問題描述
在使用Azure存儲服務(wù)汗侵，為了有效的保護Storage的Access Keys迫像〉睹疲可以使用另一種授權(quán)方式訪問資源(Shared Access Signature: 共享訪問簽名), 它的好處可以控制允許訪問的IP遇八，過期時間敞恋，*權(quán)限 *和 *服務(wù) *等。Azure門戶上提供了對Account級瘤泪，Container級灶泵，Blob級的SAS生成服務(wù)。
No alt text provided for this image
<u style="box-sizing: border-box; text-decoration: underline;">那么使用代碼如何來生成呢对途？</u>
問題回答
以最常見的兩種代碼作為示例：.NET 和 Java
.NET
Blob SAS 將使用帳戶訪問密鑰(Storage Account Key1 or Key2)進行簽名赦邻。 使用 StorageSharedKeyCredential 類創(chuàng)建用于為 SAS 簽名的憑據(jù)。 新建 BlobSasBuilder 對象实檀，并調(diào)用 ToSasQueryParameters 以獲取 SAS 令牌字符串惶洲。官方文檔（https://docs.azure.cn/zh-cn/storage/blobs/sas-service-create?tabs=dotnet）中進行了詳細介紹按声，直接使用以下部分代碼即可生成Blob的SAS URL。
private static Uri GetServiceSasUriForBlob(BlobClient blobClient,
string storedPolicyName = null)
{
// Check whether this BlobClient object has been authorized with Shared Key.
if (blobClient.CanGenerateSasUri)
{
// Create a SAS token that's valid for one hour.
BlobSasBuilder sasBuilder = new BlobSasBuilder()
{
BlobContainerName = blobClient.GetParentBlobContainerClient().Name,
BlobName = blobClient.Name,
Resource = "b"
};
if (storedPolicyName == null)
{
sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddHours(1);
sasBuilder.SetPermissions(BlobSasPermissions.Read |
BlobSasPermissions.Write);
}
else
{
sasBuilder.Identifier = storedPolicyName;
}
Uri sasUri = blobClient.GenerateSasUri(sasBuilder);
Console.WriteLine("SAS URI for blob is: {0}", sasUri);
Console.WriteLine();
return sasUri;
}
else
{
Console.WriteLine(@"BlobClient must be authorized with Shared Key
credentials to create a service SAS.");
return null;
}
}
JAVA
而Java的示例代碼在官網(wǎng)中并沒有介紹恬吕，所以本文就Java生成SAS的代碼進行講解签则。
從Java新版的SDK（azure-storage-blob）中 ，可以發(fā)現(xiàn) BlobServiceClient铐料，BlobContainerClient 渐裂，BlobClient 對象中都包含 generateAccountSas 或 generateSas 方法來實現(xiàn)對Account， Container钠惩，Blob進行SAS Token生成柒凉，只需要根據(jù)它所需要的參數(shù)對
AccountSasSignatureValues 和 BlobServiceSasSignatureValues 初始化。 示例代碼(全部代碼可在文末下載)：
public static void GenerateSASstring(BlobServiceClient blobServiceClient, BlobContainerClient blobContainerClient,
BlobClient blobClient) {
/*
* Generate an account sas. Other samples in this file will demonstrate how to
* create a client with the sas token.
*/
// Configure the sas parameters. This is the minimal set.
OffsetDateTime startTime = OffsetDateTime.now();
OffsetDateTime expiryTime = OffsetDateTime.now().plusDays(1);
AccountSasService services = new AccountSasService().setBlobAccess(true);
AccountSasResourceType resourceTypes = new AccountSasResourceType().setObject(true);
SasProtocol protocol = SasProtocol.HTTPS_ONLY;
SasIpRange sasIpRange = SasIpRange.parse("167.220.255.73");
// Generate the account sas.
