使用 php 的 Azure 共享访问签名错误

Question

I'm using SAS to trying to download a blob from a Private Azure Storage container, using php. But ALWAYS it throws me the same mistake.

<Error>
<Code>AuthenticationFailed</Code>
<Message>
Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. ...
</Message>
<AuthenticationErrorDetail>
Signature did not match. String to sign used ... /blob/name/container/archive.jpg
</AuthenticationErrorDetail>
</Error>

This is my code:

static private function getSASForBlob($accountName,$containerName, $fileName, $resourceType, $permissions, $expiry) {
     /* Create the signature */         

        $_arraysign = array();
        $_arraysign[] = $permissions;
        $_arraysign[] = '';
        $_arraysign[] = $expiry;
        $_arraysign[] = $accountName . '/' . $containerName . '/' . $fileName;
        $_arraysign[] = '';
        $_arraysign[] = "2015-04-05"; //the API version is now required
        $_arraysign[] = '';
        $_arraysign[] = '';
        $_arraysign[] = '';
        $_arraysign[] = '';
        $_arraysign[] = '';

        $_str2sign = implode("\n", $_arraysign);

        return base64_encode(
        hash_hmac('sha256', urldecode(utf8_encode($_str2sign)), base64_decode($key), true)
    );
    }
    static public function getBlobDownloadUrl($container,$blob,$accountName,$key){
 /* Create the signed query part */         
        $resourceType='b';
        $permissions='r';
        /*$expTime_utc = new DateTime(null, new DateTimeZone("UTC"));
        $expTime_utc->add(new DateInterval('PT1H'));
        $expiry=$expTime_utc->format('Y-m-d\TH:i:s\Z');*/
        $expiry = date('Y-m-d\TH:i:s\Z', strtotime('+1 day'));
        $_signature=AzureServices::getSASForBlob($accountName,$key,$container, $blob, $resourceType, $permissions, $expiry);
        $_parts = array();
        $_parts[] = (!empty($expiry))?'se=' . urlencode($expiry):'';
        $_parts[] = 'sr=' . $resourceType;
        $_parts[] = (!empty($permissions))?'sp=' . $permissions:'';
        $_parts[] = 'sig=' . urlencode($_signature);
        $_parts[] = "sv=2015-04-05";

        /* Create the signed blob URL */
        $_url = 'https://'
        .$accountName.'.blob.core.windows.net/'
        . $container . '/'
        . $blob . '?'
        . implode('&', $_parts);

        return $_url;
    }

I have tried changing the date to DateTime following the same structure, adding and deleting an "/" to the line "$_arraysign[] = $accountName . '/' . $containerName . '/' . $fileName" ... But nothing happened, the same error message is showed... Please help me. Thanks

Answer 1

As you are using the signedversion in 2015-04-05 , so beside @Gaurav Mantri's answer, there is one more point you need to be attention to, is that, according the description under section Constructing the Signature String in https://msdn.microsoft.com/en-us/library/azure/dn140255.aspx :

Version 2015-04-05 adds support for the signed IP and signed protocol fields. These must be included in the string-to-sign. To construct the string-to-sign for Blob or File service resources, use the following format:

StringToSign = signedpermissions + "\n" +
           signedstart + "\n" +
           signedexpiry + "\n" +
           canonicalizedresource + "\n" +
           signedidentifier + "\n" +
           signedIP + "\n" +
           signedProtocol + "\n" +
           signedversion + "\n" +
           rscc + "\n" +
           rscd + "\n" +
           rsce + "\n" +
           rscl + "\n" +
           rsct

So we need to modify the $_arraysign in function getSASForBlob to something like：

$_arraysign = array();
$_arraysign[] = $permissions;
$_arraysign[] = '';
$_arraysign[] = $expiry;
$_arraysign[] = '/blob/' . $accountName . '/' . $container . '/' . $blob;
$_arraysign[] = '';
$_arraysign[] = '';
$_arraysign[] = '';
$_arraysign[] = "2015-04-05"; //the API version is now required
$_arraysign[] = '';
$_arraysign[] = '';
$_arraysign[] = '';
$_arraysign[] = '';
$_arraysign[] = '';

Any further concern, please feel free to let me know.

Answer 2

Please prepend /blob/ in this line of code:

$_arraysign[] = $accountName . '/' . $containerName . '/' . $fileName;

So, it should be:

$_arraysign[] = '/blob/' . $accountName . '/' . $containerName . '/' . $fileName;

From this page: https://msdn.microsoft.com/en-us/library/azure/dn140255.aspx

The canonicalizedresouce portion of the string is a canonical path to the signed resource. It must include the service name (blob, table, queue or file) for version 2015-02-21 or later, the storage account name, and the resource name, and must be URL-decoded . Names of blobs must include the blob's container. Table names must be lower-case. The following examples show how to construct the canonicalizedresource portion of the string, depending on the type of resource.