Azure Account Shared Access Signiture

0
votes

I am trying to construct an Account level Shared Access Signiture so my client can access all containers in a storage account. I am following these docs Account SAS. It seems straight forward enough but I keep getting the following error message:

"Signature did not match. String to sign used was accountname\nrl\nb\nsc\n\n2016-10-09\n\n\n2015-04-05\n".

My parameters are identical so I suspect it has something to do with how I am hashing the String to Sign. Below is how I construct the token.

var crypto = require('crypto');
var accountName = 'accountname';
var accountKey = 'tH37FTlG3TUT86caMrt2y5kOzof8nFqqA6spzg6r7HPRojE1zDiLJD/xE4oLFDh4RNqAmymvlV7fm8W4SF8cJg==';

var signedPermissions = "sp=rl";
var signedServcies = "ss=b";
var signedResourceType = "srt=sc";
var signedExpiry = "se=2016-10-09";
var signedVersion = "sv=2015-04-05";

var stringToSign = accountName + "\n" + signedPermissions + "\n" + signedServcies + "\n" + signedResourceType + "\n" + signedExpiry + "\n" + signedVersion + "\n";
var hmacsha256 = crypto.createHmac('sha256', accountKey).update(stringToSign).digest('base64');
var token = signedPermissions + "&" + signedServcies + "&" + signedResourceType + "&" + signedExpiry + "&" + signedVersion + "&sig=" + hmacsha256;

I have tried using crypto-js as well but to no avail. The final URL used to access a blob in a container is...

"https://accountname.blob.core.windows.net/containername/blobName?srt=sc&se=2016-10-09&api-version=2015-04-05&sp=rl&ss=b&sv=2015-04-05&sig=IFD2wyfRAsHGU5IFg3RbwSJW6tRE0m0%2FxgAYvJ%2FmnEk%3D"

I have been trying for days and really would appreciate knowing what I'm doing wrong. Thanks.

2
javascriptnode.jsazureazure-storage
If this was your actual account key then i would suggest to change it immediately cause anyone with this key will be able to access your account – Haitham Shaddad

2 Answers

1
votes

Benzene, for stringToSign, the value should NOT has the parameter name?

var signedPermissions = "rl"; var signedServcies = "b"; var signedResourceType = "sc"; var signedExpiry = "2016-10-09"; var signedVersion = "2015-04-05";

0
votes

Please try the following (code shamelessly taken from Azure Storage Node.js library):

var hmacsha256 = crypto.createHmac('sha256', new Buffer(accountKey, 'base64')).update(stringToSign, 'utf-8').digest('base64');