' or the linked scope(s) are invalid.","target":null,"details":null,"innererror":null}},"StackTrace":" at Microsoft.Azure.Management.WebSites.WebAppsOperations.BeginCreateOrUpdateSlotWithHttpMessagesAsync(String resourceGroupName, String name, Site siteEnvelope, String slot, Dictionary2 customHeaders, CancellationToken cancellationToken)\r\n at Microsoft.Azure.Management.WebSites.WebAppsOperations.CreateOrUpdateSlotWithHttpMessagesAsync(String resourceGroupName, String name, Site siteEnvelope, String slot, Dictionary2 customHeaders, CancellationToken cancellationToken)\r\n at Microsoft.Azure.Management.WebSites.WebAppsOperationsExtensions.CreateOrUpdateSlotAsync(IWebAppsOperations operations, String resourceGroupName, String name, Site siteEnvelope, String slot, CancellationToken cancellationToken)\r\n at Microsoft.Azure.WebJobs.Host.Executors.VoidTaskMethodInvoker2.InvokeAsync(TReflected instance, Object[] arguments) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\VoidTaskMethodInvoker.cs:line 20\r\n at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker2.InvokeAsync(Object instance, Object[] arguments) in C:\projects\azure-webjobs-sdk-rqm4t\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionInvoker.cs:line 52\r\n at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker, ParameterHelper parameterHelper, CancellationTokenSource timeoutTokenSource, CancellationTokenSource functionCancellationTokenSource, Boolean throwOnTimeout, TimeSpan timerInterval, IFunctionInstance instance) in C:\projects\azure-webjobs-sdk-rqm4t\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionExecutor.cs:line 581\r\n at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance, ParameterHelper parameterHelper, ILogger logger, CancellationTokenSource functionCancellationTokenSource) in C:\projects\azure-webjobs-sdk-rqm4t\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionExecutor.cs:line 527\r\n at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance, FunctionStartedMessage message, FunctionInstanceLogEntry instanceLogEntry, ParameterHelper parameterHelper, ILogger logger, CancellationToken cancellationToken) in C:\projects\azure-webjobs-sdk-rqm4t\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionExecutor.cs:line 306","Message":"Operation returned an invalid status code 'Forbidden'","Data":{"$type":"System.Collections.ListDictionaryInternal, System.Private.CoreLib"},"InnerException":null,"HelpLink":null,"Source":"Microsoft.Azure.Management.Websites","HResult":-2146233088}". See the function execution logs for additional details.

[shibayan]

Please grant write permission to VNET as indicated in the error message. Due to the SDK used, it seems that write permission is required for VNET integration.