User Delegation SAS Token for Blog Storage

 

Photo from  Kaique Rocha on Pexels.com

In my previous blog, Azure Blob Storage: SAS Token, we talked about using Azure Blob Storage Account key to generate Shared Access Signature (SAS) token. In this blog, we are going to show how to generate a User Delegation SAS token. 

I created a Service Principal (you can create an Application ID instead if you wish to) and assigned Storage Blob Data Contributor to it. This role assignment is required for this form of token to work.

1. Setup

1.1 Export Environment Parameters

STORAGE_ACCOUNT_URL=<storage account URL>
STORAGE_CONTAINER_NAME=<storage container name>
STORAGE_BLOB_NAME=<storage blob name>
AZURE_CLIENT_ID=<service principal or app id>
AZURE_CLIENT_SECRET=<service principal or app secret>
AZURE_TENANT_ID=<tenant id>

1.2 Install Python package

pip install azure-identity
pip install azure-storage-blob

2. Code

Copy the code below to a file named main.py and execute it accordingly. python main.py

import datetime
import os

from azure.identity import DefaultAzureCredential
import azure.storage.blob as azureblob
from azure.storage.blob import BlobServiceClient

config = {
    "STORAGE_ACCOUNT_URL": os.getenv("STORAGE_ACCOUNT_URL"),
    "STORAGE_CONTAINER_NAME": os.getenv("STORAGE_CONTAINER_NAME"),
    "STORAGE_BLOB_NAME": os.getenv("STORAGE_BLOB_NAME"),
}

if __name__ == "__main__":
    blob_client = azureblob.BlobServiceClient(
        config["STORAGE_ACCOUNT_URL"], credential=DefaultAzureCredential()
    )

    start = datetime.datetime.utcnow()
    end = start + datetime.timedelta(hours=1)

	# start and end time is the lifespan of the user token.
    # it cannot be long than 1 hour.
    user_token = blob_client.get_user_delegation_key(start, end)

    # generate container based token
    container_sas_token = azureblob.generate_container_sas(
        account_name=blob_client.account_name,
        container_name=config["STORAGE_CONTAINER_NAME"],
        user_delegation_key=user_token, # this is used in place of account account_key
        permission=azureblob.AccountSasPermissions(read=True, list=True),
        expiry=end,
    )
    print(container_sas_token)

    # generate blob based token
    blob_sas_token = azureblob.generate_blob_sas(
        account_name=blob_client.account_name,
        user_delegation_key=user_token, # this is used in place of account account_key
        container_name=config["STORAGE_CONTAINER_NAME"],
        blob_name=config["STORAGE_BLOB_NAME"],
        permission=azureblob.AccountSasPermissions(read=True),
        start=start,
        expiry=end,
    )
    print(blob_sas_token)

The code is self-explanatory as it is very identical to the one in Azure Blob Storage: SAS Token, Much of the information that we need to know about this form of token can be found here. This is a user delegated token hence it is not allowed to perform actions on the blob if the user does not have permissions to do the same. However, the SAS token that is generated with Blog Storage Account Key can perform all granted actions.

This User Delegation SAS Token is relatively new. Please read this announcement for more information.