azureazure-active-directoryazure-files

What are the proper scopes for create share with control plane api and create file with data plane api at Azure File?

I successfully created a share with the control plane API:

PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Storage/storageAccounts/{accountName}/fileServices/default/shares/sharename?api-version=2023-01-01 HTTP/1.1
Host: management.azure.com
Authorization: Bearer token
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 17
x-ms-date: Thu, 18 Apr 2024 09:26:55 GMT
x-ms-version: 2023-01-01

, But When I create a file at this share with the same bearer token, I get an error "Server Error [AuthenticationFailed]: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.".

The HTTP request to create file:

PUT /sharename/original.dat HTTP/1.1
Host: ***.file.core.windows.net
Authorization: Bearer token
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 0
x-ms-type: file
x-ms-content-length: 26214400
x-ms-version: 2022-11-02
x-ms-file-request-intent: backup

If I change the OAuth scope to "offline_access https://{account}.file.core.windows.net/user_impersonation" and get a new Bearer token for creating files, I will create the file successfully.

So,

a) Does the Bearer token get from OAuth scope: "https://management.azure.com/user_impersonation" cannot use for data plane API?

b) How can I create share and create files with once OAuth authentication? I tried to use multi OAuth scopes like this "offline_access https://{account}.file.core.windows.net/user_impersonation https://management.azure.com/user_impersonation" and I get an error " Provided value for the input parameter scope cannot be empty when requesting an access token using the provided authorization code. Please specify a valid scope.".

Solution

  • Does the Bearer token get from OAuth scope: "https://management.azure.com/user_impersonation" cannot use for data plane API?

    No, you cannot use bearer token having Azure Management API scope for data plane API call which throws Audience failed error like this:

    PUT https://{account}.file.core.windows.net/sharename/testfile.dat

    enter image description here

    How can I create share and create files with once OAuth authentication?

    It's not possible to get single access token with multiple OAuth scopes. The scope for token generation should match the host value of API calls.

    When I tried to generate the token with multiple OAuth scopes, I too got similar error like this:

    POST https://login.microsoftonline.com/tenantID/oauth2/v2.0/token
grant_type:authorization_code
client_id:appID
client_secret:secret
scope:offline_access https://{account}.file.core.windows.net/user_impersonation https://management.azure.com/user_impersonation
code:code
redirect_uri: https://jwt.ms

    Response:

    enter image description here

    As of now, the only way is to generate bearer tokens separately with scope matching the host value of API calls as below:

    POST https://login.microsoftonline.com/tenantID/oauth2/v2.0/token
grant_type:authorization_code
client_id:appID
client_secret:secret
scope: https://{account}.file.core.windows.net/user_impersonation
code:code
redirect_uri: https://jwt.ms

    Response:

    enter image description here

    You can decode this token in jwt.ms website and check aud claim value whether it matches host value of API or not:

    enter image description here

    When I used this token to create file in file share, I got the response with 201 Created code:

    PUT /testshare/testfile.dat HTTP/1.1
Host: ***.file.core.windows.net
Authorization: Bearer <token>
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 0
x-ms-type: file
x-ms-content-length: 26214400
x-ms-version: 2022-11-02
x-ms-file-request-intent: backup

    Response:

    enter image description here

    To confirm that, I checked the same in Portal where file created successfully like this:

    enter image description here

    Reference: Access Token With multiple API Scopes - Stack Overflow by juunas