Cannot access source document location with the current permissions

Question

When trying this quickstart guide https://learn.microsoft.com/en-us/azure/cognitive-services/translator/document-translation/quickstarts/get-started-with-rest-api?pivots=programming-language-rest-api, I successfully created the translator and storage resources to translate documents in batch.

I use curl to try the translation, the api successfully accept the request:

cmd /c curl "https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches" -i -X POST --header "Content-Type: application/json" --header "Ocp-Apim-Subscription-Key: <key>" --data "@document-translation.json"

HTTP/1.1 202 Accepted

Content-Length: 0

X-RequestId: b4826024-29d4-4ffb-a53b-3335b12fc4a1

Operation-Location: https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches/4d003a4a-4032-4845-a3a7-f1736f56e87c

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

apim-request-id: b4826024-29d4-4ffb-a53b-3335b12fc4a1

x-content-type-options: nosniff

x-ms-region: East US

Date: Tue, 16 May 2023 20:19:03 GMT

This is the json:

{
    "inputs": [{
        "storageType": "File",
        "source": {
            "sourceUrl": "https://<endpoint>.blob.core.windows.net/src/document-translation-sample.docx?sp=r&st=2023-05-16T18:34:34Z&se=2023-05-17T02:34:34Z&skoid=a4db8411-463b-4a9f-84d3-75a1c98708f4&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-05-16T18:34:34Z&ske=2023-05-17T02:34:34Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=b&sig=Xcmg41owGOsw7UkmDywELd5IHtz4vow1b%2Fr%2BC0SZetI%3D"
        },
        "targets": [{
            "targetUrl": "https://<endpoint>.blob.core.windows.net/tgt/Target-Spanish.docx?sp=wl&st=2023-05-16T16:59:38Z&se=2023-05-23T00:59:38Z&skoid=a4db8411-463b-4a9f-84d3-75a1c98708f4&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-05-16T16:59:38Z&ske=2023-05-23T00:59:38Z&sks=b&skv=2022-11-02&sv=2022-11-02&sr=c&sig=LLBw6qa38WsVGU6%2BtdNh2GeAl%2Fw5amrvdRlEm1aewjQ%3D",
            "language": "es"
        }]
    }]
}

When I try to get the status of the translation, I find that the service couldn't translate because some access error in the storage account:

{"id":"4d003a4a-4032-4845-a3a7-f1736f56e87c","createdDateTimeUtc":"2023-05-16T20:19:03.8964513Z","lastActionDateTimeUtc":"2023-05-16T20:19:04.4210061Z","status":"ValidationFailed","error":{"code":"InvalidRequest","message":"Cannot access source document location with the current permissions.","target":"Operation","innerError":{"code":"InvalidDocumentAccessLevel","message":"Cannot access source document location with the current permissions."}},"summary":{"total":0,"failed":0,"success":0,"inProgress":0,"notYetStarted":0,"cancelled":0,"totalCharacterCharged":0}}

Although I set the SAS (both source and target containers) as indicated in here https://learn.microsoft.com/en-us/azure/cognitive-services/Translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers

read, list for source and write, list for target.

I appreciate your help.

Answer 1

I encountered the same error when using the C# SDK.

"Cannot access source document location with the current permissions."

Here is the code:

DocumentTranslationClient client = new(new Uri("<Endpoint>"}), new AzureKeyCredential("<Key>"));
DocumentTranslationInput input = new DocumentTranslationInput(
	new Uri("https://xxx.blob.core.windows.net/translator-source/testfile.pdf?<SAS>"),
	new Uri("https://xxx.blob.core.windows.net/translator-target/testfile.en.pdf?<SAS>"),
	"en");
DocumentTranslationOperation operation = await client.StartTranslationAsync(input);
await operation.WaitForCompletionAsync();

I have tried both file level and container level SAS, and even account level SAS with All permissions.

The error messages received are all the same.

I am sure the permissions are correct because I can open the uri of the source file normally in the browser.

After repeated attempts, I found the problem!

When instantiating the DocumentTranslationInput object, the StorageUriKind property defaults to null.

This corresponds to the StorageType parameter in the API.

In the documentation, this is not a required parameter, and I suspect that when I use the SAS URI, it incorrectly identifies the File as Folder, leading to permission issues.

