Can't access blob storage using Hadoop SDK and Azure MSI authentication

Question

I use a simple code

        conf.set("fs.defaultFS","wasbs://sshcont01@sshblobhierarchyoff.blob.core.windows.net");
        conf.set("fs.azure.ssl.channel.mode","Default_JSSE");
        conf.set("fs.azure.account.oauth.provider.type","org.apache.hadoop.fs.azurebfs.oauth2.MsiTokenProvider");
        conf.set("fs.azure.account.auth.type","OAuth");
        conf.set("fs.azure.account.oauth2.msi.tenant","My Tenant ID");
        conf.set("fs.azure.account.oauth2.client.id","My Client ID");
        FileSystem fs = org.apache.hadoop.fs.FileSystem.get(conf);

but I have got:

org.apache.hadoop.fs.azure.AzureException: org.apache.hadoop.fs.azure.AzureException: No credentials found for account sshblobhierarchyoff.blob.core.windows.net in the configuration, and its container sshcont01 is not accessible using anonymous credentials. Please check if the container exists first. If it is not publicly available, you have to provide account credentials.
Error [18:01:18] at org.apache.hadoop.fs.azure.AzureNativeFileSystemStore.createAzureStorageSession(AzureNativeFileSystemStore.java:1098)
Error [18:01:18] at org.apache.hadoop.fs.azure.AzureNativeFileSystemStore.initialize(AzureNativeFileSystemStore.java:547)
Error [18:01:18] at org.apache.hadoop.fs.azure.NativeAzureFilSystem.initialize(NativeAzureFileSystem.java:1379)
Error [18:01:18] at org.apache.hadoop.fs.FileSystem.createFileSystem(FileSystem.java:3469)
Error [18:01:18] at org.apache.hadoop.fs.FileSystem.access$300(FileSystem.java:174)
Error [18:01:18] at org.apache.hadoop.fs.FileSystem$Cache.getInternal(FileSystem.java:3574)
Error [18:01:18] at org.apache.hadoop.fs.FileSystem$Cache.get(FileSystem.java:3521)
Error [18:01:18] at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:540)
Error [18:01:18] at org.apache.hadoop.fs.FileSystem.get(FileSystem.java:288)

But if I set "access level: "container" for this container it passes well. We suppose the MSI should provide access to the container without making it public.

Answer 1

Hello @Sergey Shabalov ,

Thanks for the question and using MS Q&A platform.

This is an excepted behaviour while you set access level to private permissions when using an Azure Storage account with Hadoop.

Note: Private containers in storage accounts that are NOT connected to a cluster: You can't access the blobs in the containers unless you define the storage account in the Hadoop configuration i.e., core-site.xml file.

For your understanding, I have created three containers as following;

If you access containers using HDInsight, you will get the same error message for private and blob public access level and gives desired output for the Container public access level.

For more details, refer “HDInsight Storage architecture” and “Hadoop Azure Support: Azure Blob Storage”.

Hope this will help. Please let us know if any further queries.

------------------------------

• Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
• Want a reminder to come back and check responses? Here is how to subscribe to a notification
• If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators

Answer 2

But after providing Container:access level I am not able to write files to container. Following error is coming:

[ERROR] org.apache.hadoop.fs.azure.AzureException: Uploads to to public accounts using anonymous access is prohibited.

I am here trying to connect to Haddop using service principle authentication

configMap.set("fs.defaultFS", "wasbs://" + container + "@" + accountName + ".blob."+ endPointSuffix + "/");
		configMap.put("fs.azure.account.auth.type", "OAuth");
		configMap.set("fs.azure.account.oauth2.client.endpoint", "https://login.microsoftonline.com/" + tenantId + "/oauth2/token");
		configMap.set("fs.azure.account.oauth2.client.id", clientId);
		configMap.set("fs.azure.account.oauth2.client.secret", clientSecret);