使用最新的 azure 版本生成 SAS uri 时出错

Question

this.container = new BlobContainerClient(new Uri(connectionString), new DefaultAzureCredential());
BlobServiceClient blobServiceClient =  this.container.GetParentBlobServiceClient();

Azure.Storage.Blobs.Models.UserDelegationKey userDelegationKey = blobServiceClient.GetUserDelegationKey(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(1));

foreach (DataRow row in dt.Rows)
{                   
    string path = folderName + "/" + row.ItemArray[7] + "/" + row.ItemArray[0] + ".png";
    BlobClient blobClient = this.container.GetBlobClient(path);
    bool isexists = blobClient.Exists();

    if(isexists)
    {
        BlobSasBuilder sasBuilder = new BlobSasBuilder()
        {
            BlobContainerName = blobClient.BlobContainerName,
            BlobName = blobClient.Name,
            Resource = "b",
            StartsOn = DateTimeOffset.UtcNow,
            ExpiresOn = DateTimeOffset.UtcNow.AddDays(1)
        };
        
        // Specify read and write permissions for the SAS.
        sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
        
        // Add the SAS token to the blob URI.
        BlobUriBuilder blobUriBuilder = new BlobUriBuilder(blobClient.Uri)
        {
            // Specify the user delegation key.
            Sas = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName)
        };
    }
}
    

I need to generate SAS uri for each blob but getting Authorization Mismatch error on GetUserDelegationKey Is there any access which is missing or anything else which I need to do.

Answer 1

I tried reproduce in my environment and got below results:

Authorisation mismatch error:

• Check your SAS permission whether you are trying to do a write operation with a SAS which only permits read.
• Check your RBAC permissions Whether trying to do a write operation while user does not have necessary RBAC permissions on the object.

Also check the Access control(IAM) which is in storage blob contributor role

Code:

using Azure.Identity;
using Azure.Storage;
using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using Azure.Storage.Blobs.Specialized;
using Azure.Storage.Sas;
namespace SAStoken
{
    class Program
    {
        private static void Main()
        {
            var storageAccountUriString = $"https://storage1326.blob.core.windows.net";
            var credential = new DefaultAzureCredential();

            var blobServiceClient = new BlobServiceClient(new Uri(storageAccountUriString), credential);

            var userDelegationKey = blobServiceClient.GetUserDelegationKey(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(1));


            var blobContainerClient = blobServiceClient.GetBlobContainerClient("container1");  //container name
            var blobClient = blobContainerClient.GetBlobClient("folder1"); // my image blob name

            var sasBuilder = new BlobSasBuilder()
            {
                BlobContainerName = blobClient.BlobContainerName,
                BlobName = blobClient.Name,
                Resource = "b", // b for blob, c for container
                StartsOn = DateTimeOffset.UtcNow,
                ExpiresOn = DateTimeOffset.UtcNow.AddHours(4),
            };


            sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write); // read  write permissions

            BlobUriBuilder blobUriBuilder = new BlobUriBuilder(blobClient.Uri)
            {
                // Specify the user delegation key.
                Sas = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName)
            };

            Console.WriteLine("Blob user delegation SAS URI: {0}", blobUriBuilder);
        }
         
    }
}

Console:

Output:

Reference: Create a user delegation SAS - Azure Storage | Microsoft Learn