java - 在 Java 应用程序中访问 Azure BlobServiceClient 时出现 AuthenticationError

Question

我是 Azure 新手。我正在尝试创建简单的 Java 应用程序来连接，然后从 Blob 容器下载数据我从创造开始这是代码片段

String sasToken = "my blob sas token key";
        
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
        .endpoint("my blob sas URL")
        .sasToken(sasToken)
        .buildClient();
        
try {
    BlobServiceProperties props = this.blobServiceClient.getProperties();
    PagedIterable<BlobContainerItem> items =  this.blobServiceClient.listBlobContainers();
}
catch (Exception ex) {
    System.out.println("APP exception: "+ex.getMessage());
}

运行此代码片段后 - 出现异常:

If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', 
you can compare the string to sign with the one generated by the SDK. 
To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:cd0a04bd-f01e-0061-159d-ceb31d000000
Time:2023-08-14T10:55:53.7449600Z</Message><AuthenticationErrorDetail>The specified signed resource is not allowed for the this resource level</AuthenticationErrorDetail></Error>"

Blob SAS token key 和 Blob SAS Url 是使用所附屏幕截图中的设置生成的上面的代码中是否有遗漏/错误的地方？提前致谢

Answer 1

您收到此错误的原因是您创建了 Service SAS并尝试使用该 SAS 在帐户级别执行操作 (blobServiceClient.getProperties())。使用服务 SAS，您只能对 Blob(如果 SAS 是为特定 Blob 创建的)或 Blob 容器以及该容器内的 Blob(如果 SAS 是为特定 Blob 容器创建的，这就是您所要执行的操作)执行操作。正在做)。

要解决此问题，您需要创建 Account SAS并使用该 SAS URL(类似于 https://account.blob.core.windows.net?sas-token)。您可以在 Azure 门户中创建帐户 SAS，方法是导航到存储帐户，然后从左侧菜单中选择共享访问签名。