Question

是否可以在一个天蓝色容器上打开对整个blob的SAS访问？

我可以为特定的blob创建一个SAS，但是我试图为容器做这个，而我找不到好的选择？

我的目标是打开对整个容器的特定访问，并能够读取一些特定的blob。

$end = date('Y-m-d\TH\:i\:s\Z', strtotime('+10 minutes'));

$containerName=$_POST['container'];
$blobName= $_POST['blob'];

function getSASForBlob($accountName, $container, $blob, $permissions ,$expiry, $key){
 /* Create the signature */
 $_arraysign = array();
 $_arraysign[] = $permissions;
 $_arraysign[] = '';
 $_arraysign[] = $expiry;
 $_arraysign[] = '/blob/'.$accountName . '/' . $container . '/';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = "2015-12-11"; //the API version is now required 
 $_arraysign[] = '';
 $_arraysign[] = 'file; attachment';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = 'binary';

 $_str2sign = implode("\n", $_arraysign);

 return base64_encode(hash_hmac('sha256', urldecode(utf8_encode($_str2sign)), base64_decode($key), true));
}

function getBlobUrl($accountName, $container, $blob, $resourceType, $permissions, $expiry, $_signature){
 /* Create the signed query part */
 $_parts = array();
 $_parts[] = (!empty($expiry))?'se=' .urlencode($expiry):'';
 $_parts[] = 'sr=' . $resourceType;
 $_parts[] = (!empty($permissions))?'sp=' . $permissions:'';
 $_parts[] = 'sig=' . urlencode($_signature);
 $_parts[] = 'sv=2015-12-11';
 $_parts[] = 'comp=list';


 /* Create the signed blob URL */
 $_url = 'https://'
 .$accountName.'.blob.core.windows.net/'
 . $container . '/'
 . $blob . '?'
 . implode('&', $_parts);

 return $_url;
 }


$sig = getSASForBlob("cloudviewer",$containerName, $blobName, "r", $end, $key);
$url = getBlobUrl("cloudviewer",$containerName,$blobName,"c","r", $end, $sig);

echo(json_encode(array('url' => $url, 'experity' => $end)));

我的错误是：

签名不匹配。使用的字符串是r 2016-12-10T16：53：00Z / blob / cloudviewer / 450-423-422-392 2015-12-11

Answer 1

在我的测试中，我们需要为blob和容器操作实现单独的SAS令牌。有关详细信息，请参阅https://docs.microsoft.com/en-us/rest/api/storageservices/fileservices/constructing-a-service-sas。

对于此问题，您似乎正在为容器中的列表blob生成SAS令牌URL。如需快速测试，请尝试以下代码段：

function getSASForBlob($accountName, $container, $blob, $permissions ,$expiry, $key){
 /* Create the signature */
 $_arraysign = array();
 $_arraysign[] = $permissions;
 $_arraysign[] = '';
 $_arraysign[] = $expiry;
 if($blob){
    $_arraysign[] = '/blob' .'/'.$accountName . '/' . $container . '/' . $blob;
 }else{
    $_arraysign[] = '/blob' .'/'.$accountName . '/' . $container ;
 }
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = "2015-12-11"; //the API version is now required 
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';

 $_str2sign = implode("\n", $_arraysign);

 return base64_encode(hash_hmac('sha256', urldecode(utf8_encode($_str2sign)), base64_decode($key), true));
}

function getBlobUrl($accountName, $container, $blob, $resourceType, $permissions, $expiry, $_signature){
 $_parts = array();
    $_parts[] = (!empty($expiry)) ? 'se=' . urlencode($expiry) : '';
    $_parts[] = 'sr=' . $resourceType;
    $_parts[] = (!empty($permissions)) ? 'sp=' . $permissions : '';
    $_parts[] = 'sig=' . urlencode($_signature);
    $_parts[] = 'sv=2015-12-11';
    $_parts[] = 'comp=list';
    $_parts[] = 'restype=container';


 /* Create the signed blob URL */
 $_url = 'https://'
 .$accountName.'.blob.core.windows.net/'
 . $container 
 // . '/'
 // . $blob 
 . '?'
 . implode('&', $_parts);

 return $_url;
 }

$sig = getSASForBlob(AZURE_ACC_NAME,AZURE_CONTAINER, null, "l", $endDate, AZURE_PRIMARY_KEY);
$url = getBlobUrl(AZURE_ACC_NAME,AZURE_CONTAINER,null,"c","l", $endDate, $sig);

Answer 2

您需要进行一些小修改才能生成有效的服务SAS令牌，该令牌将列出容器中的blob。此外，在调用这些方法时，您应该传递'rl'的权限而不仅仅是'r'。这是因为您想要列出容器中的项目。

$end = date('Y-m-d\TH\:i\:s\Z', strtotime('+10 minutes'));

$containerName=$_POST['container'];
$blobName= $_POST['blob'];

function getSASForBlob($accountName, $container, $blob, $permissions ,$expiry, $key){
 /* Create the signature */
 $_arraysign = array();
 $_arraysign[] = $permissions;
 $_arraysign[] = '';
 $_arraysign[] = $expiry;
 $_arraysign[] = '/blob/' . $accountName . '/' . $container;
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = "2015-12-11"; //the API version is now required 
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';
 $_arraysign[] = '';

 $_str2sign = implode("\n", $_arraysign);

 return base64_encode(hash_hmac('sha256', urldecode(utf8_encode($_str2sign)), base64_decode($key), true));
}

function getBlobUrl($accountName, $container, $blob, $resourceType, $permissions, $expiry, $_signature){
 /* Create the signed query part */
 $_parts = array();
 $_parts[] = (!empty($expiry))?'se=' .urlencode($expiry):'';
 $_parts[] = 'sr=' . $resourceType;
 $_parts[] = (!empty($permissions))?'sp=' . $permissions:'';
 $_parts[] = 'sig=' . urlencode($_signature);
 $_parts[] = 'sv=2015-12-11';
 $_parts[] = 'comp=list';
 $_parts[] = 'restype=container';




 /* Create the signed blob URL */
 $_url = 'https://'
 .$accountName.'.blob.core.windows.net/'
 . $container . '?'
 . implode('&', $_parts);

 return $_url;
 }

Azure SAS容器php

2 个答案: