Azure / doAzureParallel

A R package that allows users to submit parallel workloads in Azure
MIT License
107 stars 50 forks source link

Error using setCredentials for existing batch account and service principal #346

Closed angusrtaylor closed 5 years ago

angusrtaylor commented 5 years ago

I want to use an existing batch account and service principal with doAzureParallel (i.e. not created using the startup script). I created my resource group, storage account, batch account and service principal app using the Azure CLI. I put the credentials into a credentials.json and the called setCredentials() but I get the following error from rAzureBatch:

> doAzureParallel::setCredentials("azure/credentials.json") -> GET /subscriptions/<subscription>/resourceGroups/antabsr/providers/Microsoft.Batch/batchAccounts/bsrbs?api-version=2017-05-01 HTTP/1.1 -> Host: management.azure.com -> User-Agent: libcurl/7.47.0 r-curl/3.2 httr/1.3.1 -> Accept-Encoding: gzip, deflate -> Accept: application/json, text/xml, application/xml, */* -> Authorization: Bearer -> Content-type: application/json -> <- HTTP/1.1 401 Unauthorized <- Cache-Control: no-cache <- Pragma: no-cache <- Content-Type: application/json; charset=utf-8 <- Expires: -1 <- WWW-Authenticate: Bearer authorization_uri="https://login.windows.net/<servicePrincipalId>", error="invalid_token", error_description="The authorization header is missing access token." <- x-ms-failure-cause: gateway <- x-ms-request-id: c58aa0d8-74d2-4c5f-af7a-b4dfd4413993 <- x-ms-correlation-request-id: c58aa0d8-74d2-4c5f-af7a-b4dfd4413993 <- x-ms-routing-request-id: NORTHEUROPE:20190211T165645Z:c58aa0d8-74d2-4c5f-af7a-b4dfd4413993 <- Strict-Transport-Security: max-age=31536000; includeSubDomains <- X-Content-Type-Options: nosniff <- Date: Mon, 11 Feb 2019 16:56:45 GMT <- Connection: close <- Content-Length: 144 <- Error in rAzureBatch::getBatchAccount(batchAccount = info$account, resourceGroup = info$resourceGroup, : Unauthorized (HTTP 401).

For some reason the authorization header is missing the access token. But I don't understand why my service principal can't retrieve this token. I checked the Access control (IAM) pane in the batch account and my service principal is listed as having Contributor role for the resource group. Can you see what I'm doing wrong? I'm wondering whether there is a step performed by the setup script that I am missing? Thanks

angusrtaylor commented 5 years ago

Closing as I have now got this to work

brnleehng commented 5 years ago

Hi @angusrtaylor

What was the issue?

Thanks, Brian

angusrtaylor commented 5 years ago

I'm not sure what the problem was. I may have mixed up the credentials. I started fresh and it worked the second time. Thanks