如何解决适用于Java的Azure SDK如何设置用户委派密钥和共享身份验证签名SAS
以下代码在最后一行引发异常:
// Create a BlobServiceClient object which will be used to create a container client
System.out.println(String.format("Connection String %s",connectStr));
blobServiceClient = new BlobServiceClientBuilder().connectionString(connectStr).buildClient();
// Get a user delegation key for the Blob service that's valid for seven days.
// You can use the key to generate any number of shared access signatures over the lifetime of the key.
keyStart = OffsetDateTime.now();
keyExpiry = OffsetDateTime.now().plusHours(7);
error -> userDelegationKey = blobServiceClient.getUserDelegationKey(keyStart,keyExpiry);
例外:
</Message><AuthenticationErrorDetail>Only authentication scheme Bearer is supported</AuthenticationErrorDetail></Error>"
Caused by: com.azure.storage.blob.models.BlobStorageException: Status code 403,"<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:d375b3bf-b01e-0044-1191-9c75a8000000
我试图将.NET教程改编成Java,但到目前为止还没有运气。
似乎此错误与REST API调用有关,有什么主意吗?
解决方法
因此,在多次尝试之后,无法使用存储帐户的连接字符串来使用用户委托密钥。我必须注册一个应用程序并添加新的应用程序环境变量。最后,在IAM仪表板中检查正确的权限。
就我而言,我在Azure中使用Azure,
- 仅添加了以下依赖项:
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-storage-blob</artifactId>
<version>12.8.0</version>
</dependency>
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-identity</artifactId>
<version>1.1.2</version>
</dependency>
- 在Azure上创建/注册应用
- 使用证书和机密创建应用程序的客户端机密。
- 在环境变量中存储应用程序-客户端ID,租户ID和客户端密钥 即在macOS上:
export AZURE_CLIENT_ID="xxxxxxx"
launchctl setenv AZURE_CLIENT_ID $AZURE_CLIENT_ID
export AZURE_TENANT_ID="xxxxxxx"
launchctl setenv AZURE_TENANT_ID $AZURE_TENANT_ID
export AZURE_CLIENT_SECRET="xxxxxxx"
launchctl setenv AZURE_CLIENT_SECRET $AZURE_CLIENT_SECRET
-
为存储帐户的用户和应用添加
Storage Blob Data Contributor
的正确角色分配。 see this -
现在可以使用以下代码生成用户委托密钥和示例容器SAS:
String endpoint = String.format(Locale.ROOT,"https://%s.blob.core.windows.net","accountName");
// Create a BlobServiceClient object which will be used to create a container client
blobServiceClient = new BlobServiceClientBuilder().endpoint(endpoint)
.credential(new DefaultAzureCredentialBuilder().build()).buildClient();
// Get a user delegation key for the Blob service that's valid for seven days.
// You can use the key to generate any number of shared access signatures over the lifetime of the key.
keyStart = OffsetDateTime.now();
keyExpiry = OffsetDateTime.now().plusDays(7);
userDelegationKey = blobServiceClient.getUserDelegationKey(keyStart,keyExpiry);
BlobContainerSasPermission blobContainerSas = new BlobContainerSasPermission();
blobContainerSas.setReadPermission(true);
BlobServiceSasSignatureValues blobServiceSasSignatureValues = new BlobServiceSasSignatureValues(keyExpiry,blobContainerSas);
BlobContainerClient blobContainerClient = blobServiceClient.getBlobContainerClient("containerName");
if (!blobContainerClient.exists())
blobContainerClient.create();
String sas = blobContainerClient
.generateUserDelegationSas(blobServiceSasSignatureValues,userDelegationKey);
希望这对其他人有帮助!
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。