SAS download returns 403

[danjohnso]

SAS download returns 403

[EmmaZhu]

Hi @danjohnso ,

The URL you generated by Azure Storage Explorer seems generated by storage key credential instead of OAuth. It doesn't include delegation SAS required query values.

[blueww]

@danjohnso

Thanks for reporting this issue!
From the debug log, the error is signature calculated from Azurite code is not aligned with the signature in the SAS.

I can repro it.
I have looked into the stringToSign of Azurite and the one on real Azure server, they have same structure (except account name). The delegation key is also correct per my testing.
Not sure why the signature not match.

I will need more time to debug into SDK code to see what's the real stringTosign SDK use. And compare it with Azurite Code generated one.

[blueww]

@EmmaZhu

Could you please help to look at the user delegation SAS failure?
Thanks!

[EmmaZhu]

Hi @danjohnso

Could you share how you get the _blobServiceClient instance? Service side token credentials may not work for Azurite.

[danjohnso]

_blobServiceClient = new BlobServiceClient(_options.ServiceUri, new DefaultAzureCredential());

ServiceUri is "https://127.0.0.1:10000/devstoreaccount1/" for Azurite, real connection is "https://ACCOUNT_NAME.blob.core.windows.net/"

[danjohnso]

Did a little more testing, maybe this is an issue with the SDK....
If I use Azure Storage Explorer, I can generate the token and it works. This is the example generated url:

https://127.0.0.1:10000/devstoreaccount1/0cd6b12f-2c13-4953-9b13-33fa412d9733/test2.png?sv=2018-03-28&st=2024-06-12T14%3A54%3A49Z&se=2024-06-13T14%3A54%3A49Z&sr=b&sp=r&sig=LXc787p4kHXJ8sw%2FaBblbHRLCA38Brw%2BFBDu9rqcLm8%3D

I notice there are less querystring params in this generated URL as compared to the SDK generated one.