AccountSasPermission accountSasPermission = new AccountSasPermission().setReadPermission(true);
AccountSasSignatureValues accountSasValues = new AccountSasSignatureValues(expiryTime, accountSasPermission,
services, resourceTypes);
accountSasValues.setStartTime(startTime);
accountSasValues.setProtocol(protocol);
accountSasValues.setSasIpRange(sasIpRange);
String accountSasToken = blobServiceClient.generateAccountSas(accountSasValues);
System.out.println("\nGenerate the account sas & url is :::: \n\t" + accountSasToken + "\n\t"
+ blobServiceClient.getAccountUrl() + "?" + accountSasToken);
// Generate a sas using a container client
BlobContainerSasPermission containerSasPermission = new BlobContainerSasPermission().setCreatePermission(true);
BlobServiceSasSignatureValues serviceSasValues = new BlobServiceSasSignatureValues(expiryTime,
containerSasPermission);
serviceSasValues.setStartTime(startTime);
serviceSasValues.setProtocol(protocol);
serviceSasValues.setSasIpRange(sasIpRange);
String containerSasToken = blobContainerClient.generateSas(serviceSasValues);
System.out.println("\nGenerate the Container sas & url is :::: \n\t" + containerSasToken + "\n\t"
+ blobContainerClient.getBlobContainerUrl() + "?" + containerSasToken);
// Generate a sas using a blob client
BlobSasPermission blobSasPermission = new BlobSasPermission().setReadPermission(true);
serviceSasValues = new BlobServiceSasSignatureValues(expiryTime, blobSasPermission);
serviceSasValues.setStartTime(startTime);
serviceSasValues.setProtocol(protocol);
serviceSasValues.setSasIpRange(sasIpRange);
String blobSasToken = blobClient.generateSas(serviceSasValues);
System.out.println("\nGenerate the Blob sas & url is :::: \n\t" + blobSasToken + "\n\t"
+ blobClient.getBlobUrl() + "?" + blobSasToken);
}
在pom.xml 中所需要加載的依賴項：
<dependency>
<groupId>com.azure</groupId>
<artifactId>azure-storage-blob</artifactId>
<version>12.13.0</version>
</dependency>
以上代碼中的各部分設(shè)置項 與 Azure門戶上設(shè)置項的對應(yīng)關(guān)系如下圖：
No alt text provided for this image
運行效果圖
No alt text provided for this image
附錄一：Java Main函數(shù)全部代碼：
package test;
import java.io.File;
import java.io.FileWriter;
import java.io.IOException;
import java.net.URISyntaxException;
import java.security.InvalidKeyException;
import java.time.OffsetDateTime;
import java.util.Iterator;
import com.azure.storage.blob.BlobClient;
import com.azure.storage.blob.BlobContainerClient;
import com.azure.storage.blob.BlobServiceClient;
import com.azure.storage.blob.BlobServiceClientBuilder;
import com.azure.storage.blob.models.BlobItem;
import com.azure.storage.blob.sas.BlobContainerSasPermission;
import com.azure.storage.blob.sas.BlobSasPermission;
import com.azure.storage.blob.sas.BlobServiceSasSignatureValues;
import com.azure.storage.common.sas.AccountSasPermission;
import com.azure.storage.common.sas.AccountSasResourceType;
import com.azure.storage.common.sas.AccountSasService;
import com.azure.storage.common.sas.AccountSasSignatureValues;
import com.azure.storage.common.sas.SasIpRange;
import com.azure.storage.common.sas.SasProtocol;
/**
* Hello world!
*
*/
public class App {
public static void main(String[] args)
throws URISyntaxException, InvalidKeyException, RuntimeException, IOException {
System.out.println("Hello World!");
String storageConnectionString = "DefaultEndpointsProtocol=https;AccountName=<your storage account name>;AccountKey=**************************;EndpointSuffix=core.chinacloudapi.cn";
String blobContainerName = "test";
String dirName = "";
// Create a BlobServiceClient object which will be used to create a container
System.out.println("\nCreate a BlobServiceClient Object to Connect Storage Account");
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder().connectionString(storageConnectionString)
.buildClient();
// Create a unique name for the container
String containerName = blobContainerName + java.util.UUID.randomUUID();
// Create the container and return a container client object
System.out.println("\nCreate new Container : " + containerName);
BlobContainerClient containerClient = blobServiceClient.createBlobContainer(containerName);
// Create a local file in the ./data/ directory for uploading and downloading
System.out.println("\nCreate a local file in the ./data/ directory for uploading and downloading");
String localPath = "./data/";
String fileName = "quickstart" + java.util.UUID.randomUUID() + ".txt";
File localFile = new File(localPath + fileName);
// Write text to the file
FileWriter writer = new FileWriter(localPath + fileName, true);
writer.write("Hello, World! This is test file to download by SAS. Also test upload");
writer.close();
// Get a reference to a blob
BlobClient blobClient = containerClient.getBlobClient(fileName);
System.out.println("\nUploading to Blob storage as blob:\n\t" + blobClient.getBlobUrl());
// Upload the blob
blobClient.uploadFromFile(localPath + fileName);
System.out.println("\nUpload blob completed : " + blobClient.getBlobName());
System.out.println("\nListing blobs...");
// List the blob(s) in the container.
for (BlobItem blobItem : containerClient.listBlobs()) {
System.out.println("\t" + blobItem.getName());
}
// Download the blob to a local file
// Append the string "DOWNLOAD" before the .txt extension so that you can see
// both files.
String downloadFileName = fileName.replace(".txt", "DOWNLOAD.txt");
File downloadedFile = new File(localPath + downloadFileName);
System.out.println("\nDownloading blob to\n\t " + localPath + downloadFileName);
blobClient.downloadToFile(localPath + downloadFileName);
// Generate SAS String for blob user..
System.out.println("\nGenerate SAS String for blob user..");
GenerateSASstring(blobServiceClient, containerClient, blobClient);
// Clean up
System.out.println("\nPress the Enter word 'Delete' to begin clean up");
boolean isDelete = System.console().readLine().toLowerCase().trim().equals("delete");
if (isDelete) {
System.out.println("Deleting blob container...");
containerClient.delete();
System.out.println("Deleting the local source and downloaded files...");
localFile.delete();
downloadedFile.delete();
} else {
System.out.println("Skip to Clean up operation");
}
System.out.println("Done");
}
public static void GenerateSASstring(BlobServiceClient blobServiceClient, BlobContainerClient blobContainerClient,
BlobClient blobClient) {
/*
* Generate an account sas. Other samples in this file will demonstrate how to
* create a client with the sas token.
*/
// Configure the sas parameters. This is the minimal set.
OffsetDateTime startTime = OffsetDateTime.now();
OffsetDateTime expiryTime = OffsetDateTime.now().plusDays(1);
AccountSasService services = new AccountSasService().setBlobAccess(true);
AccountSasResourceType resourceTypes = new AccountSasResourceType().setObject(true);
SasProtocol protocol = SasProtocol.HTTPS_ONLY;
SasIpRange sasIpRange = SasIpRange.parse("167.220.255.73");
// Generate the account sas.
AccountSasPermission accountSasPermission = new AccountSasPermission().setReadPermission(true);
AccountSasSignatureValues accountSasValues = new AccountSasSignatureValues(expiryTime, accountSasPermission,
services, resourceTypes);
accountSasValues.setStartTime(startTime);
accountSasValues.setProtocol(protocol);
accountSasValues.setSasIpRange(sasIpRange);
String accountSasToken = blobServiceClient.generateAccountSas(accountSasValues);
System.out.println("\nGenerate the account sas & url is :::: \n\t" + accountSasToken + "\n\t"
+ blobServiceClient.getAccountUrl() + "?" + accountSasToken);
// Generate a sas using a container client
BlobContainerSasPermission containerSasPermission = new BlobContainerSasPermission().setCreatePermission(true);
BlobServiceSasSignatureValues serviceSasValues = new BlobServiceSasSignatureValues(expiryTime,
containerSasPermission);
serviceSasValues.setStartTime(startTime);
serviceSasValues.setProtocol(protocol);
serviceSasValues.setSasIpRange(sasIpRange);
String containerSasToken = blobContainerClient.generateSas(serviceSasValues);
System.out.println("\nGenerate the Container sas & url is :::: \n\t" + containerSasToken + "\n\t"
+ blobContainerClient.getBlobContainerUrl() + "?" + containerSasToken);
// Generate a sas using a blob client
BlobSasPermission blobSasPermission = new BlobSasPermission().setReadPermission(true);
serviceSasValues = new BlobServiceSasSignatureValues(expiryTime, blobSasPermission);
serviceSasValues.setStartTime(startTime);
serviceSasValues.setProtocol(protocol);
serviceSasValues.setSasIpRange(sasIpRange);
String blobSasToken = blobClient.generateSas(serviceSasValues);
System.out.println("\nGenerate the Blob sas & url is :::: \n\t" + blobSasToken + "\n\t"
+ blobClient.getBlobUrl() + "?" + blobSasToken);
}
}
參考資料
快速入門：使用 Java v12 SDK 管理 blob：https://docs.azure.cn/zh-cn/storage/blobs/storage-quickstart-blobs-java
Azure Storage Blob client library for Java：https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/storage/azure-storage-blob#generate-a-sas-token
示例下載：demo.rar
當(dāng)在復(fù)雜的環(huán)境中面臨問題篓跛，格物之道需：濁而靜之徐清膝捞，安以動之徐生。 云中愧沟，恰是如此!
分類: 【Azure 存儲服務(wù)】
標(biāo)簽: Shared Access Signature: 共享訪問簽名, JAVA 生成SAS, Azure Storage, Azure Developer
