User delegated SAS token generated by Powershell command and Azure Portal different with SAS token created by Azure CLI

Chetan Prakash Saraswat 31 Reputation points
2020-09-14T05:13:52.343+00:00

A User delegated(AD) SAS token created for storage account created by Azure portal or Powershell is different with a SAS token created by Azure CLI.

Example:
Azure CLI:
az storage container generate-sas
--account-name
--name
--permissions acdlrw
--expiry
--auth-mode login
--as-user

token generated:
se=2019-07-27&sp=r&sv=2018-11-09&sr=c&skoid=&sktid=&skt=2019-07-26T18%3A01%3A22Z&ske=2019-07-27T00%3A00%3A00Z&sks=b&skv=2018-11-09&sig=

Azure portal /Powershell

New-AzStorageContainerSASToken -Context $ctx -Name <container>
-Permission racwdl `
-ExpiryTime

token generated:
?sv=2018-11-09&sr=c&sig=&skoid=&sktid=&skt=2019-08-05T22%3A24%3A36Z&ske=2019-08-07T07%3A
00%3A00Z&sks=b&skv=2018-11-09&se=2019-08-07T07%3A00%3A00Z&sp=rwdl

This is creating issue while using azcopy utility for copying from blob storage account as shown below in snapshot.

24421-azcopy.jpg

Azure Storage
Azure Storage

Globally unique resources that provide access to data management services and serve as the parent namespace for the services.

0 comments

3 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    1 deleted comment

    Comments have been turned off. Learn more

  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    1 deleted comment

    Comments have been turned off. Learn more

  3. Anonymous
    2020-09-14T19:18:18.513+00:00

    @Chetan Prakash Saraswat
    There is no difference between the two besides the order of parameters. Also the output of the PowerShell includes "?" before the SAS token, but you should be adding this on both. Are you seeing some other difference between the tokens that are generated?

    Looking at your output here it appears you are missing list permission for the container. In this case you should have "sp=rl". Please see Permissions for a container for more details.

    Hope this helps. If you have further questions or issues please let us know.

    ---------------

    Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.