Volodymyr Litovka's questions

I'm trying to get read access to Azure Log Analytics from my app and did the following steps:

1. Registered App under the “App registrations” in AD portal
2. Added platform: Web; redirect URI: http://localhost/auth under the Authentication tab
3. Requested and granted to this App API permissions to read Log Analytics Data: Log Analytics API : Data read : Type Application : Status Granted

and then, using this code, trying to read:

SECRET="XXXXXXXXXXX"
CLIENT="e7207353-ee8d-4bcc-9580-bfaaf2c0da7e"
URI="http://localhost/auth"
RESOURCE="management.azure.com"
TARGET="https://$RESOURCE/subscriptions/XXXXXXX/resourceGroups/myRG01/providers/Microsoft.OperationalInsights/workspaces/law-01/api/query?api-version=1"

# (1) Obtain token
RESP=$(curl --silent -H "Content-Type: application/x-www-form-urlencoded" -X POST \
            -d "grant_type=client_credentials&client_id=${CLIENT}&resource=https://${RESOURCE}&client_secret=${SECRET}&redirect_uri=${URI}" \
         https://login.microsoftonline.com/...orgTenantID.../oauth2/token )

TOKEN=$(echo "$RESP" | jq -r .access_token)

# (2) Call Log Analytics API
curl --silent -X POST \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   -d '{"query": "AzureActivity | limit 10"}' $TARGET | jq

but while successfully obtaining token, getting ‘AuthorizationFailed’ when calling Log Analytics:

{
  "error": {
    "code": "AuthorizationFailed",
    "message": "The client '02531282-409c-4752-8b10-4f995ceaac5d' with object id '02531282-409c-4752-8b10-4f995ceaac5d' does not have authorization to perform action 'microsoft.operationalinsights/workspaces/query/read' over scope '/subscriptions/XXXXXXX/resourceGroups/myRG01/providers/Microsoft.OperationalInsights/workspaces/law-01/api/query' or the scope is invalid. If access was recently granted, please refresh your credentials."
  }
}

Where I can be wrong? Access was granted few days ago, so any delays in propagation, hopefully, passed. Anyway, what 'refresh your credentials' can mean for this case? Anything else?

Appreciate your help. Thank you.

=== Post answer update === Use the API to access loganalytics data as described here - https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/request-format so vars for the code above should be:

RESOURCE="api.loganalytics.io"
TARGET="https://$RESOURCE/v1/workspaces/...LAW_ID.../query"

For some private purposes I need to enrich HTTP header with additional information (which will be handled by app on the HTTP server side). The basic idea was to modify received packet, send it to destination and never care about answer. The very simplified scheme of traffic paths is

+---+       +------+        +---+
|   +<<-----o MDFY +<<------o   |
| R |       +------+        | S |
| C |                       | N |
| V |                       | D |
|   o--------------------->>+   |
+---+                       +---+

The issue comes with TCP SEQ/ACK numbers. After TCP handshake, Sender send packet of 4 bytes length, which come to Modifier where length change to 22, then packet arrive Receiver and it sends ACK number +23, while Sender expects for +5. This blows Sender's mind and session becomes unsynced. I see this when, for example, try netcat for testing - for unmodified packets, session closes immediately after data exchange, while for modified packets session stales for a long time (actually, I stop it by pressing Ctrl-C).

I don't see an easy way to deal with this situation. Looks as once modified in-the-middle, entire session must be handled by Modifier because Sender knows nothing about Sequence number's modification and will rely on his own numbers. Doing this will significantly both impact performance and increase complexity, since I need to maintain state of every session and modify every packet coming from both sides to maintain SEQ/ACK numbers.

May be I don't see another way except writing own DPI? :-) Any knowledge, ideas and suggestions are appreciated.

Thank you.