azureazure-active-directorypostmanazure-storageazure-rbac

Azure Rest API using Postman

I'm trying to use postman to get the blobs from a container, I'm trying to do this from a collection. Link below: https://www.postman.com/speeding-astronaut-338068/workspace/azure-rest-api/request/13081473-85754311-416e-459a-a38d-fd37e4933bc4

First I go to a route named:

Get Storage Bearer Token

Where can I get my access_token by making this request: enter image description here

above, I get my access_token successfully. Then I go to the List Blobs route, and fill in the url with the appropriate storage account names and container name

enter image description here

but I get this error:

<?xml version="1.0" encoding="utf-8"?>
<Error>
    <Code>AuthorizationPermissionMismatch</Code>
    <Message>This request is not authorized to perform this operation using this permission.
RequestId:606c7212-201e-0005-3583-f1ab58000000
Time:2023-09-27T20:46:55.2555893Z</Message>
</Error>

Why even providing all the correct variables do I receive this error? I read some articles like:

https://learn.microsoft.com/en-us/answers/questions/779065/error-this-request-is-not-authorized-to-perform-th

but I couldn't solve it because the error persists

to receive my client_id, client_secret I followed this tutorial:

https://docs.lacework.net/onboarding/gather-the-required-azure-client-id-tenant-id-and-client-secret I have also given read permission to the service in my container and storage account

Solution

  • The error usually occurs if the service principal does not have required RBAC roles or permissions to perform the operation.

    I registered one Azure AD application and added API permission like this:

    enter image description here

    Now, I added Reader role to above service principal under storage account:

    enter image description here

    I generated access token using client credentials flow via Postman with same parameters:

    POST https://login.microsoftonline.com/tenantId/oauth2/token
grant_type:client_credentials
client_id:appId
client_secret:secret
resource: https://storage.azure.com

    Response:

    enter image description here

    When I used this token to list blobs by running below REST API call, I got same error like this:

    GET https://sristorage28.blob.core.windows.net/sri?restype=container&comp=list
Authorization: Bearer <token>
x-ms-date: 2020-10-02

    Response:

    enter image description here

    Note that, you cannot perform data operations like create, read, delete and update on storage account containers with Reader role.

    To resolve the error, you need to assign Storage related RBAC roles like Storage Blob Data Contributor or Storage Blob Data Owner.

    In my case, I assigned Storage Blob Data Contributor to the service principal under storage account like this:

    enter image description here

    When I call the REST API after assigning above role by generating new bearer token, I got response with list of blobs successfully:

    GET https://sristorage28.blob.core.windows.net/sri?restype=container&comp=list
Authorization: Bearer <token>
x-ms-date: 2020-10-02

    Response:

    enter image description here

    If the error still persists, try generating access token using v2.0 token endpoint as I mentioned in this SO thread previously.