Join site hub - Bad Gateway 502

[ThomasDK]

I have created the following flow. Does anybody know why I get this "Bad Gateway 502" error? I have tried to remove the Sharepoint connection for the flow and log back in, but I still get the same error.

Raw output:

{

    "statusCode": 502,

    "headers": {

        "Pragma": "no-cache",

        "x-ms-request-id": "9e21f69f-604e-c000-762a-a2cebe7d5da2",

        "Strict-Transport-Security": "max-age=31536000; includeSubDomains",

        "X-Content-Type-Options": "nosniff",

        "X-Frame-Options": "DENY",

        "Cache-Control": "no-store, no-cache",

        "Set-Cookie": "ARRAffinity=7fec6b3d494d502cd339a098a470860ddaf458b68c32b8ce8e190c362de93b94;Path=/;HttpOnly;Secure;Domain=sharepointonline-ne.azconn-ne.p.azurewebsites.net,ARRAffinitySameSite=7fec6b3d494d502cd339a098a470860ddaf458b68c32b8ce8e190c362de93b94;Path=/;HttpOnly;SameSite=None;Secure;Domain=sharepointonline-ne.azconn-ne.p.azurewebsites.net",

        "Timing-Allow-Origin": "*",

        "x-ms-apihub-cached-response": "true",

        "Date": "Tue, 05 Oct 2021 10:08:27 GMT",

        "Content-Length": "591",

        "Content-Type": "application/json",

        "Expires": "-1"

    },

    "body": {

        "error": {

            "code": 502,

            "source": "flow-apim-europe-001-westeurope-01.azure-apim.net",

            "clientRequestId": "252902f8-e6b9-464f-a6f5-de0020b42229",

            "message": "BadGateway",

            "innerError": {

                "status": 502,

                "message": "Hub site not found\r\nclientRequestId: 252902f8-e6b9-464f-a6f5-de0020b42229\r\nserviceRequestId: 9e21f69f-604e-c000-762a-a2cebe7d5da2",

                "source": "https://domain.sharepoint.com/sites/nt32/_api/site/JoinHubSite",

                "errors": [

                    "-2147213254",

                    "Microsoft.SharePoint.SPException"

                ]

            }

        }

    }

}

[Expiscornovus]

Hi @ThomasDK,

You are associating one site collection with another (hub) site collection. So, I would expect you to use the GUIDs of the site collections and not from the Root webs of both site collections.

Can you change the Uri of the two Send an HTTP requests from _api/web to _api/site

[ThomasDK]

Hi @Expiscornovus ,

Changing from "_api/web" to "_api/site" seems to yield the same result.

I'm not sure if I understand you correctly, but in my "Join hub site" step I use the site address because it expects me to. I once tried with the GUID, but it told me to use the site address.

In the meantime I have created a new hub site based om a Communication site, as this is more simple because it is not based om a O365 group. I have made the delegated Oauth user and the user handling the connection in the steps SiteCollection Admin. Also, I have stated that these two users are the users who can approve Hub Site join requests. So, I should think that the permissions should be OK. But, I'm getting an error saying: "Attempted to perform an unauthorized operation.". I have seen this before and as I recollect I solved it by adding the connections to the created SP sites.

I have looked into the BadGateway500 (%02) error and there are myriads of reasons why this can be occur. Eg. it can be a person field that has been changed to accept multiple persons. My guess is that I have some client side misconfiguration.. because I really don't think it is an Azure network/DNS problem of som sort.

I hope you can help as I'm out of good ideas 🙂

[Expiscornovus]

Hi @ThomasDK,

Apologies if I wasn't clear. I was not talking about the Request Site Address value, the site which we want to join to the hub.

I was talking about the hub itself, and the Hub Site Id value. The error says it cannot find your hub.

I can reproduce the Hub Site not found error when using that _api/web method for retrieving the Hub Site Id value.

Below are a couple of screenshots to show you.

Let's assume in this example that my Hub site has a GUID which is 9a356380-ce9a-4be5-aa85-ba239d9fec6a. 

1. In my test the _api/web gives me a different GUID.

2. That results in a HTTP 502 Bad Gateway Hub site not found error (as in your opening post).

3. When I use the _api/site I get the correct GUID which I can set to the variable.

Hopefully this helps a bit?

[rjack]

Out of curiosity, you are not sending to anyone for approval to join the site, why dont you disable approve option and simple use join hub site action? this is not causing your 502 error but just saying. 

have you tried hardcoding the hub site ID like below? if you have only one hub site and you dont need to dynamically fetch the site ID, i suggest hardcode it unless there's some other issue. 

