WebPubSub client can't join a group but can join other groups of the same access_token

Question

WebPubSub client can't join a group but can join other groups of the same access_token

Intelicosmos 60

We successfully create access_token for PubSub which includes webpubsub.joinLeaveGroup and webpubsub.sendToGroup for 4 groups (like A, B, C and D, so 8 roles in total) but the client (which is MAUI app) can't join the group D and receives "Received non-success acknowledge from the service: The client does not have permission to join group 'D'."!

I can confirm that once access_token is generated, we re-initialize the WebPubSubClient with the new token (which is successful) and then:

We are able to send message to group A
We are able to join group C

But we can't join group D!

Below is a last section of Python API code that generates the access_token. 'groups' variable is sent like 'A|B|C|D':

		....
		all_roles = []
        for group_name in groups.split('|'):
            all_roles.append("webpubsub.joinLeaveGroup." + group_name)
            all_roles.append("webpubsub.sendToGroup." + group_name)
        wsClient = WebPubSubServiceClient.from_connection_string(connectionstring, hub)
        token_key = wsClient.get_client_access_token(roles=all_roles, minutes_to_expire=1440)
        return str(token_key['url'])

In MAUI, our initialize and join group methods are:

public async Task InitializeConnection(string pubSubUrl)

{

try

{

    _client = new WebPubSubClient(new Uri(pubSubUrl));

    _client.GroupMessageReceived += HandleMessage;

    await _client.StartAsync();

    _isConnected = true;

}

catch (Exception ex)

{

    _isConnected = false;

    throw new Exception($"Failed to initialize WebSocket connection: {ex.Message}");

}

}

public async Task JoinGroup(string groupName)

{

if (!_isConnected)

    throw new InvalidOperationException("WebSocket is not connected");

try

{

    await _client.JoinGroupAsync(groupName);

}

catch (Exception ex)

{

    throw new Exception($"Failed to join group {groupName}: {ex.Message}");

}

}

Bhargavi Naragani 7,525 Reputation points Microsoft External Staff Moderator

2025-06-30T01:24:44.7933333+00:00
Hi Intelicosmos,
The issue you're seeing is almost certainly due to a minor mismatch in the group name string used in token generation versus what the client is trying to join. Trimming each group name in your Python backend should solve the problem.

Based on the symptoms, the issue most likely lies in how group names are being passed into the role generation logic.

Your Python code to build the roles looks like this:

for group_name in groups.split('|'): all_roles.append("webpubsub.joinLeaveGroup." + group_name) all_roles.append("webpubsub.sendToGroup." + group_name)

If the groups string is 'A|B|C|D', this logic should work. But in real-world scenarios, issues like whitespace or invisible characters can break things silently, e.g.:

" D" instead of "D"

An extra newline or carriage return at the end

URL-encoded or Unicode characters not matching group names

As a result, the actual role assigned might be webpubsub.joinLeaveGroup. D (with a space), which the client interprets differently from the actual group D.

Please sanitize your groups input by trimming each group name before appending roles. Here's the updated Python code snippet:

all_roles = [] for group_name in groups.split('|'): group_name = group_name.strip() # <-- This fixes hidden whitespace issues all_roles.append(f"webpubsub.joinLeaveGroup.{group_name}") all_roles.append(f"webpubsub.sendToGroup.{group_name}")

Also, double-check the exact group name you're trying to join from the MAUI app, it must exactly match (including case and whitespace) the group name specified in the access token.

Reference:
https://learn.microsoft.com/en-us/azure/azure-web-pubsub/howto-generate-client-access-url?tabs=javascript
https://learn.microsoft.com/en-us/python/api/overview/azure/messaging-webpubsubservice-readme?view=azure-python

Hope this helps, if you have any further concerns or queries, please feel free to reach out to us.

Intelicosmos 60

In order to make conversation easier, I have changed the Python code to make it super simple as:

        A = ...
		B = ...
		C= ...
		D = ...

		all_roles = []        
        all_roles.append("webpubsub.sendToGroup." + A.strip())

        all_roles.append("webpubsub.joinLeaveGroup." + B.strip())
        all_roles.append("webpubsub.sendToGroup." + B.strip())
        
        all_roles.append("webpubsub.joinLeaveGroup." + C.strip())
        all_roles.append("webpubsub.sendToGroup." + C.strip())

        all_roles.append("webpubsub.joinLeaveGroup." + D.strip())
        all_roles.append("webpubsub.sendToGroup." + D.strip())

        wsClient = WebPubSubServiceClient.from_connection_string(connectionstring, hub)
        token_key = wsClient.get_client_access_token(roles=all_roles, minutes_to_expire=1440)

We do not need to join A group, only sending message to A group is enough in our business.

