Java method BlobContainerClient.exists() hung forever with Azure Blob Storage using Managed Identity (MSI) . Run on Azure VM

Sergey Shabalov 46 Reputation points
2022-10-13T11:29:13.723+00:00

I develop an Java application which needs to check if Azure Blob Storage: "sshblob01" has container "sshcont01". This Java app should use 'Managed Identity' (MSI)
To do so I create Azure Managed Identity with Client ID: "c1098b90-***************-59e7ff34074c".
Then I assign this Identity to Azure Virtual Machine I run my Java APP on.

As well I assign roles: "Storage Blob Data Contributor" and "Storage Blob Data Owner" for this Identity to "sshblob01". My APP uses code:

BlobServiceClient dlsClient = new  BlobServiceClientBuilder().  
  endpoint("https://sshblob01.blob.core.windows.net")  
  .credential(new ManagedIdentityCredentialBuilder().clientId("c1098b90-***************-59e7ff34074c").build())  
    .buildClient();  
BlobContainerClient containerClient = dlsClient.getBlobContainerClient("sshcont01");  
boolean exists = containerClient.exists();  // HUNG FOREWER !!!  
System.out.println("\tcontainerClient.exists(): "+exists);  
  

It hung on containerClient.exists();

If I use 'Shared key' or 'Shared access signature' (SAS) like:

BlobServiceClient dlsClient = new BlobServiceClientBuilder()  
                            .endpoint("https://sshblob01.blob.core.windows.net")  
                            .credential(new StorageSharedKeyCredential("sshblob01","wCPHm***********************************************hofw=="))  
                            .buildClient();  
or  
  
BlobServiceClient dlsClient = new BlobServiceClientBuilder()  
                    .endpoint("https://sshblob01.blob.core.windows.net"+"/"+"?sv=2021-06-08&ss=bfqt&srt=sco&sp=rwdlacupiytfx&se=2022-10-08T18:46:56Z&st=2022-09-26T10:46:56Z&spr=https&sig=92******************************%3D")  
                    .buildClient();  

it does work well

Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
3,192 questions
Microsoft Security Microsoft Entra Microsoft Entra ID
{count} votes

1 answer

Sort by: Most helpful
  1. Sergey Shabalov 46 Reputation points
    2022-11-03T18:58:47.39+00:00

    It does work properly if I assign "System Assigned Identity" the "Storage Blob Contributor" role to the blob storage "sshblob01".
    If the same role is assigned to the "User Assigned Identity" it still hangs.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.