Azure Blob Storage authorization with SAS

0
votes

I have a web application (ASP.NET MVC) which uses Azure Blob Storage for storing documents and images. Each user has specific access rights to the blobs and this is stored in web application's database.

Currently I have a quick temporary solution which uses the web application as a middle layer that runs the authorization and if the client has read access to the blob, it is first retrieved from Azure and then delivered to the client. This is of course not the optimal way of doing it for many reasons.

I have started to rebuild this part using SAS (Shared Access Signatures), but can't find a good source for setting up a system that will scale well as the number of users and files grow. I am expecting the number of users to be around 100 and the number of blobs to be around 100 000.

As I see it I have two options.

1) All files have one signature stored in the web applications database and this is used for all users who have access to the file. This would be the easy way to do it, but if a user for some reason does not still have access to the file, they will still be able to access the file if they have the link from earlier access.

2) All files have specific signatures for each user who has access to the file. This will make it easy to revoke access to files, but the number of signatures will be massive and will this have any side effects?

Are there any more options?

Any thoughts on this are greatly appreciated!

1
asp.net-mvcazureazure-blob-storage
Is there a reason you've not considered creating SAS as and when it is needed? – Gaurav Mantri
I guess you mean that the SAS would be generated and added to the URL in the HTML delivered to the client? This is of course one option, but for images, they will be listed with thumbnails (also stored in Azure Blob Storage), so if I have 20 images on a page that would mean 20 roundtrips to Azure to generate signatures before the HTML can be rendered. Right? – moccasine
You can refer to my answer here: stackoverflow.com/questions/39431608/… – Zhaoxing Lu
Thank you Zhaoxing! Not sure though how to use your answer. Do you recommend me to use SAS or not? – moccasine

1 Answers

0
votes

Rather than having SAS for each users it would be better that you group the files by roles and map the users to roles which is easy to scale irrelevant to number of users.

Also giving access to users to blob directly is not recommended as you want to distribute your blob content through your application. So provide access to application with specific in context of role of user.

See below article for generating twominute SAS which expires in two minute so your users with the link does not have access to image for long time.

http://www.dotnetcurry.com/windows-azure/901/protect-azure-blob-storage-shared-access-signature

Hope this helps. :)