使用最新的 azure 版本生成 SAS uri 时出错

Question

this.container = new BlobContainerClient(new Uri(connectionString), new DefaultAzureCredential());
BlobServiceClient blobServiceClient =  this.container.GetParentBlobServiceClient();

Azure.Storage.Blobs.Models.UserDelegationKey userDelegationKey = blobServiceClient.GetUserDelegationKey(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(1));

foreach (DataRow row in dt.Rows)
{                   
    string path = folderName + "/" + row.ItemArray[7] + "/" + row.ItemArray[0] + ".png";
    BlobClient blobClient = this.container.GetBlobClient(path);
    bool isexists = blobClient.Exists();

    if(isexists)
    {
        BlobSasBuilder sasBuilder = new BlobSasBuilder()
        {
            BlobContainerName = blobClient.BlobContainerName,
            BlobName = blobClient.Name,
            Resource = "b",
            StartsOn = DateTimeOffset.UtcNow,
            ExpiresOn = DateTimeOffset.UtcNow.AddDays(1)
        };
        
        // Specify read and write permissions for the SAS.
        sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
        
        // Add the SAS token to the blob URI.
        BlobUriBuilder blobUriBuilder = new BlobUriBuilder(blobClient.Uri)
        {
            // Specify the user delegation key.
            Sas = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName)
        };
    }
}
    

我需要为每个 blob 生成 SAS uri，但在 GetUserDelegationKey 上出现授权不匹配错误是否有任何丢失的访问权限或我需要做的任何其他事情。

Answer 1

我尝试在我的环境中重现并得到以下结果：

Authorisation mismatch error:

• 检查您的SAS权限是否尝试使用仅允许读取的 SAS 执行写入操作。
• 检查您的RBAC权限 是否在用户对 object 没有必要的 RBAC 权限时尝试执行写操作。

还要检查storage blob contributor role中的访问控制 (IAM)

代码：

using Azure.Identity;
using Azure.Storage;
using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using Azure.Storage.Blobs.Specialized;
using Azure.Storage.Sas;
namespace SAStoken
{
    class Program
    {
        private static void Main()
        {
            var storageAccountUriString = $"https://storage1326.blob.core.windows.net";
            var credential = new DefaultAzureCredential();

            var blobServiceClient = new BlobServiceClient(new Uri(storageAccountUriString), credential);

            var userDelegationKey = blobServiceClient.GetUserDelegationKey(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(1));


            var blobContainerClient = blobServiceClient.GetBlobContainerClient("container1");  //container name
            var blobClient = blobContainerClient.GetBlobClient("folder1"); // my image blob name

            var sasBuilder = new BlobSasBuilder()
            {
                BlobContainerName = blobClient.BlobContainerName,
                BlobName = blobClient.Name,
                Resource = "b", // b for blob, c for container
                StartsOn = DateTimeOffset.UtcNow,
                ExpiresOn = DateTimeOffset.UtcNow.AddHours(4),
            };


            sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write); // read  write permissions

            BlobUriBuilder blobUriBuilder = new BlobUriBuilder(blobClient.Uri)
            {
                // Specify the user delegation key.
                Sas = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName)
            };

            Console.WriteLine("Blob user delegation SAS URI: {0}", blobUriBuilder);
        }
         
    }
}

安慰：

Output：

参考： 创建用户委托 SAS - Azure 存储 | 微软学习