Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Azure Blob Storage "Authorization Permission Mismatch" error for get request with AD token

I am building an Angular 6 application that will be able to make CRUD operation on Azure Blob Storage. I'm however using postman to test requests before implementing them inside the app and copy-pasting the token that I get from Angular for that resource.

When trying to read a file that I have inside the storage for test purposes, I'm getting: <Code>AuthorizationPermissionMismatch</Code> <Message>This request is not authorized to perform this operation using this permission.

  • All in production environment (although developing)
  • Token acquired specifically for storage resource via Oauth
  • Postman has the token strategy as "bearer "
  • Application has "Azure Storage" delegated permissions granted.
  • Both the app and the account I'm acquiring the token are added as "owners" in azure access control IAM
  • My IP is added to CORS settings on the blob storage.
  • StorageV2 (general purpose v2) - Standard - Hot
  • x-ms-version header used is: 2018-03-28 because that's the latest I could find and I just created the storage account.
like image 635
SebastianG Avatar asked Oct 11 '18 22:10

SebastianG


People also ask

How do I give access to Blob storage Azure?

To allow or disallow public access for a storage account in the Azure portal, follow these steps: Navigate to your storage account in the Azure portal. Locate the Configuration setting under Settings. Set Blob public access to Enabled or Disabled.

Is request is not authorized to perform this operation using this permission?

To resolve this issue, you need to verify the access permissions for the ADF and user type: Note: Storage Blob Data Contributor : Use to grant read/write/delete permissions to Blob storage resources. ADF permissions: Kindly check the permissions on the Storage account. Check the user permission on the storage account.

How do I access my blob storage with access key?

In the Azure portal, go to your storage account. Under Security + networking, select Access keys. Your account access keys appear, as well as the complete connection string for each key. Select Show keys to show your access keys and connection strings and to enable buttons to copy the values.


1 Answers

I found it's not enough for the app and account to be added as owners. I would go into your storage account > IAM > Add role assignment, and add the special permissions for this type of request:

  • Storage Blob Data Contributor
  • Storage Queue Data Contributor
like image 191
jager1000 Avatar answered Sep 21 '22 01:09

jager1000