AuthorizationFailure error while using DefaultAzureCredential authorization for Azure Storage Blob for creating new blob

[prashanthmadduri]

• Package Name: @azure/storage-blob, @azure/identity
• Package Version: 12.3.0, 1.2.0
• Operating system: Windows 10
• nodejs
  • version: v10.16.3
• browser
  • name/version:
• typescript
  • version: 1.5.3
• Is the bug related to documentation in
  • README.md
  • source code documentation
  • SDK API docs on https://docs.microsoft.com

Describe the bug

• As per the example provided here https://github.com/Azure/azure-sdk-for-js/blob/master/sdk/storage/storage-blob/samples/javascript/azureAdAuth.js. The Azure AD authentication should work but it is failing with AuthorizationFailure error.

• We have register the application and provided access to https://storage.azure.com/user_impersonation and also enabled Access tokens, ID tokens for Implicit grant and hybrid flows. Also, assigned the Storage Blob Data Owner role to the user using. We could able create blob using InteractiveBrowserCredential with same application registration values.

To Reproduce
Steps to reproduce the behavior:

1. Created application registration with https://storage.azure.com/user_impersonation access.
2. Provided Storage Blob Data Owner role to user.
3. Tried accessing Storage Blob using Azure AD using @azure/identity but failing as explained above.

Expected behavior
A clear and concise description of what you expected to happen.
Expecting the Storage Blob accessing using Azure AD using @azure/identity as provided sample here https://github.com/Azure/azure-sdk-for-js/blob/master/sdk/storage/storage-blob/samples/javascript/azureAdAuth.js using AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET values.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.

[jeremymeng]

@prashanthmadduri does Storage Blob Data Contributor role work? It feels that Owner role should have all of and more permissions than Contributor but worth a quick try.

[prashanthmadduri]

@jeremymeng We have added below attached three roles at storage account level Owner, Storage Blob Data Owner and Storage Blob Data Contributor as attached screenshot but still we have same issue.

[ljian3377]

Please double check you have followed the doc. https://github.com/Azure/azure-sdk-for-js/tree/master/sdk/storage/storage-blob#with-defaultazurecredential-from-azureidentity-package

• register your app in AAD, create a client secret
• in storage side, assign a role to that app
• set AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET as environment variables

[ljian3377]

If it still doesn't work, please provide more details, for example, the failed request id, so we can take look at the log.

[prashanthmadduri]

@ljian3377

We have followed the steps mentioned above. Please find the request id for the same.

RestError: This request is not authorized to perform this operation.
RequestId:75f25569-001e-001c-089d-e5fe5d000000
Time:2021-01-08T09:03:03.2092431Z 

[ljian3377]

RBAC Authorization Failed : Control Action permission Microsoft.Storage/storageAccounts/blobServices/containers/write not present.

testpsl does not have Write access to resource /testpsl/newcontainer1610096581184/

Storage Blob Data Owner is enough.
One thing that looks weird to me is that the types of the roles in the screenshot are "User" instead of "App".
Select the AAD app rather than your storage account when adding role assignment.

[prashanthmadduri]

@ljian3377 Thank you for your inputs. It started working as expected after giving Storage Blob Data Contributor role to registered App instead account user as shown in attached screenshot.

[ljian3377]

Good to know. Will close the issue now. You can re-open it if anything is needed from us for this. Thanks.