[Hub] Managed Challenge Consumer on principal no longer working in 7.2.0

[HolySephi]

The new update disables any possibility to use managed challenges with or without tag scope - the client always says he has no right to use managed challenges - hubservice-log:

2026-08-27 16:56:41.762 +02:00 [WRN] Certify.Server.Hub.Api.Services.ManagedChallengeScopeService Managed challenge access denied for principal 69ed00a2-a6bb-4720-87d8-cdaa494bfea2: no authorizing role grants 7dc15feb-0014-4ee6-baa6-809a59038537 (scoped assigned roles: (none))
2026-08-27 16:56:41.762 +02:00 [WRN] Certify.Server.Hub.Api.Controllers.ManagedChallengeController ValidateManagedInstanceChallengeAccessAsync found no accessible managed challenge for managed instance 85e6bf51-c9fe-4ad0-a0a3-323c086a70d3 / security principal 69ed00a2-a6bb-4720-87d8-cdaa494bfea2: Security principal is not authorised to use managed challenges
2026-08-27 16:56:41.762 +02:00 [WRN] Certify.Server.Hub.Api.Controllers.ManagedChallengeController AuthorizeManagedChallengeActionAsync managed-instance authorization failed for action managedchallenge_cleanup_action, managed cert , identifier owa.domain.tld, challenge type dns-01: Managed instance is not permitted to access a matching managed challenge for this request.
2026-08-27 16:56:41.763 +02:00 [WRN] Certify.Server.Hub.Api.Controllers.ManagedChallengeController AuthorizeManagedChallengeActionAsync denied by managed-instance authorization for action managedchallenge_cleanup_action, managed cert , identifier owa.domain.tld, challenge type dns-01: Managed instance is not permitted to access a matching managed challenge for this request.

i think there is a bug in roles for security principals - working permission settings from 7.1.1 are no longer working right now (managed challenge with tag, managed challenge consumer with tag scope filter)

I found the new setting for the hub to enable untagged challenges for tag settings but enabling/disabling that has no effect.

[HolySephi]

just to make it clear - despite the log saying the principal has no roles - it has the Managed Challenge Consumer role and the log always states none with or without scoped tags. The blue "eye"-Symbol correctly shows the managed challenge it should have access to but hasnt

[webprofusion-chrisc]

Hi, sorry missed this - it's best to contact support when stuff breaks as GitHub notifications can be pretty noisy and they often get lost. Will investigate and update here.

[HolySephi]

No worries - it seems it is working on a fresh install - but not after upgrading from the previous version (which also was upgraded from beta/7.0)

[webprofusion-chrisc]

With your fresh install I presume you are assigning the role to the managed instance under Security, rather than using a managed challenge API credential, is your older install perhaps configured to use a specific API credential (via an API token - Security > API Access)? Or is it only using managed instance identify as well.

The bit we can't work out yet is no authorizing role grants 7dc15feb-0014-4ee6-baa6-809a59038537 whereas a normal managed challenge would use a preset actionid instead of that GUID.

[HolySephi]

I never used API credentials - always Managed Identity permissions under Security. And the permission is present there and correctly shown via the blue "eye" symbol - it correctly filters to just show the one Managed Challenge the Principal has access to - but in the log it states as "no authorizing role grants" and the principal is unable to use the Managed Challenge

[HolySephi]

P.S. downgrading to 7.1 instantly fixed the problem and the Challenge was correctly seen again without any configuration changes

[webprofusion-chrisc]

@HolySephi thanks, found the problem - it's an incomplete upgrade of standard role permissions because the roles already exist and our API actions now require more fine-grained permissions. We're tidying up the fix for this and will plan to get an update out shortly.

[HolySephi]

Can confirm - upgrading to 7.2.1.0 does not have this problem and agents are correctly permitted to use the managed challenges. Thanks!