0

I'm trying to upload a file to a container in Azure Storage using Azure Active Directory (AAD) Authentication and REST API's. I can't figure out what is missing in the workflow below, but it always fails.

How it works:

  1. A service principal (SP) was created in AAD
  2. A client_secret was generated for this SP
  3. Contributor role added to the Storage Account for the SP, at the Storage Account-level
    • Side question: Can the Storage Blob Data Contributor role be scoped down to the Container-level instead of granting at the Account-level?
  4. Sample authentication request:
    • Method: GET
    • URL: https://login.microsoftonline.com/<my_tenant>/oauth2/v2.0/token
    • Body: x-www-form-urlencoded
      • grant_type: client_credentials
      • client_id: <client_id>
      • scope: https://graph.microsoft.com/.default
      • client_secret: <client_secret>
    • Header(s):
      • content-type: application/x-www-form-urlencoded
  5. Sample auth. response:
    • Status: 200
    • Body:
{
    "token_type": "Bearer",
    "expires_in": 3599,
    "ext_expires_in": 3599,
    "access_token": "<auth_token>"
}
  1. No problem thus far. The <auth_token> from this request is then used to send a PUT request to upload file to Azure Storage Container
  2. Sample upload request:
    • Method: PUT
    • URL: https://<stg-account-name>.blob.core.windows.net/<container-name>/<file-name>.json
    • Body: binary
      • <file-name>.json
    • Header(s):
      • x-ms-blob-type: BlockBlob
      • x-ms-version: 2020-04-08
        • Required for AAD auth (at least per this doc)
      • Authentication: Bearer <auth_token>
  3. Sample upload response:
    • Status: 401
    • Body:
<?xml version="1.0" encoding="utf-8"?>
<Error>
    <Code>InvalidAuthenticationInfo</Code>
    <Message>Server failed to authenticate the request. Please refer to the information in the www-authenticate header.
RequestId:<guid>
Time:2022-09-26T18:29:27.4477615Z</Message>
    <AuthenticationErrorDetail>Signature validation failed. Signature verification failed.</AuthenticationErrorDetail>
</Error>

Tried:

  • Removing the Bearer keyword from the Authentication header
    • Results in Status 403
  • Changing the x-ms-version header from 2017-11-09 to 2020-04-08
    • No change

Questions

  1. What is missing here?
  2. Where is this covered in the documentation?

EDIT1

  1. RE: "What is missing here?"
    • Thank you @gaurav-mantri, your suggested worked!
    • I changed the scope header to https://storage.azure.com/.default in the auth request.
    • The subsequent upload request responded with status 201.
  2. RE: "Can you help me find this referenced in the docs?"
    • Thank you again @gaurav-mantri, here is the doc ref
ericOnline
  • 1,586
  • 1
  • 19
  • 54
  • Did you give `Contributor` access to your SP or `Storage Blob Data Contributor` (in step 2)? – Gaurav Mantri Sep 26 '22 at 18:49
  • 1
    Also try by changing the scope from `https://graph.microsoft.com/.default` to `https://storage.azure.com/.default` in step 3. – Gaurav Mantri Sep 26 '22 at 18:55
  • Yes, `Contributor` access to SP to remove permissions from being an issue while testing. I *want* to grant `Storage Blob Data Contributor` on only the Container ("Side question") – ericOnline Sep 26 '22 at 19:50
  • Regarding #2, please see here: https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory#use-oauth-access-tokens-for-authentication – Gaurav Mantri Sep 27 '22 at 03:17
  • The term `https://storage.azure.com/.default` is not present on the page. Looking for a reference to the `scope` value somewhere in official documentation. – ericOnline Sep 27 '22 at 15:33
  • Sorry, my bad. Please try this: https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet#get-an-access-token-from-azure-ad. – Gaurav Mantri Sep 27 '22 at 15:42
  • Thank you very much! ([REF](https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad-app?tabs=dotnet#azure-storage-resource-id)) – ericOnline Oct 03 '22 at 20:47
  • Hi @ericOnline if you solve your issue kindly post as an answer so that it will be helpful for other members who can encounter the same problem. – Venkatesan Oct 04 '22 at 03:30
  • Please see **EDIT1** in OP. It tells you exactly what I changed in the original request. – ericOnline Oct 05 '22 at 20:38

1 Answers1

1

I tried to reproduce the same in my environment and got the below results:

I created one service principal Test and added Contributor role to it at storage account level as below:

enter image description here

I generated the access token with same parameters as you like below:

enter image description here

When I use the above access token to upload file via PUT request, I am getting same error as you like this:

enter image description here

To resolve the error, you need to add Storage Blob Data Contributor role to your service principal at Azure Storage container level as below:

enter image description here

Now, I generated access token by changing scope to https://storage.azure.com/.default like this:

enter image description here

With this token, I am able to upload file to Azure Storage container successfully as below:

enter image description here

When I checked Azure Portal, file got uploaded successfully like this:

enter image description here

If you generated the token by changing the scope to https://storage.azure.com/.default and did not assign Storage Blob Data Contributor role, you will get 403 error like below:

enter image description here

So, make sure to grant Storage Blob Data Contributor role to service principal before generating access token.

Sridevi
  • 10,599
  • 1
  • 4
  • 17
  • The Service Principal had `Contributor` access on the Storage Account (step 2 in OP). The answer was the `scope` header on the auth request. Once I changed that, the upload request worked. – ericOnline Sep 26 '22 at 20:40