Downloading Azure Stroage data using Azure AD in Python

Question

I am trying to download data in Azure Storage container using Python. Using account keys is not an option, so I am trying to use Azure AD but have not been able to make it work so far. I am primarily using the doc here for reference: https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-directory-file-acl-python.

Code to connect using Azure AD:

def initialize_storage_account_ad(storage_account_name, client_id, client_secret, tenant_id):
    
    try:  
        global service_client

        credential = ClientSecretCredential(tenant_id, client_id, client_secret)

        service_client = DataLakeServiceClient(account_url="{}://{}.dfs.core.windows.net".format(
            "https", storage_account_name), credential=credential)
    
    except Exception as e:
        print(e)

Code to download data:

def download_file_from_directory():
    try:
        file_system_client = service_client.get_file_system_client(file_system="my-file-system")

        directory_client = file_system_client.get_directory_client("my-directory")
        
        local_file = open("C:\\file-to-download.txt",'wb')

        file_client = directory_client.get_file_client("uploaded-file.txt")

        download = file_client.download_file()

        downloaded_bytes = download.readall()

        local_file.write(downloaded_bytes)

        local_file.close()

    except Exception as e:
     print(e)

Now I know that I have the download set up correctly, because I am able to get the data when I use account key. But somehow, no success with using Azure AD to connect. I started with registering an app, finding tenant id/client id/client secret. I have also granted the registered app the permissions to Azure Storage and enabled implicit grant flow (ID tokens). Am I still missing anything? Any help is appreciated.

You will also need a storage blob data reader role via the RBAC settings on the storage account. Set this role against your Service principal and give it some 5 mins to propagate. And then try again. — Anupam Chand, Sep 02 '21 at 14:05

score 0 · Answer 1 · answered Sep 06 '21 at 07:53

If you're using Azure Active Directory (Azure AD) to authorize access, then make sure that you assigned the Storage Blob Data Owner role . And Grant access to Azure Blob data with RBAC in the Azure Portal

You'll have to assign one of the following Azure role-based access control (Azure RBAC) roles to your security principal.

Storage Blob Data Owner: All directories and files in the account.

Storage Blob Data Contributor: Only directories and files owned by the security principal.

For more details refer this document

Downloading Azure Stroage data using Azure AD in Python

1 Answers1