使用Node.js托管身份无法在Azure文件共享中创建目录

我通过托管身份（Managed Identity）在Azure存储账户中管理资源，已成功创建文件共享，但创建该共享内的目录时报错。运行Node.js脚本的VM已启用身份，且配置了对应权限。

错误信息 #

RestError: An HTTP header that's mandatory for this request is not specified.
RequestId:[REDACTED]
Time:2024-12-31T07:42:57.4819576Z
{
  "name": "RestError",
  "code": "MissingRequiredHeader",
  "statusCode": 400,
  "details": {
    "errorCode": "MissingRequiredHeader",
    "content-length": "305",
    "content-type": "application/xml",
    "server": "Windows-Azure-File/1.0 Microsoft-HTTPAPI/2.0",
    "x-ms-request-id": "[REDACTED]",
    "x-ms-client-request-id": "[REDACTED]",
    "x-ms-version": "2025-01-05",
    "date": "Tue, 31 Dec 2024 07:42:56 GMT",
    "message": "An HTTP header that's mandatory for this request is not specified.\nRequestId:[REDACTED]\nTime:2024-12-31T07:42:57.4819576Z",
    "code": "MissingRequiredHeader",
    "HeaderName": "x-ms-file-request-intent"
  },
  "request": {
    "url": "https://[STORAGE-ACCOUNT].file.core.windows.net/[FILE-SHARE]/[DIRECTORY]?restype=REDACTED",
    "headers": {
      "x-ms-version": "REDACTED",
      "accept": "application/xml",
      "x-ms-file-permission": "REDACTED",
      "x-ms-file-attributes": "REDACTED",
      "x-ms-file-creation-time": "REDACTED",
      "x-ms-file-last-write-time": "REDACTED",
      "user-agent": "azsdk-js-azure-storage-blob/12.26.0 core-rest-pipeline/1.18.1 Node/20.5.1 OS/(x64-Linux-6.5.0-1025-azure)",
      "x-ms-client-request-id": "[REDACTED]",
      "authorization": "REDACTED"
    },
    "method": "PUT"
  }
}

使用的Node.js代码 #

const { DefaultAzureCredential } = require("@azure/identity");
const { ShareServiceClient } = require("@azure/storage-file-share");

const storageAccountName = "[STORAGE-ACCOUNT]";
const fileShareName = "[FILE-SHARE]";
const directoryName = "[DIRECTORY]";

const credential = new DefaultAzureCredential();

async function main() {
    const serviceClient = new ShareServiceClient(
        `https://${storageAccountName}.file.core.windows.net`,
        credential
    );

    const shareClient = serviceClient.getShareClient(fileShareName);
    const directoryClient = shareClient.getDirectoryClient(directoryName);
    await directoryClient.create();
    console.log(`Directory '${directoryName}' created successfully in file share '${fileShareName}'.`);
}

main().catch((error) => {
    console.error("Error creating directory:", error);
});

解决方法 #

从错误信息可以明确，请求缺失了x-ms-file-request-intent头，这是Azure Files通过Azure AD身份验证操作时的必填请求头。以下是具体排查和修复步骤：

• 更新SDK版本：旧版的@azure/storage-file-share可能不会自动注入这个必填头。执行命令更新到最新稳定版：

  npm update @azure/storage-file-share
  

• 手动注入请求头：如果更新SDK后问题仍存在，可以通过自定义管道策略手动添加该请求头，修改后的代码如下：

  const { DefaultAzureCredential } = require("@azure/identity");
  const { ShareServiceClient, newPipeline } = require("@azure/storage-file-share");
  
  const storageAccountName = "[STORAGE-ACCOUNT]";
  const fileShareName = "[FILE-SHARE]";
  const directoryName = "[DIRECTORY]";
  
  const credential = new DefaultAzureCredential();
  
  // 创建自定义管道并添加请求头注入策略
  const pipeline = newPipeline(credential);
  pipeline.factories.unshift({
    create(nextPolicy) {
      return {
        async sendRequest(request) {
          request.headers.set("x-ms-file-request-intent", "file");
          return nextPolicy.sendRequest(request);
        }
      };
    }
  });
  
  async function main() {
      const serviceClient = new ShareServiceClient(
          `https://${storageAccountName}.file.core.windows.net`,
          pipeline
      );
  
      const shareClient = serviceClient.getShareClient(fileShareName);
      const directoryClient = shareClient.getDirectoryClient(directoryName);
      await directoryClient.create();
      console.log(`Directory '${directoryName}' created successfully in file share '${fileShareName}'.`);
  }
  
  main().catch((error) => {
      console.error("Error creating directory:", error);
  });
  

• 验证权限配置：确认托管身份已被分配Storage File Data Contributor角色，而非仅Storage Contributor。前者才具备文件共享层级的读写操作权限，后者仅能管理存储账户级别的资源。

内容的提问来源于stack exchange，提问作者rajath n