Azure blob client fails with authz error while same operation is allowed via CLI

[inc0]

• Package Name: azure-storage-blob
• Package Version: 12.5.0
• Operating System: MacOS
• Python Version: 3.8

Describe the bug
This command:
az storage blob list --container-name mycontainername --account-name myaccount works and returns list of blobs
in python:
ContainerClient(account_url="myaccount.blob.core.windows.net", container_name="mycontainername", credential=AzureCliCredential()).list_blobs()

Throws:

HttpResponseError: This request is not authorized to perform this operation using this permission.
RequestId:4d936591-701e-0031-078a-8c01ed000000
Time:2020-09-17T00:34:09.6826796Z
ErrorCode:AuthorizationPermissionMismatch
Error:None

Expected behavior
Either python returning correct response or useful error message to pinpoint what's wrong.

[inc0]

from the CLI debug logs
https://myaccount.blob.core.windows.net:443 "GET /mycontainername?restype=container&comp=list&maxresults=5000 works and returns 200

[inc0]

I should add that trying to list blobs or access blobs via UI works well too. Listing containers via python sdk like

bc = BlobServiceClient("mycontainername.blob.core.windows.net", credential=AzureCliCredential())

works well too

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

[inc0]

Additional debug: It seems that CLI does request to /subscriptions/<my sub id>/resourceGroups/<res group>/providers/Microsoft.Storage/storageAccounts/<my account>/listKeys - I assume it tries to authenticate with accessKey rather than creds, which would be different to what python is doing. When I go to UI I also see that UI uses accessKey.

Is there way to programmatically pull these access keys with python and then use it for authentication? I did try to use this snippet https://github.com/Azure/azure-sdk-for-python/blob/master/sdk/storage/azure-storage-blob/samples/blob_samples_authentication.py#L115 and paste in key manually, but it didn't seem to help.

[inc0]

After looking here we've added missing permission and it worked. I think CLI uses access keys under the hood. It may be good idea to document how to pull access keys and use them in python sdk too. I'll close this issue for now

[tasherif-msft]

Hi @inc0,
I was trying to repro this issue on my end. Using credential=AzureCliCredential() works fine as a credential when trying to list blobs in a container in the Python SDK. However, I was going to suggest ensuring that your account was listed as a Storage Blob Data Owner as it appears to be a common issue when this is not set.

It's good to note that the Python SDK also supports passing a DefaultAzureCredential etc. good reference: https://docs.microsoft.com/en-us/python/api/overview/azure/identity-readme?view=azure-python#authenticating-with-defaultazurecredential

This link provides very good documentation on the Azure Identity CLI for Python and the different types of credentials that can be used.

Let me know if anything else comes up! Have a great one.

[inc0]

Default credential didn't work as well. My suspicion is that CLI pulls access key under the hood and uses it, which makes it work without data owner permissions. If we provide docs with python snippet to pull access key and use it instead of credentials, I think that'd be useful.