Azure - Generate SAS Token for Blob from PHP

Question

I have created a SAS Token from within the portal & all works fine, i can access Private blobs.

I am trying to create new SAS Tokens on the fly using this function:

function generateSasToken($uri, $sasKeyName, $sasKeyValue) 
{ 
    $targetUri = strtolower(rawurlencode(strtolower($uri))); 
    $expires = time();     
    $expiresInMins = 60; 
    $week = 60*60*24*7;
    $expires = $expires + $week; 
    $toSign = $targetUri . "\n" . $expires; 
    $signature = rawurlencode(base64_encode(hash_hmac('sha256',             
    $toSign, $sasKeyValue, TRUE))); 

    $token = "SharedAccessSignature sr=" . $targetUri . "&sig=" . $signature . "&se=" . $expires .         "&skn=" . $sasKeyName; 
    return $token; 
}

This does generate a SAS Token, however in a slightly different format to the account wide one generated from the portal.

When trying to use the Token i recieve the error:

<Error>
<Code>AuthenticationFailed</Code>
<Message>
Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:1d65690e-e01e-00a6-3d3f-b505c1000000 Time:2018-03-06T11:40:20.5662128Z
</Message>
<AuthenticationErrorDetail>Signature fields not well formed.</AuthenticationErrorDetail>
</Error>

The account wide SAS which works correctly has this format:

?sv=2017-07-29&ss=b&srt=sco&sp=rwdlac&se=2019-03-03T04:26:37Z&st=2018-03-02T20:26:37Z&spr=https&sig=LjxZDst%2F1Ec745%2BMpZ8PueQErDCySr%2BQLRV1UKBtEGE%3D

The SAS Token generated by the function, which fails, has this format:

SharedAccessSignature
sr=<URL>%2fnewteamofficialfc%2fsummarydata.csv&sig=8cURAqmkXFVbq7CYyfk3BsXZJ0dJbHwNhiwJ1jL8jMA%3D&se=1520941694&skn=key2

Answer 1

You may want to check out this blog post:

Generating Shared access signature(SAS) on Azure Blob using PHP

See also:

• Microsoft Azure and SAS for PHP

• Why isn't my Azure SAS Token Signature matching?

• SAS Azure Signature did not match

Answer 2

Using the most recent version of the PHP API (August 2020), you can use the following class to generate the SAS. All you'll need is your:

• account name
• account key
• container name
• blob name

$sas_helper = new MicrosoftAzure\Storage\Blob\BlobSharedAccessSignatureHelper($_ENV['azure_account_name'], $_ENV['azure_account_key']);
$sas = $sas_helper->generateBlobServiceSharedAccessSignatureToken(
    Resources::RESOURCE_TYPE_BLOB,              # Resource name to generate the canonicalized resource. It can be Resources::RESOURCE_TYPE_BLOB or Resources::RESOURCE_TYPE_CONTAINER
    "{$container}/{$blob}",                     # The name of the resource, including the path of the resource. It should be {container}/{blob}: for blobs.
    "r",                                        # Signed permissions.
    (new \DateTime())->modify('+10 minute'),    # Signed expiry
    (new \DateTime())->modify('-5 minute'),     # Signed start
    '',                                         # Signed IP, the range of IP addresses from which a request will be accepted, eg. "168.1.5.60-168.1.5.70"
    'https',                                    # Signed protocol, should always be https
);
echo "https://{$_ENV['azure_account_name']}.blob.core.windows.net/{$container}/{$blob}?{$sas}";

Replace the $_ENV variables with your preferred method of accessing API keys.

To read more about what the heck is going up above, have a look here: https://docs.microsoft.com/en-us/rest/api/storageservices/create-service-sas#service-sas-example