REST api for Azure DataLake Storage Service Principal not possible to use folder-specific access

Question

I'm trying to configure folder-specific access to adls (gen2) storage using app registration (active directory/service principal) auth. It works well when I'm using RBAC configuration to the whole storage/container, but I still got a 403 error when I'm configuring the access (read+execute) even to the root folder. Here are the steps I did during my configuration:

1. I created app registration, create a secret for it and add an API permission to blob storages and adls:
2. In the root directory of my storage account the I add the ACL (Access control list) for Read and Execute access.
3. Using postman I got the Oauth token for my application and trying to execute a GET request for the container to get the list of files in the directory using the URL from the azure docs (https://learn.microsoft.com/en-us/rest/api/storageservices/datalakestoragegen2/path/list) :

And got the error:

{
    "error": {
        "code": "AuthorizationPermissionMismatch",
        "message": "This request is not authorized to perform this operation using this permission.\nRequestId:12401499-f01f-0105-2a98-327246000000\nTime:2021-04-16T08:15:07.8676657Z"
    }
}

And it works when I set RBAC (IAM) access to the whole container instead of ACL. What should I also add in my configuration to use folder-specific access for the service principal account?

Answer 1

I can also reproduce your issue on my side, from your request url, you want to do operation List /abc/d/, so to solve the issue, you need to give the ACL permissions like below.

Operation	/	abc/	d/
List /abc/d/	--X	--X	R-X

You have already given the R-X(actually--x is enough) permission at the container( i.e. /), so you just need to give --X at abc directory and R-X at d directory, then it will work fine.

To give the ACL permissions to the directory, refer to the screenshot below.

See reference - Common scenarios related to ACL permissions, your case is the same as the last one.

Test(The command essentially calls the REST API you used):