.Net: Bug: System.ClientModel.ClientResultException: 'HTTP 401 (PermissionDenied) Principal does not have access to API/Operation.' when running VectorStoreRAG.csproj

[radrad]

Semanatic kernel version: "1.32.0.0"

Z:\semantic-kernel\dotnet\src\Connectors\Connectors.OpenAI\Core\ClientCore.cs

Microsoft.SemanticKernel.Connectors.OpenAI.ClientCore.RunRequestAsync(System.Func<System.Threading.Tasks.Task>) in ClientCore.cs

Error: return await request.Invoke().ConfigureAwait(false);

{"HTTP 401 (PermissionDenied)\r\n\r\nPrincipal does not have access to API/Operation."} | System.ClientModel.ClientResultException

This is a part of header for post message I managed to see.
I don't know where it the pipeline a token is added.

{Method: POST, RequestUri: 'https://.openai.azure.com/openai/deployments//chat/completions?api-version=2024-10-01-preview', Version: 1.1, Content: System.ClientModel.Primitives.HttpClientPipelineTransport+HttpPipelineRequest+MessageBodyAdapter, Headers:
{
Accept: application/json
User-Agent: Semantic-Kernel azsdk-net-AI.OpenAI/2.1.0-beta.2 (.NET 8.0.11; Microsoft Windows 10.0.22000)
x-ms-client-request-id: 3245c4e1-4d0c-94c2-234234
Content-Type: application/json
}}

I did run az login prior to running code. Both of these don't work. Below you can see in the image assigned [Cognitive Services Contributor] and even [owner] to my azure account. So I exhausted my ideas.

    kernelBuilder.AddAzureOpenAIChatCompletion(
        appConfig.AzureOpenAIConfig.ChatDeploymentName,
        appConfig.AzureOpenAIConfig.Endpoint,
        new AzureCliCredential());

    kernelBuilder.AddAzureOpenAIChatCompletion(
        appConfig.AzureOpenAIConfig.ChatDeploymentName,
        appConfig.AzureOpenAIConfig.Endpoint,
        new DefaultAzureCredential());

When I tried using another overrinden method with appConfig.AzureOpenAIConfig.ApiKey instead it did work. But I would like to avoid using api keys.

How I am supposed to run this code?

[westey-m]

@radrad, I think the issue may be that you need the Cognitive Services OpenAI User or Cognitive Services OpenAI Contributor roles. What you have is the Cognitive Services Contributor role, note the missing OpenAI.

Also see

• https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/role-based-access-control#cognitive-services-openai-user
• https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/managed-identity#assign-role

I don't know where it the pipeline a token is added.

FYI Semantic Kernel passes the provided Credential class to the underlying Azure Open AI SDK and the token is added by it, so you will not see this the token added in the Semantic Kernel codebase.