1

I'm working on a demo to demonstrate Azure AD workload identity federation with SPIFFE and SPIRE. Following this blog. All the steps worked except the verification step. In the verification step - it is supposed to fetch JWT toke exchange for AD Token and use this token to get Azure Blob. It is failing with:

There is a endpoint to fetch the token, this appears to work as expected. I have masked the token returned in the below output.

$ curl -XGET 20.83.89.207:80/exchanged
{"token":"eyJ0sdfsdfsdfsdfsdfsdfsdfig","expiresOnTimestamp":1678485060000}

When I issue below command to fetch the blob, it fails with AuthorizationPermissionMismatch:

$ curl -XGET <workload svc ip>/<storage container>/<blob name>

error:

"details":{"errorCode":"AuthorizationPermissionMismatch","content-length":"279","content-type":"application/xml","date":"Mon, 06 Mar 2023 15:40:45 GMT","server":"Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0","x-ms-client-request-id":"1d2cbecb-09b2-4395-93ee-918136ee2fbe","x-ms-request-id":"cf2283f1-d01e-003f-4642-5077a4000000","x-ms-version":"2021-10-04","message":"This request is not authorized to perform this operation using this permission.\nRequestId:cf2283f1-d01e-003f-4642-5077a4000000\nTime:2023-03-06T15:40:46.3857513Z","code":"AuthorizationPermissionMismatch"}}

I have the Azure Storage account with following roles assigned to my principal: Contributor, Storage Blob Delegator, Storage Blob Data Contributor, Storage Blob Data Reader and Storage Queue Data Contributor, Storage Blob Data Owner, Owner and a bunch of other roles.

I'm not sure what I'm missing.

I tried adding different roles listed above.

Edwin Buck
  • 69,361
  • 7
  • 100
  • 138
Ranjit
  • 48
  • 5
  • I don't understand how the generated token is sent across to the blob service? You do need to pass it along in the `Authorization` header in your request: https://learn.microsoft.com/en-us/rest/api/storageservices/get-blob?tabs=azure-ad#request-headers There are additional headers that are required which seem to be missing your request. – Gaurav Mar 10 '23 at 23:22
  • I'm not passing the exchanged token. I'm using it to verify SPIFFE token exchange for AD token . In the GET method ( https://github.com/udayxhegde/aad-federate-blobstore-node/blob/main/src/app.ts ) there is a BlobServiceClient that opens a connection to the Azure service to download the blob. – Ranjit Mar 11 '23 at 03:13
  • I found the resolution. One of the steps in the blog is missing. After registering the application in Azure AD, this app entity should be given permission to access Storage account. Once I added this to Storage account IAM policy I was able to read the contents of a blob. – Ranjit Mar 11 '23 at 23:48

0 Answers0