Azure / AzureStor

R interface to Azure storage accounts
Other
64 stars 20 forks source link

Add signed encryption scope field to string-to-sign for authorization for SAS #134

Open psolymos opened 1 year ago

psolymos commented 1 year ago

Helo, I have encountered an issue with SAS and this PR represents a fix referencing Azure SAS spec changes:

  1. https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#version-2020-12-06-and-later
  2. https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas#version-2020-12-06-and-later (actually the docs are also wrong there omitting the rsct field)

Here is how the user delegation SAS fields lined up:

spec pkg
signedPermissions permissions
signedStart dates$start
signedExpiry dates$expiry
canonicalizedResource resource
signedKeyObjectId key$SignedOid
signedKeyTenantId key$SignedTid
signedKeyStart key$SignedStart
signedKeyExpiry key$SignedExpiry
signedKeyService key$SignedService
signedKeyVersion key$SignedVersion
signedAuthorizedUserObjectId
signedUnauthorizedUserObjectId
signedCorrelationId
signedIP ip
signedProtocol protocol
signedVersion auth_api_version
signedResource resource_type
signedSnapshotTime snapshot_time
signedEncryptionScope MISSING
rscc
rscd
rsce
rscl
rsct

Because of this, I was getting Signature did not match. String to sign used was ... error. Installing from my fork resolved the issue.

Cheers!

hongooi73 commented 1 year ago

Hmm, I don't recall running into problems with SAS, but this was some time ago

psolymos commented 1 year ago

@hongooi73 any plans for merging this for a new CRAN release? Thanks.

sam-bradshaw-wcmc commented 3 days ago

I have also encountered problems with the SAS tokens generated by this library (with a similar error message), and it looks like I'm not the only one https://github.com/Azure/AzureStor/issues/140

This post was actually very helpful for me to help work around the issue. If I set auth_api_version="2020-10-02" the SAS token generated start working. The API version needs to be one before 2020-12-06 in which this breaking change seems to have occurred