Azure / Azure/azure-functions-host

Azure Functions failed to get permission for managed identity authentication for azure storage queue and azure storage blob via DefaultCredential

Open
#9,652 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

#### Check for a solution in the Azure portal
Managed identity in azure function is not working for blob and queue

I have created azure function (in process with C# code) given all the permission to the storage account.
This function uses managed identity to connect to azure storage. Note, here queue trigger is working but I am talking about in c# code we are connecting Queue and blobs for data processing which is failing. (Not talking about queue or blob trigger extension)
Trying to connect via managed identity using below libraries
using Azure.Storage.Blobs;
using Azure.Storage.Queues;

![image](https://github.com/Azure/azure-functions-host/assets/126070530/11ab8cab-5561-461d-b29b-3c2c97566194)

Also created the required environment variable still facing below error for:

Storage blob:

Azure.RequestFailedException at Azure.Storage.Blobs.BlobRestClient+d__38.MoveNext

Azure.Storage.Blobs, Version=12.13.0.0, Culture=neutral, PublicKeyToken=92742159e12e44c8

This request is denied to perform this operation using this permission.
RequestId:313e9365-101e-0055-6b84-0cf075000000
Time:2023-11-01T05:31:49.4966383Z
Status: 403 (This request is denied to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionDenied

Content:
AuthorizationPermissionDeniedThis request is denied to perform this operation using this permission.
RequestId:313e9365-101e-0055-6b84-0cf075000000
Time:2023-11-01T05:31:49.4966383Z

Headers:
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 313e9365-101e-0055-6b84-0cf075000000
x-ms-client-request-id: 79eaa29e-88fb-4766-baab-d1c75c4f7173
x-ms-version: 2021-08-06
x-ms-error-code: AuthorizationPermissionDenied
Date: Wed, 01 Nov 2023 05:31:48 GMT
Content-Length: 269
Content-Type: application/xml

Storage queue

Azure.RequestFailedException at Azure.Storage.Queues.MessagesRestClient+d__8.MoveNext

Azure.Storage.Queues, Version=12.15.0.0, Culture=neutral, PublicKeyToken=92742159e12e44c8

This request is denied to perform this operation using this permission.
RequestId:2ef07aba-a003-0050-0284-0c22ae000000
Time:2023-11-01T05:31:49.9021280Z
Status: 403 (This request is denied to perform this operation using this permission.)
ErrorCode: AuthorizationPermissionDenied

Content:
AuthorizationPermissionDeniedThis request is denied to perform this operation using this permission.
RequestId:2ef07aba-a003-0050-0284-0c22ae000000
Time:2023-11-01T05:31:49.9021280Z

Headers:
Server: Windows-Azure-Queue/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 2ef07aba-a003-0050-0284-0c22ae000000
x-ms-version: 2018-11-09
x-ms-error-code: AuthorizationPermissionDenied
Date: Wed, 01 Nov 2023 05:31:48 GMT
Content-Length: 269
Content-Type: application/xml

![image](https://github.com/Azure/azure-functions-host/assets/126070530/b41f46b5-d551-4a1e-bcd3-ed0312e20901)

![image](https://github.com/Azure/azure-functions-host/assets/126070530/f4b377be-e74c-4548-8fbb-c5f00e27b1fb)

#### Investigative information

Please provide the following:

- Timestamp:
- Function App version: 4
- Function App name: mctstagingphone-tfa-mk3lu2p5pzq4o
- Function name(s) (as appropriate): mctstagingphone-tfa-mk3lu2p5pzq4o
- Invocation ID:
- Region:

#### Repro steps
Create a function app using managed identity library.
using Azure.Storage.Blobs;
using Azure.Storage.Queues;

and trying to access the storage queue and blob using DefaultCredential is not working
![image](https://github.com/Azure/azure-functions-host/assets/126070530/8d9cffd9-0304-4ecc-9368-4cd9ca8df4ac)

There function are queue and timer trigger functions for which I have added a separate extension and tested that extension and its working fine via queue trigger
PackageReference Include="Microsoft.Azure.WebJobs.Extensions.Storage.Queues" Version="5.1.3"

C# code is unable to get token using azure.Storage.Blobs and Azure.Storage.Queue which is the requirement to process the data as during processing we need to connect to queue and blob multiple times.

#### Expected behavior
Code should work and fetched the token using DefaultCredential as similar code is working for app service without specifying the storage connection string.
I have specify all the env variables
![image](https://github.com/Azure/azure-functions-host/assets/126070530/6d81c5aa-5a4c-4c62-aa1d-5814733f51f6)

#### Actual behavior
Function app unable to start and giving error due to failure in fetching token for queue and blob.

Contributor guide

Open the contributing guide

Research direction

No repository files or tests are identified. Start by reviewing the Azure Functions v4 managed identity configuration, the DefaultCredential usage with Azure.Storage.Blobs and Azure.Storage.Queues, and the listed environment variables and role permissions; done means the function can access both blob and queue operations without the 403 errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.