dvc: Azure OAuth failure
Bug Report
Description
When using OAuth authentication to connect to Azure with DVC and executing push/pull operations the following error is returned:
ERROR: unexpected error - Cannot combine AUTHORIZATION header with AUTH argument or credentials encoded in URL
This behaviour has been reported in a similar case: https://github.com/iterative/dvc/issues/5589, but the error we receive is a new one. We are currently following Iterative’s guide for configuring DVC<>Azure: https://iterative.ai/blog/azure-remotes-in-dvc
When trying any of the suggested workarounds we still receive the same error. It is possible we are doing something wrong or our Azure accounts config is not right, but in that case it would be helpful to have a different error message or update the guide 😃
Related links we found around: https://github.com/iterative/dvc/issues/2200 https://github.com/iterative/dvc.org/issues/462 https://github.com/Azure/azure-sdk-for-python/issues/18012
Reproduce
0. brew update && brew install azure-cli
1. dvc init
2. dvc remote add -d storage azure://RESOURCE/FOLDER
3. az login
4. dvc remote modify storage account_name 'USERNAME'
5. dvc add data/.
6. dvc push
If doing pull from an already uploaded DVC repo on Azure, we get the same error message:
ERROR: unexpected error - Cannot combine AUTHORIZATION header with AUTH argument or credentials encoded in URL
Expected
Files on data folder to be uploaded to Azure.
We are currently able to work fine (push and pull) with token authentication using AZURE_STORAGE_KEY, but this is a temporary solution for us and would like to move to full OAuth.
Environment information
Output of dvc doctor:
$ dvc doctor
DVC version: 2.29.0 (pip)
---------------------------------
Platform: Python 3.10.7 on macOS-12.5.1-arm64-arm-64bit
Subprojects:
dvc_data = 0.14.0
dvc_objects = 0.5.0
dvc_render = 0.0.11
dvc_task = 0.1.3
dvclive = 0.11.0
scmrepo = 0.1.1
Supports:
azure (adlfs = 2022.10.0, knack = 0.10.0, azure-identity = 1.11.0),
http (aiohttp = 3.8.3, aiohttp-retry = 2.8.3),
https (aiohttp = 3.8.3, aiohttp-retry = 2.8.3)
Cache types: reflink, hardlink, symlink
Cache directory: apfs on /dev/disk3s8s1
Caches: local
Remotes: azure
Workspace directory: apfs on /dev/disk3s8s1
Repo: dvc
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Reactions: 1
- Comments: 18 (13 by maintainers)
Commits related to this issue
- _prepare_credentials: don't take version_aware as an auth option Fixes https://github.com/iterative/dvc/issues/9833 — committed to efiop/dvc-azure by efiop a year ago
- _prepare_credentials: don't take version_aware as an auth option Fixes https://github.com/iterative/dvc/issues/9833 — committed to iterative/dvc-azure by efiop a year ago
Hi @efiop, this seems to have resolved the issue for me. I appreciate the quick turnaround!
@ctafabiano @smarais Hey folks, could you please upgrade
dvc-azurepackage withpip install -U dvc-azure(make sure it is 2.22.1) and see if that fixes it for you?Turns out there was a bug in
dvc-azure, where we accidentally madeadlfsdefault to anon login whenversion_awarewas enabled.🤦 You are right @efiop. Thanks for looking into it! I can confirm that reinstalling azure-cli in my virtual env fixes it. Let’s close it then.
Transferred to dvc for more visibility and since it directly impacts dvc usage.
@efiop I’m not sure if it’s a regression or I tested something differently when we closed this, but I can reproduce the issue with
version_awareremotes.Same issue for me. @dberenbaum I did the comparison, using version-aware will trigger the error, not using it will work fine.
edit : confirmed on both windows and Ubuntu
Hi @efiop , I’m seeing a similar issue to this.
Notes:
Storage Blob Data Contributorset in my Azure IAMaz storage blob upload --file hello.txt --account-name mldatastephenmarais --container-name datasets --name myblobupload --auth-mode loginworks finedvc pushworks fine when setting the connection string but I’m trying to avoid this.These are the exact steps that reproduce my issue (running on Ubuntu 20.04).
This is the error:
az --versiongives@dberenbaum Definitely worth documenting in azure and probably troubleshooting sections. Created https://github.com/iterative/dvc.org/issues/4652 for now
Another user ran into this: https://discord.com/channels/485586884165107732/485596304961962003/1106179670799552584
Coming from https://github.com/iterative/dvc-azure/issues/43#issuecomment-1487307936, I see a similar issue but only for
version_awareremotes. If I don’t setaccount_keyorconnection_string, I get an error.I have a config like this:
Here’s the
dvc pushoutput: