search

Azure / azure-storage-java

Microsoft Azure Storage Library for Java
https://docs.microsoft.com/en-us/java/api/overview/azure/storage
MIT License
189 stars 163 forks source link

Batch Delete with SAS Token Auth Fails #538

Open original-brownbear opened 4 years ago

original-brownbear commented 4 years ago

I raised this before in https://github.com/Azure/azure-storage-java/issues/492 but now this seems to again be broken with service level SAS tokens (which according to my testing and information given in #492 should work).

Which service(blob, file, queue, table) does this issue concern?

Blob

Which version of the SDK was used?

v8.6.2

What problem was encountered?

Using SAS Token authentication, batch delete operations fail because they are not correctly authenticated. I get the following exception:

Caused by: com.microsoft.azure.storage.StorageException: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
at com.microsoft.azure.storage.StorageException.translateException(StorageException.java:87) ~[azure-storage-8.4.0.jar:?]
   at com.microsoft.azure.storage.core.StorageRequest.materializeException(StorageRequest.java:305) ~[azure-storage-8.4.0.jar:?]
    at com.microsoft.azure.storage.core.ExecutionEngine.executeWithRetry(ExecutionEngine.java:196) ~[azure-storage-8.4.0.jar:?]
    at com.microsoft.azure.storage.blob.BlobBatchOperation.execute(BlobBatchOperation.java:24) ~[azure-storage-8.4.0.jar:?]
   at com.microsoft.azure.storage.blob.CloudBlobClient.executeBatch(CloudBlobClient.java:796) ~[azure-storage-8.4.0.jar:?]
   at com.microsoft.azure.storage.blob.CloudBlobClient.executeBatch(CloudBlobClient.java:762) ~[azure-storage-8.4.0.jar:?]

This is true for account as well as service level SAS tokens now. I believe this worked before with service level SAS (before == in November of 2019).

Have you found a mitigation/solution?

The same exact code works fine when using normal key authentication. All other operations (putting blobs, deleting single blobs etc.) work as well. For now we can't move to bulk deletes as a result of this issue since we require SAS token auth to work but the SDK is not broken per-se since we can work around it by using single deletes.

rickle-msft commented 4 years ago

@original-brownbear Thank you for reporting this, and we apologize for the inconvenience. Would you be able to confirm the previous version of the SDK that worked for you with service sas authentication so we can hone in on where the regression is?

original-brownbear commented 4 years ago

@rickle-msft np, I just tried this again with 8.4.0 and it's broken as well. Not sure if I made a mistake back when I tested it (not sure how ... given how I specifically had to add code to generate the token and how the tokens my code generates work for all other operations though), but it's either I made a mistake or this is broken in the service now.

Also on the same subject, are there any plans of making both service & account SAS work with bulk deletes eventually?

grisha-kotler commented 4 years ago

Also an issue with the .NET SDK https://github.com/Azure/azure-sdk-for-net/issues/11762