Azure File Storage SAS token - error 403

Question

I am trying to implement Shared Access Signature (SAS) for Azure File Storage operations using the Storage Library client in .NET. I have created a storage account, and have created a File Share through the portal (ARM model). Using the below code, I generate the SAS token, and the URL.

StorageCredentials sCred = new StorageCredentials("mystorageaccountname", "lhxxxxxxxxxxxxxxxxxxxxxxxxxxx-my key -xxxxxxxxxxxxxxx");
CloudFileClient cfc = new CloudFileClient(new Uri(@"https://myfileserviceendpoint.file.core.windows.net/"),sCred);

SharedAccessFilePolicy sasPolicy = new SharedAccessFilePolicy()
{
    Permissions = SharedAccessFilePermissions.Read | SharedAccessFilePermissions.Write | SharedAccessFilePermissions.Create,
    SharedAccessExpiryTime = DateTime.UtcNow.AddDays(1)
};

CloudFileShare fs = cfc.GetShareReference("samplefileshare");

if(fs.Exists())
{
    _strToken = @"https://myfileserviceendpoint.file.core.windows.net/" + fs.GetSharedAccessSignature(sasPolicy);                
}

After this, I am trying to access the File Share from another application and iterate through the list of files and directories by using the token generated above. The code is shown below:

CloudFileShare fs = new CloudFileShare(new Uri(_strToken)); //_strToken generated above
CloudFileDirectory cfd = fs.GetRootDirectoryReference();
foreach(var item in cfd.ListFilesAndDirectories())
{
    //process item     
}

However, I get the below error:

Microsoft.WindowsAzure.Storage.StorageException: 'The remote server returned an error: (403) Forbidden.'

I get this error on the line "foreach(var item in cfd.ListFilesAndDirectories())".

Any pointers will be highly appreciated.

Answer 1

I believe there are two problems:

1. Your shared access signature is missing List permission. In order to list files/directories in a share, the SAS must have List permission.

2. Your _strToken variable does not have the share name. It should be:

   _strToken = @" https://myfileserviceendpoint.file.core.windows.net/samplefileshare " + fs.GetSharedAccessSignature(sasPolicy);