403 error when trying to use `UserDelegationKey`

[juliusl]

403 error when trying to use `UserDelegationKey`

[blueww]

@juliusl

"getUserDelegationKey" only support Oauth (Microsoft Entra ID) authentication. This is same in both product Azure and Azurite.
However, you are trying to call it with sharedkey authentication so the failure happen, this is by design in both product Azure and Azurite.
See more details in the rest API doc and feature doc:
https://learn.microsoft.com/en-us/rest/api/storageservices/get-user-delegation-key#authorization
https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas

BTW, to enable Oauth authentication with Azurite, you need to start Azurite with https and Oauth configuration, see https://github.com/Azure/Azurite?tab=readme-ov-file#oauth-configuration
And for Oauth, Azurite will do basic authentication, like validating incoming bearer token, checking issuer, audience, expiry. But Azurite will NOT check token signature and permission.

I will close this issue as it's by design.
Feel free to contact us again if you need any further assistance on Azurite.

[juliusl]

@blueww

BTW, to enable Oauth authentication with Azurite, you need to start Azurite with https and Oauth configuration, see https://github.com/Azure/Azurite?tab=readme-ov-file#oauth-configuration
And for Oauth, Azurite will do basic authentication, like validating incoming bearer token, checking issuer, audience, expiry. But Azurite will NOT check token signature and permission.

Can you give me an example of how to create a test blob client w/ oauth instead of using the emulator connection string?

[juliusl]

I ended up w/ this, is this what you meant?

// See https://aka.ms/new-console-template for more information
using Azure.Core;
using Azure.Storage.Blobs;

Console.WriteLine("Hello, World!");


var client = new BlobServiceClient(new Uri(@"https://localhost:10000/devstoreaccount1"), new TestTokenCredentials());

var key = await client.GetUserDelegationKeyAsync(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(10));


Console.WriteLine(key);

return;

class TestTokenCredentials : TokenCredential
{
    public TestTokenCredentials()
    {
    }

    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return new AccessToken("test", DateTimeOffset.UtcNow.AddDays(1));
    }

    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return ValueTask.FromResult(new AccessToken("test", DateTimeOffset.UtcNow.AddDays(1)));
    }
}

[blueww]

I ended up w/ this, is this what you meant?

// See https://aka.ms/new-console-template for more information
using Azure.Core;
using Azure.Storage.Blobs;

Console.WriteLine("Hello, World!");


var client = new BlobServiceClient(new Uri(@"https://localhost:10000/devstoreaccount1"), new TestTokenCredentials());

var key = await client.GetUserDelegationKeyAsync(DateTimeOffset.UtcNow, DateTimeOffset.UtcNow.AddDays(10));


Console.WriteLine(key);

return;

class TestTokenCredentials : TokenCredential
{
    public TestTokenCredentials()
    {
    }

    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return new AccessToken("test", DateTimeOffset.UtcNow.AddDays(1));
    }

    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return ValueTask.FromResult(new AccessToken("test", DateTimeOffset.UtcNow.AddDays(1)));
    }
}

We are Azurite owner, but not .net SDK expert, so might not be the best person to give the usage of .net SDK.
Here's a .net SDK example for you reference.
https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-dotnet?tabs=visual-studio%2Cmanaged-identity%2Croles-azure-portal%2Csign-in-visual-studio%2Cidentity-visual-studio&pivots=blob-storage-quickstart-scratch#sign-in-and-connect-your-app-code-to-azure-using-defaultazurecredential

For your above code, it might not work with Azurite, since Azurite will do some basic validation on the token (see details). So use string like "test" as the token won't pass validation in Azurite.

And you must start Azurite with Oauth configuration to support Oauth credential.