Failed to authenticate an ASP.NET Core app in the Azure app registry for local development

[migueltorresc]

I have set up an app in the Azure App Registry for local development with ASP.NET Core. I have created object in application registry, also assigned roles to a Microsoft Enter ID group (Storage Blob Data Contributor and Storage Blob Data Reader).

Visual Studio is authenticated with a user account present in Azure and group member set to Enter ID.

Configure the application as follows:

This is the configuration of launchSettings.json:

  "https": {
    "commandName": "Project",
    "dotnetRunMessages": true,
    "launchBrowser": true,
    "inspectUri": "{wsProtocol}://{url.hostname}:{url.port}/_framework/debug/ws-proxy?browser={browserInspectUri}",
    "applicationUrl": "https://localhost:5002;http://localhost:5194",
    "environmentVariables": {
      "ASPNETCORE_ENVIRONMENT": "Development",
      "AZURE_CLIENT_ID": "XXXd69ed-dba5-4104-a413-f46428ffd7c0",
      "AZURE_TENANT_ID": "XXX25413-6329-41fb-923d-4f70372f072a",
      "AZURE_CLIENT_SECRET": "XXXMisecretoxxxxxxx"

    }
  },

program.cs:

builder.Services.AddAzureClients(x =>
{
    x.AddBlobServiceClient(new Uri("https://miblobstorage.blob.core.windows.net"));      
    x.UseCredential(new DefaultAzureCredential());
});

Dependency injection in controller:

private readonly BlobServiceClient _blobServiceClient;

public ProductController(ApplicationDbContext db, BlobServiceClient blobServiceClient )
 {
     _db = db;    
     _blobServiceClient = blobServiceClient;
 }

Controller method:

public async Task<IEnumerable<Product>> Get([FromHeader(Name = "x-requestid")] string requestId)
{
    BlobContainerClient containerClient = _blobServiceClient.GetBlobContainerClient("demoblob");
    var results = new List<string>();

    await foreach (BlobItem blob in containerClient.GetBlobsAsync())
    {
        results.Add(blob.Name);
    }

    results.ToArray();
}

After running the application, an error occurs in the Get method, following line:

await foreach (BlobItem blob in containerClient.GetBlobsAsync())

Error description:

Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      Azure.RequestFailedException: This request is not authorized to perform this operation using this permission.
RequestId:bb46c0f5-101e-0069-7ea9-831293000000
Time:2024-03-31T20:27:18.1148480Z
      Status: 403 (This request is not authorized to perform this operation using this permission.)
      ErrorCode: AuthorizationPermissionMismatch

      Content:
      ?<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:bb46c0f5-101e-0069-7ea9-831293000000
Time:2024-03-31T20:27:18.1148480Z</Message></Error>

Apparently there is something preventing the authentication to Azure from completing, I followed this documentation:

https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/local-development-service-principal?tabs=azure-portal%2Cwindows%2Ccommand-line

https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication/local-development-dev-accounts?tabs=azure-portal%2Csign-in-visual-studio%2Ccommand-line