[ThomasDK]

Hi @Expiscornovus,

Thank you very much for the clarification. It is quite strange that "web" fails and "Site" works, as the output looks similar. I will keep the Hub GUID in a variable and use "Site" 🙂

[Expiscornovus]

Hi @ThomasDK,

Great to hear it works.

Site, site collection, web, root web. Don't get me started on the subject of the different objects in SharePoint. Even after explaining the SharePoint architecture to customers in the last 15 years I still understand it is kind of confusing 😁

[ThomasDK]

Hi @rjack 

This is the third time I start a reply to you in this thread. The last two times I thought I'd try something out and then it logs out and I loose my reply. Third time must be the charm 🙂

I really don't want the approval flow, as it is not necessary in my flow. I tried to build my flow without it previously but did not succeed. I have now tried again. This following shows the setup and the result. Please help me find out what I'm not doing right. I get this error:

The Hub site, where the approval is not required:

A communication site with these settings:

The flow step:

Now, the error suggests that the problem is permissions. I have these permisssions on the Hub Site:

Connection user = the user logged in to Sharepoint in the flow step.

The only thing I can think of is the Sharepoint site, that is created together with my team, which I want to join to the Hub Site, could be the problem. The user that created the Team, is the same user 'manageing' the connection to Sharepoint and I guess that this user must have rights on the Sharepoint site. BUT.. when I look at the Sharepoint site, which I want to join, I don't see that this user has any rights when I look at advanced rights management. Nothing in the groups or otherwise.

[rjack]

Hi @ThomasDK 

Sorry i couldn't understand the language in one of the screenshot but i assume it is not hub site approval work flow setting. in the below article, search for 'Manage site association approval flows' title and follow the article to turn off the work flow process. i believe this is why you need an approval process.

Set up your SharePoint hub site (microsoft.com)

[ThomasDK]

I can see how this part of my explanation can be confusing, although I try to be explicit 🙂 What I mean is that I turn off the approval requirement:

BR,

Thomas

[rjack]

ha! now i understand. lol! when i saw the green arrow in the screenshot, I was expecting an annotation on the image. my bad! 

since you have turned off the approval for the site, you need to remove the actions that are used for approval. this is based on assumption from your Wednesday message which contains at least one of the action that are in the below image.

[ThomasDK]

Hi @rjack 

The only step I have configured is:

BR,

Thomas

[rjack]

Interesting! could you please create a test flow like below and see if you are having the same error? I just ran the test with 2 steps like in the screenshot and works. if this fails I suggest you to log a call with MS. 

Might be a stupid question: is there any space before and after your dynamic site URL section? not sure if thats an issue.

[ThomasDK]

Hi @rjack 

OK, so triggering the exact same flow suceeds 😊 I don't get the error, which I get when the flow is triggered by the creation of a row in a Sharepoint list. I guess I don't get the error because I trigger it as an authorized user (I can see the connection was established just before I executed the manually triggered flow for the first time). I guess I get the error  with the SP triggered flow is because a token is needed?? Unfortunately there is no header attributes in the "Join hub" step, so I can't authorize in the same way I do eg. with "Send an HTTP request to Sharepoint". 

Do you have any suggestions in this regard?

Answer to your Question: No there is no space before or after the site ref. I just tried writing the site path without using the dynamic URL. Same result.

[rjack]

could you please share your flow screenshot and i'll try recreating it and see what happens. also, if you could expand to show details, that will be great!

[ThomasDK]

Hi @rjack 

Yes, sure. Allthough my flow is quite long. Which parts are you interested in?

Here is the "Join Hub" part:

As you can see here, my flow is quite long. It first gets a OAuth token, then checks if the team should be private, then creates the team, then waits for it to finish provisioning, then updates Team name and Icon, then Creates a Sharepoint library and some other stuff, then adds a tab to a channel (this fails too), then adds members and owners, then joins the Sharepoint site to a Hub Site (which fails).

[rjack]

That is indeed a long flow. I thought my flow was long. Thanks for the information. I read through your whole post again and I'm not sure why you're getting 403 error. below is/are somethings to check, may not help if you are using your or service account to create new teams.

check the owner of the site that gets created by the teams. is the owner of the new site authorized to join that site to the hub site? if no, add that user to the authorization list in SP admin center or make that account owner of the hub site.

using powershell doublecheck if your hub site ID is correct. Get-SPOHubSite. this will list all hubsite you have in your tenant once connected to the tenant. if the ID provided is different from what you are using then use the one which you got from powershell. Get started with the SharePoint Online Management Shell | Microsoft Docs

could you please expand Get hub ID and join hub site 2 connectors under condition "yes" and send the screenshot? 

