Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add signed encryption scope field to string-to-sign for authorization for SAS #134

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

psolymos
Copy link

@psolymos psolymos commented Apr 20, 2023

Helo, I have encountered an issue with SAS and this PR represents a fix referencing Azure SAS spec changes:

  1. https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#version-2020-12-06-and-later
  2. https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas#version-2020-12-06-and-later (actually the docs are also wrong there omitting the rsct field)

Here is how the user delegation SAS fields lined up:

spec pkg
signedPermissions permissions
signedStart dates$start
signedExpiry dates$expiry
canonicalizedResource resource
signedKeyObjectId key$SignedOid
signedKeyTenantId key$SignedTid
signedKeyStart key$SignedStart
signedKeyExpiry key$SignedExpiry
signedKeyService key$SignedService
signedKeyVersion key$SignedVersion
signedAuthorizedUserObjectId
signedUnauthorizedUserObjectId
signedCorrelationId
signedIP ip
signedProtocol protocol
signedVersion auth_api_version
signedResource resource_type
signedSnapshotTime snapshot_time
signedEncryptionScope MISSING
rscc
rscd
rsce
rscl
rsct

Because of this, I was getting Signature did not match. String to sign used was ... error. Installing from my fork resolved the issue.

Cheers!

signedEncryptionScope is needed
for string-to-sign for authorization
version 2020-12-06 and later

Signed-off-by: Peter Solymos <psolymos@gmail.com>
Version 2020-12-06 adds support
for the signed encryption scope
field

Signed-off-by: Peter Solymos <psolymos@gmail.com>
@hongooi73
Copy link
Collaborator

Hmm, I don't recall running into problems with SAS, but this was some time ago

@psolymos
Copy link
Author

@hongooi73 any plans for merging this for a new CRAN release? Thanks.

@sam-bradshaw-wcmc
Copy link

sam-bradshaw-wcmc commented Nov 29, 2024

I have also encountered problems with the SAS tokens generated by this library (with a similar error message), and it looks like I'm not the only one #140

This post was actually very helpful for me to help work around the issue. If I set auth_api_version="2020-10-02" the SAS token generated start working. The API version needs to be one before 2020-12-06 in which this breaking change seems to have occurred

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants