如何在 Azure 存储 Blob 中生成许可下载 link

Question

我可以通过这些代码得到一个link，它可以成功下载一个文件。

BlobContainerSasPermission blobContainerSasPermission = new BlobContainerSasPermission()
                .setReadPermission(true)
                .setWritePermission(true)
                .setListPermission(true);
BlobServiceSasSignatureValues builder = new BlobServiceSasSignatureValues(OffsetDateTime.now().plusDays(1), blobContainerSasPermission)
                .setProtocol(SasProtocol.HTTPS_ONLY);
BlobClient client = new BlobClientBuilder()
                .connectionString("connection string")
                .blobName("")
                .buildClient();
String blobContainerName = "test";
return String.format("https://%s.blob.core.windows.net/%s?%s",client.getAccountName(), blobContainerName, client.generateSas(builder));

但是每个人都可以通过这个link下载文件，我希望文件可以被授权的人下载。是否有任何代码或 azure 的设置（例如 AD？）可以实现这个？谢谢

------------------------更新-------------------- -----

我找到一个doc，并给出了原因。 注意：此方法调用仅在该对象的 HttpPipeline 中使用 TokenCredential 时有效。 但是在我导入的包中只有 BasicAuthenticationCredential 实现了 TokenCredential。这是我的mvn.

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-storage-blob</artifactId>
    <version>12.11.0-beta.2</version>
</dependency>

我试过了

String userName = "userName";
String password = "password";
BasicAuthenticationCredential basicAuthenticationCredential = new BasicAuthenticationCredential(userName,password);
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder().endpoint(endpoint).credential(basicAuthenticationCredential).buildClient();

然后我得到这个 状态代码 401，(InvalidAuthenticationInfo)

大神们，帮帮我吧！

Answer 1

A SAS token for access to a container, directory, or blob may be secured by using either Azure AD credentials or an account key. A SAS secured with Azure AD credentials is called a user delegation SAS. Microsoft recommends that you use Azure AD credentials when possible as a security best practice, rather than using the account key, which can be more easily compromised. When your application design requires shared access signatures, use Azure AD credentials to create a user delegation SAS for superior security.

使用 UserDelegationKey

生成 SAS 查询参数

以下示例为 Azure 存储容器生成 SAS 查询参数。

BlobSasPermission blobPermission = new BlobSasPermission()
    .setReadPermission(true)
    .setWritePermission(true);

// We are creating a SAS to a container because only container name is set.
BlobServiceSasSignatureValues builder = new BlobServiceSasSignatureValues()
    .setProtocol(SasProtocol.HTTPS_ONLY) // Users MUST use HTTPS (not HTTP).
    .setExpiryTime(OffsetDateTime.now().plusDays(2))
    .setContainerName("my-container")
    .setPermissions(blobPermission);

// Get a user delegation key after signing in with Azure AD
UserDelegationKey credential = new UserDelegationKey();
String account = "my-blob-storage-account";
BlobServiceSasQueryParameters sasQueryParameters = builder.generateSasQueryParameters(credential, account);

查看 Create a user delegation SAS and this 了解实施细节。

Answer 2

看起来没有办法实现这个。

This is the answer.