How can I create an Azure Auth Token in a blobTrigger Azure Function? - azure

Question

I am trying to create a new Storage Account resource from an Azure Function. I am trying to use a StorageManagementClient, and need to pass in a ServiceClientCredential.
My code feels too simple... it compiles, but I feel like I must be missing some params. I am passing in a subscriptionId and a tenantId of an account in my subscription.
AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
string accessToken = await azureServiceTokenProvider.GetAccessTokenAsync("https://management.azure.com/", tenantId);
ServiceClientCredentials credentials = new TokenCredentials(accessToken);
StorageManagementClient StorageManagement = new StorageManagementClient(credentials) { SubscriptionId = subscriptionId };
When it runs, I get the following error:
2021-02-12T03:32:26.407 [Error] Executed 'BlobTrigger1' (Failed, Id=9c293b8d-591e-420e-b376-dc9ac45097cc, Duration=343ms)Parameters: Connection String: [No connection string specified], Resource: https://management.azure.com/, Authority: https://login.microsoftonline.com/cd256644-73f5-4da4-af5d-4a977f7a6a5d. Exception Message: Tried the following 3 methods to get an access token, but none of them worked.Parameters: Connection String: [No connection string specified], Resource: https://management.azure.com/, Authority: https://login.microsoftonline.com/cd256644-73f5-4da4-af5d-4a977f7a6a5d. Exception Message: Tried to get token using Managed Service Identity. Access token could not be acquired. An attempt was made to access a socket in a way forbidden by its access permissions.Parameters: Connection String: [No connection string specified], Resource: https://management.azure.com/, Authority: https://login.microsoftonline.com/cd256644-73f5-4da4-af5d-4a977f7a6a5d. Exception Message: Tried to get token using Visual Studio. Access token could not be acquired. Visual Studio token provider file not found at "D:\local\LocalAppData\.IdentityService\AzureServiceAuth\tokenprovider.json"Parameters: Connection String: [No connection string specified], Resource: https://management.azure.com/, Authority: https://login.microsoftonline.com/cd256644-73f5-4da4-af5d-4a977f7a6a5d. Exception Message: Tried to get token using Azure CLI. Access token could not be acquired. 'az' is not recognized as an internal or external command,operable program or batch file.

Answer 1

Your code is correct. I have found this issues is similar to yours. You can try this:
Hi friends, I have little ability to write fancy workaround code (my
head is not there), but by what you said above, I harkened back to
some old advice of: In the tool bar at the top of your VS 2017 program
go to: Tools, Options, Azure Service Authentication, Account
Selection, click the drop arrow on the right of the Microsoft banner
with your account name on it, click your account pop-up
again...hard(really insist on it), and that worked. I really feel like
a "just fix it" here might be just fine for a lot of folks. Don't get
me wrong, you girls(guys) know it better. Boy did I just want it to
work (phew!) Thanks :)
If that can't solve your problem, you can try this code:
public static async Task Main(string[] args)
{
string accessToken = await GetAuthorizationHeader();
ServiceClientCredentials credentials = new TokenCredentials(accessToken);
StorageManagementClient StorageManagement = new StorageManagementClient(credentials) { SubscriptionId = subscriptionId };
}
public static async Task<string> GetAuthorizationHeader()
{
ClientCredential cc = new ClientCredential(applicationId, password);
var context = new AuthenticationContext("https://login.windows.net/" + tenantId);
var result = await context.AcquireTokenAsync("https://management.azure.com/", cc);
if (result == null)
{
throw new InvalidOperationException("Failed to obtain the JWT token");
}
string token = result.AccessToken;
return token;
}

Answer 2

After following instructions on creating an Application Resgistration in Azure AD, this is the code I ended up getting to work:
var azureAuthConnectionString = $"RunAs=App;AppId={appId};TenantId={tenantId};AppKey={appKey}";
AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider(azureAuthConnectionString);
string accessToken = await azureServiceTokenProvider.GetAccessTokenAsync("https://management.azure.com/");
ServiceClientCredentials credentials = new TokenCredentials(accessToken);
StorageManagementClient StorageManagement = new StorageManagementClient(credentials) { SubscriptionId = subscriptionId };