A customer of mine recently approached me for assistance to help resolve an Authorization error he was receiving , when he was running a custom prepared automation script in C# that would pause and restart the SQL data warehouse.
To save costs, you can pause and resume compute resources on-demand. He had tried the instructions provided here https://azure.microsoft.com/en-in/documentation/articles/sql-data-warehouse-manage-compute-rest-api/
The URL created looked like this:
https://management.azure.com/subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.Sql/servers/<servername>.database.windows.net/databases/<dbname>/pause?api-version=2014-04-01-preview+HTTP%2F1.1
It asked for an Authorization option and he provided the Authorization by following the link.
After getting the Authorization key, when he executed the REST API to pause the SQL database from REST client It gave the following error
Steps to resolution:
A simple way of testing whether the REST API calls are working is by using POSTMAN client which is an add-on to Google chrome browser. It is an intuitive user interface that would make testing APIs effortless
My colleague Suhas recently blogged about using Testing Azure REST API using POSTMAN Client – The steps and the screenshots to setup the environment to test the Azure REST API using POSTMAN Client is described very well in his blog https://blogs.msdn.microsoft.com/suhaspv/2016/11/22/geo-replication-fail-over-testing-using-rest-api/
I decided to give this a shot to save time for testing!
I was able to test the scenario out using the client (Postman app) and was able to pause and unpause my Azure SQL DW successfully by altering the REST API to our scenario
I used the REST API from the following: https://azure.microsoft.com/en-in/documentation/articles/sql-data-warehouse-manage-compute-rest-api/
Rest API calls used:
Note: I did not use the api-version=2014-04-01-preview HTTP/1.1 as mentioned in the above article as I was getting an error with it. So you may want to try with both to be sure.
However my customer was still receiving an error like the below when he tried attempt to generate a Request Token in Postman even though he provided a Manage Service API Access
Additional technical information:
Correlation ID: 6e4eda78-e520-496e-b897-0a397d46b325
Timestamp: 2016-08-01 14:03:44Z
TESTAPP90093: This application requires application permissions to another application. Consent for application permissions can only be performed by an administrator. Sign out and sign in as an administrator or contact one of your organization’s administrators.
This error message here was more descriptive than the earlier authorization error and gave us a clear idea that we were missing some admin access.
++ We found that the customer was a Co-Admin on the subscription but was still giving us this error
We figured that – A subscription co-administrator does not automatically make you an Azure AD administrator and You’d need explicit role grant on the target Azure AD.
Once the customer was granted Global Administrator in the Azure AD domain he was able to generate the token without the error
After this we were able to successfully Pause/Resume the Azure SQL DW using the calls above.
More info on different AD roles: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign-admin-roles
Now that we had it working with the Postman Client the customer was able to use the REST API calls above in his automation script in C#:
OAuth 2.0 is what we need which is explained in below article https://azure.microsoft.com/en-us/documentation/articles/resource-manager-api-authentication/#connect-subscription-to-application
Hope this helps! J