在powershell中生成SAS帐户令牌

Question

“我使用 Azure 生成了一个令牌，它正在工作，但我需要使用密钥在 PowerShell 中创建正确的脚本。我生成的

stringToSign

与 Azure 提供的不同，azcopy 给我一个 403 Server failed to验证请求错误的基础是： https://learn.microsoft.com/en-us/rest/api/storageservices/create-account-sas https://learn.microsoft.com/en-us/rest/api/eventhub/generate-sas-token

# Azure Storage Account Details
$storageAccountName = "name"
$storageAccountKey = "key"
$baseUrl = "https://$storageAccountName.blob.core.windows.net"

# SAS Token parameters
$permissions = "rwdlacup"  # Read, write, delete, list, add, create, update, process
$serviceVersion = "2022-11-02"  # API version
$expiryDate = "2024-12-13T22:41:13Z"  # Token expiry
$startDate = "2024-12-13T14:41:13Z"   # Start time
$signedServices = "bqtf"  # Blob, Queue, Table, File
$signedResourceTypes = "sco"  # Service, Container, Object
$signedIP = ""             # No specific IP restriction
$signedProtocol = "https"  # Only HTTPS

# Create the string-to-sign
$stringToSign = "$storageAccountName\n$permissions\n$signedServices\n$signedResourceTypes\n$startDate\n$expiryDate\n$signedIP\n$signedProtocol\n$signedversion"

# Compute HMAC SHA-256
$hmac = New-Object System.Security.Cryptography.HMACSHA256
$hmac.Key = [Convert]::FromBase64String($storageAccountKey)
$sig = [Convert]::ToBase64String($hmac.ComputeHash([Text.Encoding]::UTF8.GetBytes($stringToSign)))

# Construct SAS token
$sasToken = "?sv=$serviceVersion&ss=$signedServices&srt=$signedResourceTypes&sp=$permissions&se=$expiryDate&st=$startDate&spr=https&sig=$sig"

# Full URL with SAS token
$fullUrl = "$baseUrl/$sasToken"

我尝试了不同类型的

stringToSign

，但 SAS 令牌仍然不同，并导致相同的错误。 SAS 令牌生成不匹配，我收到 403 服务器无法验证请求错误。我尝试过使用各种

stringToSign 

格式，但没有一个能按预期工作。

Answer 1

在 powershell 中生成 SAS 帐户令牌

如果您使用

2022-11-02

REST API 版本，您的

stringToSign

应使用以下逻辑构建：

StringToSign = accountname + "\n" +  
    signedpermissions + "\n" +  
    signedservice + "\n" +  
    signedresourcetype + "\n" +  
    signedstart + "\n" +  
    signedexpiry + "\n" +  
    signedIP + "\n" +  
    signedProtocol + "\n" +  
    signedversion + "\n" +
    signedEncryptionScope + "\n"

您可以使用以下脚本使用 Powershell 生成帐户 sas 令牌。

脚本：

# Parameters
$xMsDate = [System.DateTime]::UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ")
$expiryInSeconds = 7200 # 2 hours validity

$accountName = "xxx"
$signedPermissions = "rwdlaciytfx"
$signedService = "b"
$signedResourceType = "sco"
$signedStart = $xMsDate
$signedExpiry = [System.DateTime]::UtcNow.AddSeconds($expiryInSeconds).ToString("yyyy-MM-ddTHH:mm:ssZ")
$signedIP = "" # Optional
$signedProtocol = "https"
$signedVersion = "2022-11-02"
$signedEncryptionScope = ""

# Storage Account Key (Replace with your actual key)
$accessKey = "xxxx"

# Construct String-to-Sign
$StringToSign = "{0}`n{1}`n{2}`n{3}`n{4}`n{5}`n{6}`n{7}`n{8}`n{9}`n" -f `
    $accountName, $signedPermissions, $signedService, $signedResourceType, `
    $signedStart, $signedExpiry, $signedIP, $signedProtocol, $signedVersion, $signedEncryptionScope

# Decode the storage account key
$keyBytes = [Convert]::FromBase64String($accessKey)

# Convert String-to-Sign to bytes
$SignatureBytes = [System.Text.Encoding]::UTF8.GetBytes($StringToSign)

# Generate HMAC-SHA256 signature
$hasher = New-Object System.Security.Cryptography.HMACSHA256
$hasher.Key = $keyBytes
$Signature = [Convert]::ToBase64String($hasher.ComputeHash($SignatureBytes))

# Generate SAS Token
$sasToken = "sv=$signedVersion&ss=$signedService&srt=$signedResourceType&sp=$signedPermissions&se=$signedExpiry&st=$signedStart&spr=$signedProtocol&sig=$([System.Web.HttpUtility]::UrlEncode($Signature))"

# Output the SAS Token
Write-Output $sasToken

输出：

sv=2022-11-02&ss=b&srt=sco&sp=rwdlaciytfx&se=2024-12-14T11:27:45Z&st=2024-12-14T09:27:45Z&spr=https&sig=redacted

现在，我使用 blob URL 验证了 SAS 令牌，以从 Azure blob 存储中获取图像。

API请求：

参考：

创建帐户 SAS - Azure 存储 |微软学习