Azure SAS token AzCopy Authentication Issue

Question

Can anyone help with an error when using a SAS key to perform an azCopy?

I SSH onto my Azure VM and get a token using it's managed identity:

curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com' -H Metadata:true

I then build a postman request, with an 'Authorization' header of 'Bearer tokenFromAbove' and a JSON body of:

{
"signedServices":"b",
"signedResourceTypes":"co",
"signedPermission":"rwc",
"signedProtocol":"https",
"signedExpiry":"2020-02-22T00:06:00Z"
}

This posts to: https://management.azure.com/subscriptions/mySubId/resourceGroups/myResourceGroupName/providers/Microsoft.Storage/storageAccounts/myStorageAccountName/listAccountSas/?api-version=2019-06-01

And returns a sas token. This token allows me to create a container with 'azcopy make.'

But I also want to use 'azcopy copy' to move files from my VM to the new container. I attempt this via the command:

azcopy copy 'mySourceDirectory' 'https://myStorageAccountName.blob.core.windows.net/myContainer?sv=2015-04-05&ss=b&srt=co&sp=rwc&se=2020-02-22T00:06:00Z&spr=https&sig=redacted' --recursive

But this fails with the following:

INFO: Authentication failed, it is either not correct, or expired, or does not have the correct permission -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /home/vsts/go/pkg/mod/github.com/!azure/[email protected]/azblob/zc_storage_error.go:42

===== RESPONSE ERROR (ServiceCode=AuthenticationFailed) =====

Description=Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

RequestId:ef37087d-501e-0050-650b-e81cb4000000

Time:2020-02-20T16:35:50.6651356Z, Details:

AuthenticationErrorDetail: **Signature did not match**.

String to sign used was myStorageAccountName
rwc
b
co
2020-02-22T00:06:00Z
https
2015-04-05

Code: AuthenticationFailed

Note if I generate a similar SAS token in Azure portal, it works. My VM is an owner of the storage account.

Can you try to add list (l) permission to the SAS? So your permissions would be rwcl. — Gaurav Mantri
– Gaurav Mantri, Commented Feb 20, 2020 at 17:04
Unfortunately, no change. I've tried all options for SignedServices, SignedResourceType & SignedPermission. — Tester_123
– Tester_123, Commented Feb 20, 2020 at 17:19
This is a bug in azcopy: github.com/Azure/azure-storage-azcopy/issues/122 — Hong Ooi
– Hong Ooi, Commented Feb 20, 2020 at 18:07

Tester_123 · Accepted Answer · 2020-02-21 09:40:11Z

0

Thanks to the replies above. This is indeed an open issue with the 'azcopy copy' command, failing to interpret the date format returned in the SAS token when that token has been generated from the rest API.

We will come up with a workaround - i think we can temporarily use a token generated from the portal.

answered Feb 21, 2020 at 9:40

Tester_123

552 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Azure SAS token AzCopy Authentication Issue

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related