AuthorizationPermissionMismatch while performing operations on blobServiceClient

Question

Hi,

I have below code to generate sas token for a blob.

ClientSecretCredential clientSecretCredential = new ClientSecretCredentialBuilder()
.clientId("clientId")
.tenantId("tenantId")
.clientSecret("secret")
.build();
blobServiceClient = new BlobServiceClientBuilder()
.endpoint(endpoint)
.credential(clientSecretCredential)
.buildClient();

BlobContainerClient blobContainerClient = blobServiceClient.getBlobContainerClient(containerName);

if (!blobContainerClient.exists()) {
throw new CustomException()
}

    BlobClient blobClient = blobContainerClient.getBlobClient(blobName);  


    BlobServiceSasSignatureValues blobServiceSasSignatureValues = new BlobServiceSasSignatureValues(expiryTime,  
            blobContainerSasPermission);  

    UserDelegationKey userDelegationKey = blobServiceClient.getUserDelegationKey(OffsetDateTime.now(), expiryTime);  

    String sasToken = blobClient.generateUserDelegationSas(blobServiceSasSignatureValues, userDelegationKey);  

I am receiving below error while executing any blobContainerClient.exists() & blobServiceClient.getUserDelegationKey

com.azure.storage.blob.models.BlobStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "?<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:ea77b05b-901e-008c-0767-ab807b000000
Time:2022-08-08T20:43:37.3142655Z</Message></Error>"
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(Unknown Source) ~[na:na]
at com.azure.core.http.rest.ResponseExceptionConstructorCache.invoke(ResponseExceptionConstructorCache.java:56) ~[azure-core-1.27.0.jar!/:1.27.0]
at com.azure.core.http.rest.RestProxy.instantiateUnexpectedException(RestProxy.java:406) ~[azure-core-1.27.0.jar!/:1.27.0]
at com.azure.core.http.rest.RestProxy.lambda$ensureExpectedStatus$5(RestProxy.java:462) ~[azure-core-1.27.0.jar!/:1.27.0]
at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:125) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxSwitchIfEmpty$SwitchIfEmptySubscriber.onNext(FluxSwitchIfEmpty.java:74) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Operators$MonoSubscriber.complete(Operators.java:1816) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoCacheTime$CoordinatorSubscriber.signalCached(MonoCacheTime.java:337) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoCacheTime$CoordinatorSubscriber.onNext(MonoCacheTime.java:354) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Operators$ScalarSubscription.request(Operators.java:2398) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoCacheTime$CoordinatorSubscriber.onSubscribe(MonoCacheTime.java:293) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxFlatMap.trySubscribeScalarMap(FluxFlatMap.java:192) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoFlatMap.subscribeOrReturn(MonoFlatMap.java:53) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.InternalMonoOperator.subscribe(InternalMonoOperator.java:57) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoDefer.subscribe(MonoDefer.java:52) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoCacheTime.subscribeOrReturn(MonoCacheTime.java:143) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.InternalMonoOperator.subscribe(InternalMonoOperator.java:57) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:157) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxSwitchIfEmpty$SwitchIfEmptySubscriber.onNext(FluxSwitchIfEmpty.java:74) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Operators$MonoSubscriber.complete(Operators.java:1816) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoCallable.subscribe(MonoCallable.java:62) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.InternalMonoOperator.subscribe(InternalMonoOperator.java:64) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:157) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:122) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxOnErrorResume$ResumeSubscriber.onNext(FluxOnErrorResume.java:79) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Operators$MonoSubscriber.complete(Operators.java:1816) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:151) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxDelaySubscription$DelaySubscriptionMainSubscriber.onNext(FluxDelaySubscription.java:189) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.SerializedSubscriber.onNext(SerializedSubscriber.java:99) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.SerializedSubscriber.onNext(SerializedSubscriber.java:99) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxTimeout$TimeoutMainSubscriber.onNext(FluxTimeout.java:180) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Operators$MonoSubscriber.complete(Operators.java:1816) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:151) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoIgnoreThen$ThenIgnoreMain.complete(MonoIgnoreThen.java:292) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoIgnoreThen$ThenIgnoreMain.onNext(MonoIgnoreThen.java:187) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onNext(FluxMapFuseable.java:129) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.FluxMapFuseable$MapFuseableSubscriber.onNext(FluxMapFuseable.java:129) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Operators$MonoSubscriber.complete(Operators.java:1816) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:151) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.MonoCreate$DefaultMonoSink.success(MonoCreate.java:172) ~[reactor-core-3.4.21.jar!/:3.4.21]
at com.azure.core.http.okhttp.OkHttpAsyncHttpClient$OkHttpCallback.onResponse(OkHttpAsyncHttpClient.java:191) ~[azure-core-http-okhttp-1.9.0.jar!/:1.9.0]
at okhttp3.internal.connection.RealCall$AsyncCall.run(RealCall.kt:519) ~[okhttp-4.9.3.jar!/:na]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) ~[na:na]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) ~[na:na]
at java.base/java.lang.Thread.run(Unknown Source) ~[na:na]
Suppressed: java.lang.Exception: #block terminated with an error
at reactor.core.publisher.BlockingSingleSubscriber.blockingGet(BlockingSingleSubscriber.java:99) ~[reactor-core-3.4.21.jar!/:3.4.21]
at reactor.core.publisher.Mono.block(Mono.java:1707) ~[reactor-core-3.4.21.jar!/:3.4.21]
at com.azure.storage.common.implementation.StorageImplUtils.blockWithOptionalTimeout(StorageImplUtils.java:177) ~[azure-storage-common-12.15.1.jar!/:12.15.1]

I have tried added below roles to my service principle still have the same issue.

1. Contributor
2. Storage Blob Data Contributor
3. Storage Blob Data Owner
4. Storage Blob Data Reader
5. Storage Queue Data Contributor

Answer 1

@Chaitrali Deshmukh Thank you for your patience while I was looking into this issue.

I see that you are receiving error- AuthorizationPermissionMismatch. This request is not authorized to perform this operation using this permission.

This error occurs when the AAD App does not have the proper permissions to get a user delegation key. Please refer to this article for more details regarding this here- https://learn.microsoft.com/en-us/rest/api/storageservices/get-user-delegation-key#authorization

Please also check the level of scope given to the generateUserDelegationKey as it has to be at the level of storage account, the resource group, or the subscription. Hope this helps!

Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Answer 2

Thanks, I was able to pass through this error by just adding Storage Blob Data Contributor.