Indeed, testing confirmed my suspicion. When I manually set the StorageUriKind to File, it works!

DocumentTranslationInput input = new DocumentTranslationInput(
	new Uri("https://xxx.blob.core.windows.net/translator-source/testfile.pdf?<SAS>"),
	new Uri("https://xxx.blob.core.windows.net/translator-target/testfile.en.pdf?<SAS>"),
	"en") { StorageUriKind= StorageInputUriKind.File };

Additionally, I tried changing the Uri from a file to a container or directory, while keeping the StorageUriKind at its default null setting.

DocumentTranslationInput input = new DocumentTranslationInput(
	new Uri("https://xxx.blob.core.windows.net/translator-source/?<SAS>"),
	new Uri("https://xxx.blob.core.windows.net/translator-target/?<SAS>"),
	"en");

This also worked as expected, translating all files within the file directory.

Hoping This Helps

Answer 2

Hi @romungi-MSFT , thanks for response. I generate again the SAS at container level with read, list, user delegation keys for source container (src) and SAS container level with write, list, user delegation keys for target container (tgt), update the json:

{

    "inputs": [{

        "source": {

            "sourceUrl": "https://<endpoint>.blob.core.windows.net/src?sp=rl&st=2023-05-17T20:39:04Z&se=2023-05-24T04:39:04Z&skoid=a4db8411-463b-4a9f-84d3-75a1c98708f4&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-05-17T20:39:04Z&ske=2023-05-24T04:39:04Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=c&sig=r8ZeCQ7eXsLBVHRylovhEQZ5qivgrzhy7rYag2sUamo%3D"

        },

        "targets": [{

            "targetUrl": "https://<endpoint>.blob.core.windows.net/tgt?sp=wl&st=2023-05-17T20:40:21Z&se=2023-05-24T04:40:21Z&skoid=a4db8411-463b-4a9f-84d3-75a1c98708f4&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-05-17T20:40:21Z&ske=2023-05-24T04:40:21Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=c&sig=cTr2loH0FYrpHTcb7cDz%2BoER7K3fXd85P69USP%2B5g9k%3D",

            "language": "es"

        }]

    }]

}

Even checked that both containers have Container (anonymous read access for containers and blobs) "Public Access Levels" as per documentation. https://learn.microsoft.com/en-us/azure/cognitive-services/Translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers#prerequisites

Sent the request again:

cmd /c curl "https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches" -i -X POST --header "Content-Type: application/json" --header "Ocp-Apim-Subscription-Key: <key>" --data "@document-translation.json"
HTTP/1.1 202 Accepted
Content-Length: 0
X-RequestId: 0b929ce6-5180-4cce-8a1f-5d0695f571b7
Operation-Location: https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches/5833c5c2-cb2a-47dd-9626-dddd408bb005
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
apim-request-id: 0b929ce6-5180-4cce-8a1f-5d0695f571b7
x-content-type-options: nosniff
x-ms-region: East US
Date: Wed, 17 May 2023 20:41:22 GMT

Unfortunately, still get the same error:

cmd /c curl "https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches/5833c5c2-cb2a-47dd-9626-dddd408bb005" -i -X GET --header "Ocp-Apim-Subscription-Key: <key>"

{"id":"5833c5c2-cb2a-47dd-9626-dddd408bb005","createdDateTimeUtc":"2023-05-17T20:41:22.894242Z","lastActionDateTimeUtc":"2023-05-17T20:41:23.4059145Z","status":"ValidationFailed","error":{"code":"InvalidRequest","message":"Cannot access source document location with the current permissions.","target":"Operation","innerError":{"code":"InvalidDocumentAccessLevel","message":"Cannot access source document location with the current permissions."}},"summary":{"total":0,"failed":0,"success":0,"inProgress":0,"notYetStarted":0,"cancelled":0,"totalCharacterCharged":0}}

What else do you recommend? I appreciate it.

PS: I even submit a bug I found in documentation that is currently on PR: https://github.com/MicrosoftDocs/azure-docs/issues/109630#issuecomment-1550677451

Answer 3

Hi! Were you able to fix this somehow? I have the same issue with the same tool

Answer 4

I still have the same problem trying to use the example code, both C# and Python example.
Provide tutorials materials that simply doesn't work it's a good start to don't sell the service!

Answer 5

Is there any update? I got the same error