The call from Postman, shows the the roles name in Python as:
User's image And the Error message from MAUI also shows as:
Note: Due to our client privacy, I can't show the A, B, C and D logic, also I would not be able to make this question accessible to public once problem solved!

Intelicosmos 60 Reputation points

2025-06-30T06:18:59.0633333+00:00

Is there anyway or tool to decompose the access_token and see what groups are included in the token?
Intelicosmos 60 Reputation points

2025-06-30T12:43:38.1333333+00:00

I think with the idea of using https://jwt.ms/ to decode the token, we have found that the token actually had all necessary roles, however before we join a group (D specially), we had to send a message (to A) and inside sending message, the token was overwritten with a new one which didn't include the D role! So, we are accepting that as our code issue and nothing wrong with the token itself!

Without decomposing the token, we couldn't come to this analysis. Thanks for the great support.
Bhargavi Naragani 7,525 Reputation points Microsoft External Staff Moderator

2025-06-30T14:50:38.03+00:00

Hi Intelicosmos, I've converted my comment to answer.

Please accept my answer if it helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Thank you.

Accepted answer

0 additional answers

Your answer

Intelicosmos 60 Reputation points

2025-06-30T06:12:06.4033333+00:00

In order to make conversation easier, I have changed the Python code to make it super simple as:

A = ... B = ... C= ... D = ... all_roles = [] all_roles.append("webpubsub.sendToGroup." + A.strip()) all_roles.append("webpubsub.joinLeaveGroup." + B.strip()) all_roles.append("webpubsub.sendToGroup." + B.strip()) all_roles.append("webpubsub.joinLeaveGroup." + C.strip()) all_roles.append("webpubsub.sendToGroup." + C.strip()) all_roles.append("webpubsub.joinLeaveGroup." + D.strip()) all_roles.append("webpubsub.sendToGroup." + D.strip()) wsClient = WebPubSubServiceClient.from_connection_string(connectionstring, hub) token_key = wsClient.get_client_access_token(roles=all_roles, minutes_to_expire=1440)

We do not need to join A group, only sending message to A group is enough in our business.

The call from Postman, shows the the roles name in Python as:
And the Error message from MAUI also shows as:
Note: Due to our client privacy, I can't show the A, B, C and D logic, also I would not be able to make this question accessible to public once problem solved!
Intelicosmos 60 Reputation points

2025-06-30T06:18:59.0633333+00:00

Is there anyway or tool to decompose the access_token and see what groups are included in the token?
Intelicosmos 60 Reputation points

2025-06-30T12:43:38.1333333+00:00

I think with the idea of using https://jwt.ms/ to decode the token, we have found that the token actually had all necessary roles, however before we join a group (D specially), we had to send a message (to A) and inside sending message, the token was overwritten with a new one which didn't include the D role! So, we are accepting that as our code issue and nothing wrong with the token itself!

Without decomposing the token, we couldn't come to this analysis. Thanks for the great support.
Bhargavi Naragani 7,525 Reputation points Microsoft External Staff Moderator

2025-06-30T14:50:38.03+00:00

Hi Intelicosmos, I've converted my comment to answer.

Please accept my answer if it helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Thank you.

Answer 1

Hi Intelicosmos,

From the screenshots you provided, you've done a good job setting up the roles for A, B, C, and D. However, the runtime error in the MAUI client:

“The client does not have permission to join group 'abc'”

indicates that the generated access token did not include the correct joinLeaveGroup.abc permission, even though it seems you intended to include it.

Looking at your variable expansion (all_roles list):

['webpubsub.sendToGroup.',
 'webpubsub.joinLeaveGroup.7',
 'webpubsub.sendToGroup.7',
 'webpubsub.joinLeaveGroup.',
 'webpubsub.sendToGroup.',
 'webpubsub.joinLeaveGroup',
 'webpubsub.sendToGroup.I_']

The correct role webpubsub.joinLeaveGroup.abc is present, but it is at the 6th index of the list, meaning it is very likely that your MAUI app is initialized with an outdated token, the one before this role was added.

Verify Token Contents to ensure the token includes the right group roles, please decode the JWT using Microsoft’s secure tool: https://jwt.ms
- Paste in the token returned by get_client_access_token()
- Look for:
```
     "roles": [
     "webpubsub.joinLeaveGroup.I",
     "webpubsub.sendToGroup.I",
     ...
     ]
```
- If joinLeaveGroup.Iabc is missing, then your MAUI app is running with an old or mismatched token.

Ensure Re-initialization in MAUI App

Confirm that after generating the token in Python, the MAUI app reconnects using the new token by reinitializing the WebPubSubClient. Example:

     _client = new WebPubSubClient(new Uri(newTokenUrl));
     await _client.StartAsync();
     await _client.JoinGroupAsync("I_abc"); // Ensure this group name matches exactly

Share via

WebPubSub client can't join a group but can join other groups of the same access_token

0 additional answers

Your answer