[ThomasDK]

Hi @rjack 

I have now double checked the GUID of the HubSite with PowerShell and it is the same. I usually get it by writing "/_api/site" after the site URL and search for ID.

I don't use the steps under condition "yes", as it belongs to private Teams and I have not finished that part yet. But here are the screenshots:

What I use is one of these two approches (preferably Option1):

BR,

Thomas

[rjack]

you were talking about token earlier. do you have 'approval token' added under advanced option of join hub site 3?

what happens when you try adding the site to hub site from the new site's settings  --> site information --> hub site association? Note: login as the connection user of 'join hub site 3' connector. 

(just thinking out loud - lol) above suggestions doesn't make sense since triggering the same flow is succeeding unless there's a branch and an action in that branch that simultaneously gets completed while join hub site 3 is failing? but i see only sequential steps not parallel. hmm.

i'm not an expert so all i can think is one of the below that causes the issue.

1. the delay is placed in a wrong location or

2. the delay time is not enough for the site to be fully provisioned.

3. the account that is used to create the team doesn't have privileges to join to the hub site. check the 'create a team' action's connector account and change to hub site owner or service account. this may not be an issue but putting it out there. 

4. since resubmitting an failed flow succeeds, IMO, there is an action where the hub site owners/service account  are provided permission to the new site few milli sec before the join hub 3 fails. 

hope this helps!?

here's a screenshot of the first few steps of my flow. to be on safe side, i have set the delay to 5 min before i start getting the SP groups and adding 0365 group members to SP groups and create 1000s of folders with unique permissions etc. 

Another test: trigger the flow using the actual trigger, don't resubmit, and create a new team. let the flow fail. visit the site and check the permissions on the new site and see if connection user has access to the new site. maybe login as the connection user itself. in my case, i would use service.admin account to login and see if i can join to hub site. but, like i was thinking out loud, if there's a action that gives permission to the service account just before (few millisecond) the flow failed, you will be able to join just how resubmitting a failed flow succeeds.   

BTW, I'm happy to help over a teams meeting if you would like. let me know with your time zone. i'm in PST. I'm not sure if we can send direct messages in here. but i think i can see your email address somewhere in the screenshot. 

[ThomasDK]

Hi @rjack 

It would be nice to have an extra set of eyes om this, as I'm pretty close to giving up on this. Also, I have another issue that I would love to show you. I'm om GMT+1 which means that we are 9 hours apart. If possible maby we could start at 08 PST on tuesday the 2'nd of November? It'll be 17:00 here in Denmark and maby there will be enough time before the misses have dinner ready 🙂

Let me answer your questions in your post also:

"you were talking about token earlier. do you have 'approval token' added under advanced option of join hub site 3?"

Nope:

"what happens when you try adding the site to hub site from the new site's settings  --> site information --> hub site association? Note: login as the connection user of 'join hub site 3' connector. "

It gets added to the hubsite

"(just thinking out loud - lol) above suggestions doesn't make sense since triggering the same flow is succeeding unless there's a branch and an action in that branch that simultaneously gets completed while join hub site 3 is failing? but i see only sequential steps not parallel. hmm."

Nope, no parallel steps. 

"I'm not an expert so all i can think is one of the below that causes the issue.

1. the delay is placed in a wrong location or"

The delay is placed before the HTTP step in which I create the tab in the channel

"2. the delay time is not enough for the site to be fully provisioned."

I have tried with 10 and 9 minutes, but this times out?? When I try with 8 or less minutes I still get the error (I can see the channel is created way before the Delay times out).

"3. the account that is used to create the team doesn't have privileges to join to the hub site. check the 'create a team' action's connector account and change to hub site owner or service account. this may not be an issue but putting it out there. "

I have checked (in the Sharepoint admin settings) who is allowed and my main flow user (which I use for everything) is allowed.

"4. since resubmitting an failed flow succeeds, IMO, there is an action where the hub site owners/service account  are provided permission to the new site few milli sec before the join hub 3 fails."

.....................................................................................WWWTTTFF..  as I'm replying to your post, I have tried to create my OAuth Token with the same user as the one I use for connections. Now I can add site to hubsite! I'm glad but I don't get it.. My user who joins were in the owner group of the Team under which my sharepoint site (which I want to join to hubsite) resides, so the rights sould be OK, right?!?!

OK, @rjack ... if you stille have the time I wiuld love to show you the last obstacle before I can deliver my first (big) flow to the customer. I have described it here:

Re: Channel ID/GUID is identical, but the error sa... - Power Platform Community (microsoft.com)

Cheers,

Thomas

"Another test: trigger the flow using the actual trigger......................"

My settings looks the same as yours, but just with another user.

hope this helps!?"