Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

How do we use GenerateSasUri to create a SAS based on a storage access policy?

See original GitHub issue

Library name and version

Azure.Storage.Blobs 12.14.1

Query/Question

We have code in SQL Server Management Studio to set an access policy on a container and generate a SAS based on that access policy. That SAS is then used as a credential by SQL Server to enable backup to/restore from URL.

I am trying to port the code from the old WindowsAzure.Storage SDK to the new Azure.Storage.Blobs SDK and I can’t find an equivalent way to generate a SAS based on the access policy.

The old code is below. Note that CloudBlobContainer.GetSharedAccessSignature had a override that accepts the SharedAccessBlobPolicy as a parameter. In the new SDK I don’t see any parameters for BlobContainerClient.GenerateSasUri or BlobSasBuilder that are related to the access policy.

/// <summary>
        /// Create Shared Access Policy for container 
        /// Default Accesss permission is Write/List/Read/Delete
        /// </summary>
        /// <param name="container"></param>
        /// <param name="policyName"></param>
        /// <param name="selectedSaredAccessExpiryTime"></param>
        public static string CreateSharedAccessPolicyOnContainer(CloudBlobContainer container, string policyName, DateTime selectedSaredAccessExpiryTime)
        {
            //Create a new stored access policy and define its constraints.
            SharedAccessBlobPolicy sharedAccessPolicyForContainer = new SharedAccessBlobPolicy()
            {
                SharedAccessExpiryTime = selectedSaredAccessExpiryTime,
                Permissions = SharedAccessBlobPermissions.Write | SharedAccessBlobPermissions.List | SharedAccessBlobPermissions.Read | SharedAccessBlobPermissions.Delete
            };

            //Get the container's existing permissions.
            BlobContainerPermissions permissions = container.GetPermissions();
            if (!permissions.SharedAccessPolicies.ContainsKey(policyName))
            {
                //Add the new policy to the container's permissions.
                permissions.SharedAccessPolicies.Add(policyName, sharedAccessPolicyForContainer);
            }
            else
            {
                // if already exists, remove then recreate the policy to get expircy/permission right. 
                SharedAccessBlobPolicy existingSharedAccessPolicyForContainer = new SharedAccessBlobPolicy();
                permissions.SharedAccessPolicies.TryGetValue(policyName, out existingSharedAccessPolicyForContainer);

                permissions.SharedAccessPolicies.Remove(policyName);
                container.SetPermissions(permissions);
                permissions.SharedAccessPolicies.Add(policyName, sharedAccessPolicyForContainer);
            }
            container.SetPermissions(permissions);
            permissions = container.GetPermissions();

            // verify access
            string sharedAccessSignatureForContainer = container.GetSharedAccessSignature(sharedAccessPolicyForContainer).TrimStart('?');
            if (string.IsNullOrEmpty(sharedAccessSignatureForContainer))
            {
                throw new InvalidCredentialException(SR.InvalidCredential);
            }
            return sharedAccessSignatureForContainer;
        }

This is what I’ve got so far for the replacement using the new SDK. What should I replace my container.GenerateSasUri call with to use the access policy I created for the SAS key? As written, this code generates a SAS without the access policy parameter.

        public static string CreateSharedAccessPolicyOnContainer(BlobContainerClient container, string policyName, DateTime selectedSharedAccessExpiryTime)
        {
            //Create a new stored access policy and define its constraints.
            var sharedAccessPolicyForContainer = new BlobSignedIdentifier()
            {
                Id = policyName,
                AccessPolicy = new BlobAccessPolicy()
                {
                    PolicyExpiresOn = selectedSharedAccessExpiryTime,
                    Permissions = "wlrd" // Write | List | Read | Delete
                }
            };

            //Get the container's existing permissions.
            var existingPolicy = container.GetAccessPolicy().Value;
            var permissions = existingPolicy.SignedIdentifiers.ToList();
            var existingPermission = permissions.FindIndex(b => b.Id == policyName);
            if (existingPermission == -1)
            {
                //Add the new policy to the container's permissions.
                permissions.Add(sharedAccessPolicyForContainer);
            }
            else
            {
                permissions[existingPermission] = sharedAccessPolicyForContainer;
            }
            container.SetAccessPolicy(existingPolicy.BlobPublicAccess, permissions);

            // verify access
            string sharedAccessSignatureForContainer = container.GenerateSasUri(Sas.BlobContainerSasPermissions.Write | Sas.BlobContainerSasPermissions.List | Sas.BlobContainerSasPermissions.Delete | Sas.BlobContainerSasPermissions.Read, selectedSharedAccessExpiryTime).Query.TrimStart('?');
            if (string.IsNullOrEmpty(sharedAccessSignatureForContainer))
            {
                throw new InvalidCredentialException(SR.InvalidCredential);
            }
            return sharedAccessSignatureForContainer;
        }