Server failed to authenticate the request. Please refer to the information in the www-authenticate header

Hi @Alex Sanchez,

The error message you are "Server failed to authenticate the request," along with the detail "OId is missing," indicates that the authentication information being sent to the Blob Storage is either incomplete or incorrect.

When using a service principal for authentication, please make sure you have set up the necessary environment variables correctly and that the service principal has the right permissions to access the Blob Storage. Specifically, check that you are using the correct application ID, tenant ID, and client secret or certificate.

Also, when using Rclone, please ensure that the configuration file contains all necessary fields and that the service principal's application is correctly registered in Azure Active Directory with the required roles assigned for Blob Storage access.

Please refer the below documentation for additional information:

• Authorize access to blobs and files with AzCopy and Microsoft Entra ID

I hope the above helps in addressing your query.

Please let us know in the comments below, if the issue is resolved or still persists. We will be glad to assist you closely.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members. Accepted answers show up at the top, resulting in improved discoverability for others.

What could be the right env variables? And I already have set up the role assignment with the service principal I created, so idk why is not working

Hi @Alex Sanchez,

Please set the below environment variables to authenticate perfectly for a service principal:

• AZURE_TENANT_ID: The tenant (or directory) ID of your Azure Active Directory.
• AZURE_CLIENT_ID: The client ID of your service principal.
• AZURE_CLIENT_SECRET: The client secret associated with your service principal.

You should set the following variables:

export AZCOPY_AUTO_LOGIN_TYPE=SPN
export AZCOPY_SPA_APPLICATION_ID=<application-id>
export AZCOPY_SPA_CLIENT_SECRET=<client-secret>
export AZCOPY_TENANT_ID=<tenant-id>

Replace <application-id>, <client-secret>, and <tenant-id> with the appropriate values from your service principal's app registration. Additionally, if you are using a user-assigned managed identity, you should also set:

export AZCOPY_MSI_CLIENT_ID=<client-id>
export AZCOPY_MSI_OBJECT_ID=<object-id>

Please ensure to check again that these variables are properly set in your environment. As you send that you have already said that you have assigned role to the service principal. Please make sure that he service principal must have the necessary role (e.g., "Storage Blob Data Contributor") assigned at the appropriate scope (e.g., the storage account or container level). If the roles are assigned correctly and the environment variables are set properly, you should be able to authenticate without any issues.

I hope by following the above helps in resolving the issue.

For more additional information, please refer the below document:

• Authorize access to blobs and files with AzCopy and Microsoft Entra ID

Unfortunately, if the issue still persists. Please do provide with error message along with the screenshot which helps to assist you better.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

But, I am not using azcopy, what I am using is rclone, so I assume the env variables are not the same for this purpose

@Alex Sanchez,

The specific environment variables for Rclone may differ from AzCopy. In this case, generally, you need to make sure that to follow variables are set correctly, variables such as Client ID, Client Secret and Tenant ID.

Make sure that these values are correctly configured in your Rclone configuration file or as environment variables.

Though, if you are still facing the issue. Please check the Rclone documentation for Azure Blob Storage to ensure that all required settings are correctly configured.