如何生成要在我的JavaScript文件中使用的Azure表授权令牌

Question

I want to make calls to my Azure storage table from my Javascript file.

Requirements - 1. no time expiration in the key. 2. Only read access

I don't want a SAS token because it is time based, so I need to generate a access key or something I can pass into the JS API with this limited read only access.

But working within my Azure dashboard, I can't seem to figure it out. Under my tables, I can see my access keys and connection strings. I can also generate a access policy for my table with just read permission.

Not sure how to combine the two...

Answer 1

If the solution need to meet the two requirements, I think it is impossible to do that.

The access policy just provides an additional level of control over service-level SAS on the server side and it is also time based, it will expiry.

If your case is for Blob and Queue storage, you can use RBAC to meet your requirements, register an AD App, add it as a Reader role in the Access Control (IAM) of the container or queue, and generate the access token with the AD App. Even so, the access token will also expiry, but the permission of the AD App to the Blob or Queue will not expiry, you just need to generate the token again with your code when necessary. If you want to absolute permanent, I think you could just use storage key nowadays.

For the Table storage, the RBAC is not supported currently, I found a feedback here , you could vote it. May be it will be supported in the future, until then, you could refer to the steps above, the logic should be similar.

Edit :

The above answer is for the requirement of absolute permanent ( no time expiration in the key as you said), if you can accept the very far expiry time , like @Jerry mentioned, just specific the expiry time of a far time, like 3000-11-13, I think it will work fine.