Azure Data Lake Service-to-service authentication client secret, AdalServiceException and WebException

Question

Tyring to use the below docs to get this up and running for my console app that I plan to port to Azure Functions. https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-get-started-net-sdk

The code below is where I'm getting stuck

CODE SNIP

// Service principal / appplication authentication with client secret / key
// Use the client ID of an existing AAD "Web App" application.
SynchronizationContext.SetSynchronizationContext(new SynchronizationContext());

var domain = "<AAD-directory-domain>";
var webApp_clientId = "<AAD-application-clientid>";
var clientSecret = "<AAD-application-client-secret>";
var clientCredential = new ClientCredential(webApp_clientId, clientSecret);
var creds = await ApplicationTokenProvider.LoginSilentAsync(domain, clientCredential);

MY IMPLEMENTATION

SynchronizationContext.SetSynchronizationContext(new SynchronizationContext());
var domain = "https://microsoft.onmicrosoft.com";
var webApp_clientId = "<my-client-id>";
var clientSecret = "<my-client-secret>";
var clientCredential = new ClientCredential(webApp_clientId, clientSecret);
var creds = await ApplicationTokenProvider.LoginSilentAsync(domain, clientCredential);

SynchronizationContext.SetSynchronizationContext(new SynchronizationContext());                       

_adlsClient = new DataLakeStoreAccountManagementClient(creds) { SubscriptionId = _subId };
_adlsFileSystemClient = new DataLakeStoreFileSystemManagementClient(creds);

await _adlsFileSystemClient.FileSystem.MkdirsAsync("<name-of-my-dlstore>", "tempdir");

I also made sure to give my app permissions to my specified folder in Azure Data Lake instance:

I also made sure to give all child folders in this directory the same level or permissions:

Assigned permissions to file path

When I run my implementation I get the below errors. Any advice SO? System.AggregateException: 'One or more errors occurred.'

Inner Exception 1

AdalServiceException: AADSTS90002: Requested tenant identifier 'https:' is not valid.

Trace ID: d1718b0a-0533-4708-a311-4e1622840100

Correlation ID: a1544df2-692e-43d2-8acf-25a847956fb6

Timestamp: 2017-03-29 01:30:18Z

Inner Exception 2

WebException: The remote server returned an error: (400) Bad Request.

AS PART OF SOLUTION Need to make sure to give root folder read, write, execute permissions, (this will trickle down to the one folder you want to give these permissions for) then remove those permissions from all other folders you don't want these permissions assigned too, making sure you select the option to remove these permissions for that sub folder and all it's kiddos/children.

Nan Yu Nan Yu · Accepted Answer · 2017-03-29T03:35:04

AdalServiceException: AADSTS90002: Requested tenant identifier 'https:' is not valid.

That is your tenant name ,like "microsoft.onmicrosoft.com" .

WebException: The remote server returned an error: (400) Bad Request.

What is the detail error message , please refer to tutorial :

https://docs.microsoft.com/en-us/azure/data-lake-store/data-lake-store-get-started-net-sdk

I followed the detail steps to use service-to-service authentication with client secret , and successfully create a directory . Code below is for your reference :

  public static async Task  CreateDirectory()
    {

        SynchronizationContext.SetSynchronizationContext(new SynchronizationContext());
        var domain = "microsoft.onmicrosoft.com";
        var webApp_clientId = "client id";
        var clientSecret = "client secret";
        var clientCredential = new ClientCredential(webApp_clientId, clientSecret);
        var creds = ApplicationTokenProvider.LoginSilentAsync(domain, clientCredential).Result;

        SynchronizationContext.SetSynchronizationContext(new SynchronizationContext());

        _adlsClient = new DataLakeStoreAccountManagementClient(creds) { SubscriptionId = "_subId" };
        _adlsFileSystemClient = new DataLakeStoreFileSystemManagementClient(creds);

        await _adlsFileSystemClient.FileSystem.MkdirsAsync("_adlsAccountName", "tempdir");

    }
    static void Main(string[] args)
    {
      CreateDirectory().Wait();
    }

EDIT

You need to assign Execute permission to your app if you want to create a directory . Tenant ID and tenant name are both available ,means :

 var domain = "microsoft.onmicrosoft.com";
 //you could also use tenant id 
 var domain = "Your tenant ID";

Azure Data Lake Service-to-service authentication client secret, AdalServiceException and WebException

1 Answers