适用于Java的Azure SDK如何设置用户委派密钥和共享身份验证签名SAS

问题描述

以下代码在最后一行引发异常：

            // Create a BlobServiceClient object which will be used to create a container client
            System.out.println(String.format("Connection String %s",connectStr));
            blobServiceClient = new BlobServiceClientBuilder().connectionString(connectStr).buildClient();

            // Get a user delegation key for the Blob service that's valid for seven days.
            // You can use the key to generate any number of shared access signatures over the lifetime of the key.
            keyStart = OffsetDateTime.Now();
            keyExpiry = OffsetDateTime.Now().plusHours(7);
 error ->   userDelegationKey = blobServiceClient.getUserDelegationKey(keyStart,keyExpiry);

例外： </Message><AuthenticationErrorDetail>Only authentication scheme Bearer is supported</AuthenticationErrorDetail></Error>"

Caused by: com.azure.storage.blob.models.BlobStorageException: Status code 403,"<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server Failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:d375b3bf-b01e-0044-1191-9c75a8000000

我试图将.NET教程改编成Java，但到目前为止还没有运气。

似乎此错误与REST API调用有关，有什么主意吗？

解决方法

因此，在多次尝试之后，无法使用存储帐户的连接字符串来使用用户委托密钥。我必须注册一个应用程序并添加新的应用程序环境变量。最后，在IAM仪表板中检查正确的权限。

就我而言，我在Azure中使用Azure，

1. 仅添加了以下依赖项：

        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-storage-blob</artifactId>
            <version>12.8.0</version>
        </dependency>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-identity</artifactId>
            <version>1.1.2</version>
        </dependency>

1. 在Azure上创建/注册应用
2. 使用证书和机密创建应用程序的客户端机密。
3. 在环境变量中存储应用程序-客户端ID，租户ID和客户端密钥 即在macOS上：

export AZURE_CLIENT_ID="xxxxxxx"
launchctl setenv AZURE_CLIENT_ID $AZURE_CLIENT_ID

export AZURE_TENANT_ID="xxxxxxx"
launchctl setenv AZURE_TENANT_ID $AZURE_TENANT_ID 

export AZURE_CLIENT_SECRET="xxxxxxx"
launchctl setenv AZURE_CLIENT_SECRET $AZURE_CLIENT_SECRET

1. 为存储帐户的用户和应用添加Storage Blob Data Contributor的正确角色分配。 see this

2. 现在可以使用以下代码生成用户委托密钥和示例容器SAS：

String endpoint = String.format(Locale.ROOT,"https://%s.blob.core.windows.net","accountName");

// Create a BlobServiceClient object which will be used to create a container client
blobServiceClient = new BlobServiceClientBuilder().endpoint(endpoint)
        .credential(new DefaultAzureCredentialBuilder().build()).buildClient();

// Get a user delegation key for the Blob service that's valid for seven days.
// You can use the key to generate any number of shared access signatures over the lifetime of the key.
keyStart = OffsetDateTime.now();
keyExpiry = OffsetDateTime.now().plusDays(7);
userDelegationKey = blobServiceClient.getUserDelegationKey(keyStart,keyExpiry);

BlobContainerSasPermission blobContainerSas = new BlobContainerSasPermission();
blobContainerSas.setReadPermission(true);
BlobServiceSasSignatureValues blobServiceSasSignatureValues = new BlobServiceSasSignatureValues(keyExpiry,blobContainerSas);
BlobContainerClient blobContainerClient = blobServiceClient.getBlobContainerClient("containerName");
if (!blobContainerClient.exists())
    blobContainerClient.create();

String sas = blobContainerClient
        .generateUserDelegationSas(blobServiceSasSignatureValues,userDelegationKey);

希望这对其他人有帮助！