azure - 构建帐户 SAS(共享访问签名)

Question

我正在尝试生成帐户 SAS token : MSDN DOC

当我尝试使用生成的 token 时，我得到以下信息:

AuthenticationFailed Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:89959111-0001-00c8-24d1-e0515b000000 Time:2016-07-18T08:49:00.8383767Z Signature did not match. String to sign used was [accountName] rl b sc 2017-01-01 2015-04-05

这是我的代码:

        var signedVersion = "2015-04-05";
        var signedServices = "b";
        var signedResourceTypes = "sc";
        var signedPermission = "rl";
        var signedExpiry = "2017-01-01";

        var stringToSign =
            accountName + "\n" +
            signedPermission + "\n" +
            signedServices + "\n" +
            signedResourceTypes + "\n" +
            signedExpiry + "\n" +
            signedVersion + "\n"
            ;

        var keyBytes = Encoding.UTF8.GetBytes(accountKey);

        byte[] hash;
        using (var mac = new HMACSHA256(keyBytes))
        {
            var stringToSignBytes = Encoding.UTF8.GetBytes(stringToSign);
            hash = mac.ComputeHash(stringToSignBytes);
        }

        var str = Convert.ToBase64String(hash);
        var sig = HttpUtility.UrlEncode(str);

        var url = $"https://{accountName}.blob.core.windows.net/?comp=list&sv={signedVersion}&ss={signedServices}&srt={signedResourceTypes}&sp={signedPermission}&se={signedExpiry}&sig={sig}";

我做错了什么？

Answer 1

我注意到代码有一些问题:

首先，要将帐户 key 转换为字节数组，您需要使用 Convert.FromBase64String(accountKey) 而不是 Encoding.UTF8.GetBytes(accountKey);。

接下来，即使您没有使用开始时间、签名协议(protocol)和签名 IP 地址，您也需要将它们包含在您的 stringToSign 中。

完成这些操作后，代码就应该可以工作了。基于这些，我在下面添加了修改后的代码。我测试了它以列出我的存储帐户中的容器，并且它有效。

    static void AccountSas()
    {
        var signedVersion = "2015-04-05";
        var signedServices = "b";
        var signedResourceTypes = "sc";
        var signedPermission = "rl";
        var signedExpiry = "2017-01-01";
        var signedStart = "";
        var signedIP = "";
        var signedProtocol = "";
        var stringToSign =
            accountName + "\n" +
            signedPermission + "\n" +
            signedServices + "\n" +
            signedResourceTypes + "\n" +
            signedStart + "\n" +
            signedExpiry + "\n" +
            signedIP + "\n" +
            signedProtocol + "\n" +
            signedVersion + "\n"
            ;

        var keyBytes = Convert.FromBase64String(accountKey);

        byte[] hash;
        using (var mac = new HMACSHA256(keyBytes))
        {
            var stringToSignBytes = Encoding.UTF8.GetBytes(stringToSign);
            hash = mac.ComputeHash(stringToSignBytes);
        }

        var str = Convert.ToBase64String(hash);
        var sig = HttpUtility.UrlEncode(str);
        var url = string.Format("https://{0}.blob.core.windows.net/?comp=list&sv={1}&ss={2}&srt={3}&sp={4}&se={5}&sig={6}", accountName, signedVersion, signedServices, signedResourceTypes, signedPermission, signedExpiry, sig);
    }