[QUERY] Generating sas for Azure IoT hub blob storage doesn't work.

[geometrikal]

Library name and version

Azure.Storage.Blobs 12.13.0

Query/Question

I'm using BlobSasBuilder from the Azure.Storage.Blob nuget package version 12.13.0 to generate blob read sas.

This works fine with blobs stored on Azure, but fails with "Signature did not match" for blobs hosted on an on-premises machine using Azure Blob Storage on IoT Edge

Interestingly, the SAS generated by Azure Storage Explorer works, and I notice that the service version (sv) in the query string is much earlier ("2017-04-17") than that generated by v 12.13.0 of the library. Apart from the version and the signature, the SAS query strings are identical.

Any ideas?

Environment

No response

[ghost]

Thank you for your feedback. This has been routed to the support team for assistance.

[SatishBoddu-MSFT]

Hello @geometrikal We are looking into this!

Quick question: How are you generating the SAS for a particular blob? within the IoT Edge Module or from outside the module?

Wanted to understand the SAS generation on your side for Azure Blob Storage on IoT Edge,

[geometrikal]

@SatishBoddu-MSFT

We have an ASP.Net Core web api (deployed locally or dev machine or remote to Azure app services) that the client retrieves the sas key information from, and then the client downloads the blob.

This is the code

var blobSasBuilder = new BlobSasBuilder()
{
    BlobContainerName = containerName,
    BlobName = filePath,
    Resource = "b",
    StartsOn = DateTimeOffset.UtcNow.AddMinutes(-5),
    ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(5)
};
blobSasBuilder.SetPermissions(BlobSasPermissions.Read);
var storageSharedKeyCredential = new StorageSharedKeyCredential(accountName, accountKey);
var sas = blobSasBuilder.ToSasQueryParameters(storageSharedKeyCredential).ToString();

Normally we have data stored on the IoT Edge device which then syncs to the Azure blob storage instance. However, the software we are using creates a separate container for each project, so we have to keep manually updating the Module Identity Twin with the new containers, which is often delayed or done on a needs basis. So for the client, I want to be able to fall back to grabbing the blob from the IoT Edge device if it is not in the Azure storage.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

Issue Details

---

### Library name and version Azure.Storage.Blobs 12.13.0 ### Query/Question I'm using `BlobSasBuilder` from the Azure.Storage.Blob nuget package version 12.13.0 to generate blob read sas. This works fine with blobs stored on Azure, but fails with "Signature did not match" for blobs hosted on an on-premises machine using [Azure Blob Storage on IoT Edge](https://docs.microsoft.com/en-us/azure/iot-edge/how-to-store-data-blob?view=iotedge-2020-11) Interestingly, the SAS generated by Azure Storage Explorer works, and I notice that the service version (sv) in the query string is much earlier ("2017-04-17") than that generated by v 12.13.0 of the library. Apart from the version and the signature, the SAS query strings are identical. Any ideas? ### Environment _No response_

Author:	geometrikal
Assignees:	-
Labels:	`Storage`, `Service Attention`, `Client`, `customer-reported`, `question`, `needs-team-attention`
Milestone:	-

[github-actions[bot]]

Hi @geometrikal, we deeply appreciate your input into this project. Regrettably, this issue has remained unresolved for over 2 years and inactive for 30 days, leading us to the decision to close it. We've implemented this policy to maintain the relevance of our issue queue and facilitate easier navigation for new contributors. If you still believe this topic requires attention, please feel free to create a new issue, referencing this one. Thank you for your understanding and ongoing support.