Storage Datalake allows upload, but a read causes a 401

Question

I'm following the documentation here: https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-directory-file-acl-javascript

Have verified, triple verified the account name and the account key.

Uploading a file works:

async function UploadFile(fileSystemClient: DataLakeFileSystemClient) {
  let content = ""

  fs.readFile("mytestfile.txt", (err, data) => {
    if (err) throw err

    content = data.toString()
  })

  const fileClient = fileSystemClient.getFileClient("my-directory/uploaded-file.txt")
  await fileClient.create()
  await fileClient.append(content, 0, content.length)
  await fileClient.flush(content.length)
}

Doing this throws error:

async function DownloadFile(fileSystemClient: DataLakeFileSystemClient) {
  const fileClient = fileSystemClient.getFileClient("my-directory/uploaded-file.txt")

  const downloadResponse = await fileClient.read()
}

The error is:

 [401] Server failed to authenticate the request. Please refer to the information in the www-authenticate header.
RequestId:475c59c9-501e-00bb-4d34-efddbe000000
Time:2024-08-15T16:57:58.0876603Z
  at handleErrorResponse (./node_modules/@azure/core-client/src/deserializationPolicy.ts:255:17)  
  at deserializeResponseBody (./node_modules/@azure/core-client/src/deserializationPolicy.ts:159:43)  
  at process.processTicksAndRejections (node:internal/process/task_queues:95:5)  
  at StorageContextClient.sendOperationRequest (./node_modules/@azure/core-client/src/serviceClient.ts:207:27)  
  at StorageContextClient.sendOperationRequest (./node_modules/@azure/core-http-compat/src/extendedClient.ts:99:23)  
  at <anonymous> (./node_modules/@azure/storage-blob/src/Clients.ts:1218:9)  
  at Object.withSpan (./node_modules/@azure/storage-blob/node_modules/@azure/core-tracing/src/tracingClient.ts:70:22)  
  at DataLakeFileClient.read (./node_modules/@azure/storage-file-datalake/src/clients.ts:1365:27)  
  at DownloadFile (./server/api/test.get.ts:51:1)  
  at Object.handler (./server/api/test.get.ts:19:1)

Debugging, the error is:

code: NoAuthenticationInformation
name: RestError
message: 'Server failed to authenticate the request. Please refer to the information in the www-authenticate header.
www-authenticate: 'Bearer authorization_uri=https://login.microsoftonline.com/04877f06-fddd-4eec-ab16-bff4affcd5e1/oauth2/authorize resource_id=https://storage.azure.com'

Answer 1

Hello Eugen Istoc,

Greetings! Welcome to Microsoft Q&A Platform.

I understand that you’re encountering a common issue with authentication when trying to read from your storage datalake.

Please consider checking the below troubleshooting steps to resolve the issue,

1. Please re-check the Connection String which is passed.
2. Do consider using key2 of Shared Access Signature once.
3. Networking option has Enabled from all networks for Storage Account.
4. Ensure that the account you’re using has the necessary permissions to read from the storage account. You might need roles like Storage Blob Data Reader or Storage Blob Data Contributor
5. The error message suggests checking the www-authenticate header for more details. This header can provide specific information about why the authentication failed.

If you use private endpoints, you will need to ensure that your DNS is properly configured.

Few more workaround options are discussed at this link: azurestorage-blob-server-failed-to-authenticate-the-request-make-sure-the-value

Hope this helps! Please let us know if this solves the issue and do let us know if any further queries.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.