Question

我在门户网站内创建了一个SAS令牌。一切正常，我可以访问私人blob。

我正在尝试使用此功能动态创建新的SAS令牌：

function generateSasToken($uri, $sasKeyName, $sasKeyValue) 
{ 
    $targetUri = strtolower(rawurlencode(strtolower($uri))); 
    $expires = time();     
    $expiresInMins = 60; 
    $week = 60*60*24*7;
    $expires = $expires + $week; 
    $toSign = $targetUri . "\n" . $expires; 
    $signature = rawurlencode(base64_encode(hash_hmac('sha256',             
    $toSign, $sasKeyValue, TRUE))); 

    $token = "SharedAccessSignature sr=" . $targetUri . "&sig=" . $signature . "&se=" . $expires .         "&skn=" . $sasKeyName; 
    return $token; 
}

这会生成SAS令牌，但格式与门户网站生成的帐户范围略有不同。

尝试使用令牌时，我收到错误：

<Error>
<Code>AuthenticationFailed</Code>
<Message>
Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:1d65690e-e01e-00a6-3d3f-b505c1000000 Time:2018-03-06T11:40:20.5662128Z
</Message>
<AuthenticationErrorDetail>Signature fields not well formed.</AuthenticationErrorDetail>
</Error>

正常运行的帐户范围SAS具有以下格式：

?sv=2017-07-29&ss=b&srt=sco&sp=rwdlac&se=2019-03-03T04:26:37Z&st=2018-03-02T20:26:37Z&spr=https&sig=LjxZDst%2F1Ec745%2BMpZ8PueQErDCySr%2BQLRV1UKBtEGE%3D

该函数生成的SAS令牌失败，具有以下格式：

SharedAccessSignature
sr=<URL>%2fnewteamofficialfc%2fsummarydata.csv&sig=8cURAqmkXFVbq7CYyfk3BsXZJ0dJbHwNhiwJ1jL8jMA%3D&se=1520941694&skn=key2

Answer 1

您可以查看此博文：

Generating Shared access signature(SAS) on Azure Blob using PHP

另见：

Answer 2

使用最新版本的PHP API（2020年8月），可以使用以下类生成SAS。您所需要做的就是：

帐户名
帐户密钥
容器名称
blob名称

$sas_helper = new MicrosoftAzure\Storage\Blob\BlobSharedAccessSignatureHelper($_ENV['azure_account_name'], $_ENV['azure_account_key']);
$sas = $sas_helper->generateBlobServiceSharedAccessSignatureToken(
    Resources::RESOURCE_TYPE_BLOB,              # Resource name to generate the canonicalized resource. It can be Resources::RESOURCE_TYPE_BLOB or Resources::RESOURCE_TYPE_CONTAINER
    "{$container}/{$blob}",                     # The name of the resource, including the path of the resource. It should be {container}/{blob}: for blobs.
    "r",                                        # Signed permissions.
    (new \DateTime())->modify('+10 minute'),    # Signed expiry
    (new \DateTime())->modify('-5 minute'),     # Signed start
    '',                                         # Signed IP, the range of IP addresses from which a request will be accepted, eg. "168.1.5.60-168.1.5.70"
    'https',                                    # Signed protocol, should always be https
);
echo "https://{$_ENV['azure_account_name']}.blob.core.windows.net/{$container}/{$blob}?{$sas}";

用您首选的访问API密钥的方法替换$_ENV变量。

要详细了解上述问题，请在此处查看： https://docs.microsoft.com/en-us/rest/api/storageservices/create-service-sas#service-sas-example

Azure - 从PHP为Blob生成SAS令牌

2 个答案: