Azure cli authentication with BlobServiceClient

Question

Should it be possible to use cli authentication with Azure storage?

cli_auth = AzureCliAuthentication()
blob_service_client = BlobServiceClient(account_url="https://mystorage.blob.core.windows.net", credential=cli_auth)
container_client = blob_service_client.get_container_client("mycontainer")

blobs=container_client.list_blobs()

for blob in blobs:
    print(blob)

Right now I get:

Exception has occurred: ClientAuthenticationError Server failed to authenticate the request. Please refer to the information in the www-authenticate header. ErrorCode:InvalidAuthenticationInfo authenticationerrordetail:Audience validation failed. Audience did not match.

When run locally, DefaultAzureCredential relies on environment variables named **AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID** https://learn.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate-hosted-applications. **AzureCliCredential** is one of the methods called. Your question does not show what **AzureCliAuthentication** does or what library it comes from. — John Hanley, Feb 15 '22 at 06:48

score 1 · Accepted Answer · answered Feb 15 '22 at 08:48

1

You will have to use AzureCLICredentials instead of using AzureCLIAuthentication.

You can use something like below after doing a az login :

from azure.identity import AzureCliCredential
from azure.storage.blob import BlobServiceClient
cli_auth = AzureCliCredential()
blob_service_client = BlobServiceClient(account_url="https://<Storageaccountname>.blob.core.windows.net", credential=cli_auth)
container_client = blob_service_client.get_container_client("<ContainerName>")

blobs=container_client.list_blobs()

for blob in blobs:
    print(blob.name)

Output:

answered Feb 15 '22 at 08:48

Ansuman Bal

9,705
2
10
27

I can reproduce the error message using AzureCliCredential as well. – John Hanley Feb 15 '22 at 08:52
Same here. I get the error This request is not authorized to perform this operation using this permission. – Mathias Rönnlund Feb 15 '22 at 09:06
3

I was the owner of the subscription but that was not enough. I added myself to the role "Storage Blob Data Contributor" and now it works! – Mathias Rönnlund Feb 15 '22 at 09:25

Azure cli authentication with BlobServiceClient

1 Answers1