How to connect to a Blob Container using a SAS Token?

Question

. 。 Answers to this question are eligible for a +50 reputation bounty. Bounty grace period ends in 1 hour . bleze wants to to this question. 。

Using this SDK; https://github.com/Azure/azure-storage-cpp , I able to use SAS Tokens connecting to storage accounts, but not blob containers. No matter what I try, I cannot get it to work. The token works fine in Storage Explorer.

My guess is that I have to specify the container name somewhere, but I cannot find anything in documentation or any examples.

Test code where Account Name is 'cp' and Container is 'spool';

Obfuscated SAS Token; https://cp.blob.core.windows.net/spool?sp=racwdl&st=2022-06-20T08%3A49%3A39Z&se=2022-06-27T16%3A49%3A39Z&spr=https&sv=2021-06-08&sr=c&sig=... .

azure::storage::cloud_storage_account storage_account;
auto storage_credentials = azure::storage::storage_credentials(L"cp", azure::storage::storage_credentials::sas_credential(L"?sp=racwdl&st=2022-06-20T08%3A49%3A39Z&se=2022-06-27T16%3A49%3A39Z&spr=https&sv=2021-06-08&sr=c&sig=...."));
if (storage_credentials.is_sas() == true)
{
    azure::storage::storage_uri blob_endpoint(web::http::uri(U("https://cp.blob.core.windows.net/spool"))); // here I change endpoint to add the container name
    storage_account = azure::storage::cloud_storage_account(storage_credentials, blob_endpoint, azure::storage::storage_uri(), azure::storage::storage_uri(), azure::storage::storage_uri());
}

if (storage_account.is_initialized() == true)
{
    azure::storage::cloud_blob_client blob_client = storage_account.create_cloud_blob_client();
    blob_client.get_root_container_reference(); // <- exception
}

Probably something silly, but I cannot seem to find the right parameters for a valid connection, so any pointers would be appreciated. Equivalent to 'Attach to an individual Blob container' and 'SAS URL'.

Depending on what I try, I'm getting exceptions like;

1. The requested URI does not represent any resource on the server.
2. This request is not authorized to perform this operation.
3. Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

PS. I know there is a newer SDK, but this is just another connection type I'm adding to existing code, so rewrite is not on the table for now.

Answer 1

Turns out that you can access the container and list blobs+dirs, but you cannot check if the container exists without getting exception. I never thought to just try this since my existing code was using exists to be sure user had selected a proper container