Microsoft.WindowsAzure.Storage.StorageException: The remote server returned an error: (403)

2
votes

upon fresh publish this is the initial error:

System.ApplicationException: The trace listener AzureBlobTraceListener is disabled. ---> System.InvalidOperationException: The SAS URL for the cloud storage account is not specified. Use the environment variable 'DIAGNOSTICS_AZUREBLOBCONTAINERSASURL' to define it.at Microsoft.WindowsAzure.WebSites.Diagnostics.AzureBlobTraceLi‌​stener.RefreshConfig‌​()

I then added DIAGNOSTICS_AZUREBLOBCONTAINERSASURL to the application settings having its value set to the Blob service SAS URL generated. At this I get a new error:

System.ApplicationException: The trace listener AzureBlobTraceListener is disabled. ---> System.ArgumentException: Missing mandatory parameters for valid Shared Access Signature at Microsoft.WindowsAzure.Storage.Core.Auth.SharedAccessSignatureHelper.ParseQuery(IDictionary2 queryParameters, Boolean mandatorySignedResource) at Microsoft.WindowsAzure.Storage.Core.Util.NavigationHelper.ParseBlobQueryAndVerify(Uri address, StorageCredentials& parsedCredentials, Nullable1& parsedSnapshot) at Microsoft.WindowsAzure.Storage.Core.Util.NavigationHelper.ParseBlobQueryAndVerify(StorageUri address, StorageCredentials& parsedCredentials, Nullable`1& parsedSnapshot) at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer.ParseQueryAndVerify(StorageUri address, StorageCredentials credentials) at Microsoft.WindowsAzure.Storage.Blob.CloudBlobContainer..ctor(StorageUri containerAddress, StorageCredentials credentials) at Microsoft.WindowsAzure.WebSites.Diagnostics.AzureBlobTraceListener.RefreshConfig()

I then added sr=b to the 'DIAGNOSTICS_AZUREBLOBCONTAINERSASURL' which result in the below error:

Microsoft.WindowsAzure.Storage.StorageException: The remote server returned an error: (403) Forbidden. ---> System.Net.WebException: The remote server returned an error: (403) Forbidden. at System.Net.HttpWebRequest.GetResponse() at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand1 cmd, IRetryPolicy policy, OperationContext operationContext) --- End of inner exception stack trace --- at Microsoft.WindowsAzure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand1 cmd, IRetryPolicy policy, OperationContext operationContext) at Microsoft.WindowsAzure.Storage.Blob.CloudBlockBlob.DownloadBlockList(BlockListingFilter blockListingFilter, AccessCondition accessCondition, BlobRequestOptions options, OperationContext operationContext) at Microsoft.WindowsAzure.WebSites.Diagnostics.AzureBlobTraceListener.AppendStreamToBlob(Stream stream) at Microsoft.WindowsAzure.WebSites.Diagnostics.AzureBlobTraceListener.ConsumeBuffer() Request Information RequestID:5225782d-0001-0175-6d94-fc82dd000000 RequestDate:Fri, 14 Jul 2017 11:33:16 GMT StatusMessage:Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. ErrorCode:AuthenticationFailed

Connection string used to declare AzureWebJobsDashboard and AzureWebJobsStorage in app settings: enter image description here

1
azureazure-storage
Welcome to StackOverflow. Please edit your question with better format, and provide more context of your problem, or people are not able to help you via just an exception stack trace. – Zhaoxing Lu
added some description thanks – Keshav Taurah
According to your description, we still couldn't find the reason why you get the 403 error. Could you please tell us what you have done? Do enable the Diagnostics logs in the azure web app portal or run the storage SDK in your application codes? – Brando Zhang
upon fresh publish this is the initial error: System.ApplicationException: The trace listener AzureBlobTraceListener is disabled. ---> System.InvalidOperationException: The SAS URL for the cloud storage account is not specified. Use the environment variable 'DIAGNOSTICS_AZUREBLOBCONTAINERSASURL' to define it.at Microsoft.WindowsAzure.WebSites.Diagnostics.AzureBlobTraceListener.RefreshConfig() – Keshav Taurah
@BrandoZhang-MSFT I added DIAGNOSTICS_AZUREBLOBCONTAINERSASURL in the application settings,setting its value to the Blob service SAS URL generated . – Keshav Taurah

1 Answers

8
votes

According to your description, I guess the reason why you faced the error is your SAS token doesn't have enough permission to CRUD the blob.

The SAS token must be the blob container SAS token not the blob SAS token.

Besides, if you set the the azure web app's diagnostics logs Application Logging feature, it will auto generate a SAS token in your web app's appsetting.

More details, you could refer to below image:

Set the storage account in the diagnostics logs.

enter image description here

Then it will auto set the appsetting:

enter image description here

Update:

Failed to validate Microsoft Azure WebJobs SDK Dashboard connection string. The Microsoft Azure Storage account connection string is not formatted correctly.

If you upload a webjobs to your web app, the web jobs need two appsetting. One is the Dashboard connection string, another one is the AzureWebJobsStorage.

Both of these two setting need the storage connection string not the storage SAS.

You could find the storage connection string as below image shows:

1.Open the storage access key feature.

enter image description here

2.Copy the connection string:

enter image description here

3.Replace the connection string in the web app appsetting.

enter image description here