Azure-Samples / Azure-Samples/azure-files-samples

Debug-AzStorageAccountAuth has a case-sensitivity mismatch for default CIFS SPN on Entra Object Check

Open
#302 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
261
Forks
202
Avg merge
1d 5h
Merged PRs (30d)
4

Description

By default, the SPNs that get automatically added on the Entra ID app registration for the storage account when you enable Entra ID Kerberos authentication are as follows:

"api://redacted-identifier/host/storage-account-name.file.core.windows.net",
"api://redacted-identifier/cifs/storage-account-name.file.core.windows.net",
"api://redacted-identifier/http/storage-account-name.file.core.windows.net",
"host/storage-account-name.file.core.windows.net",
"cifs/storage-account-name.file.core.windows.net",
"http/storage-account-name.file.core.windows.net"

It appears that Debug-AzStorageAccountAuth treats this value as case-sensitive and it expects "cifs" to be upper case.

It will fail the check with:

Checking Entra Object
(✕) Failed
ERROR: SPN Value is not set correctly, It should be 'CIFS/storage-account-name.file.core.windows.net'

Even though it does exist as "cifs/storage-account-name.file.core.windows.net"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.