Unable to access adls gen2 from synapse using sas token

Question

Unable to access adls gen2 from synapse using sas token

Guruprasad Kulkarni 60

Hi Team,

I am unable to access adls gen 2 from synapse using sas token. Note that I can access the same folder/container using other option like 'Account Key' or 'System assigned managed Identity'. However, using SAS URI option, I am getting below error.

User's image

Aswin S 492 Reputation points

2023-12-24T16:57:32.65+00:00

While creating SAS token in ADLS gen2, make sure that SAS token is not expired and it has container, object level access. In order to check if your current SAS token is expired, you can check the date in se= from SAS token. Similarly, you can check if it has container or object level access, you can check from the srt= part of SAS token. Check the value of srt has c for container and o for object .

SAS token example screenshot

If you want to generate the new SAS token, make sure to check the container checkbox in allowed resource type and give the proper expiry date.

SAS token creation in azure portal - screenshot
Guruprasad Kulkarni 60 Reputation points

2023-12-25T05:56:24.5033333+00:00

Thanks for response! But in my case, I am creating SAS token from my azure portal using right click on the container name. I have also verified expiry date of SAS token and looks ok. I am still getting issue. Interestingly, when I try to access blob storage from ADF/synapse using SAS token, it works. The problem occurs when I tried to access ADLS Gen 2.
Aswin S 492 Reputation points

2023-12-25T15:16:22.7033333+00:00

Since you are creating container level SAS token, while creating linked service in ADF, make sure you are clicking to file path option in Test connection. Give the container name in the file path. Then test the connection. linked service screenshot
Guruprasad Kulkarni 60 Reputation points

2023-12-25T16:56:56.5433333+00:00

Still issue persists.
Aswin S 492 Reputation points

2023-12-25T17:24:46.9166667+00:00

Give SAS URL and token in below format

SAS URL format: https://dludemypracticte4.dfs.core.windows.net

SAS token: ?sp=r..............
Guruprasad Kulkarni 60 Reputation points

2023-12-25T17:49:29.6633333+00:00

I am able to make the connection. However, there seems some issue from microsoft side. for ADLS, SAS URL should be https://<account-name>.dfs.core.windows.net. As of now, it is created as https://<account-name>.blob.core.windows.net. Also, another learning is that even if we want only read access on the container, we also need to select 'list' access as well. Can you guys make these changes as it is easy to forget for users?

Anyway, Thank you for tirelessly suggesting different solution! You can close this thread.
Aswin S 492 Reputation points

2023-12-25T18:05:12.7266667+00:00

Sure. I am posting this as answer. If this answers your question, you may accept, upvote that.

Answer accepted by question author

0 additional answers

Your answer

Aswin S 492 Reputation points

2023-12-24T16:57:32.65+00:00

While creating SAS token in ADLS gen2, make sure that SAS token is not expired and it has container, object level access. In order to check if your current SAS token is expired, you can check the date in se= from SAS token. Similarly, you can check if it has container or object level access, you can check from the srt= part of SAS token. Check the value of srt has c for container and o for object .

SAS token example screenshot

If you want to generate the new SAS token, make sure to check the container checkbox in allowed resource type and give the proper expiry date.

SAS token creation in azure portal - screenshot
Guruprasad Kulkarni 60 Reputation points

2023-12-25T05:56:24.5033333+00:00

Thanks for response! But in my case, I am creating SAS token from my azure portal using right click on the container name. I have also verified expiry date of SAS token and looks ok. I am still getting issue. Interestingly, when I try to access blob storage from ADF/synapse using SAS token, it works. The problem occurs when I tried to access ADLS Gen 2.
Aswin S 492 Reputation points

2023-12-25T15:16:22.7033333+00:00

Since you are creating container level SAS token, while creating linked service in ADF, make sure you are clicking to file path option in Test connection. Give the container name in the file path. Then test the connection. linked service screenshot
Guruprasad Kulkarni 60 Reputation points

2023-12-25T16:56:56.5433333+00:00

Still issue persists.
Aswin S 492 Reputation points

2023-12-25T17:24:46.9166667+00:00

Give SAS URL and token in below format

SAS URL format: https://dludemypracticte4.dfs.core.windows.net

SAS token: ?sp=r..............
Guruprasad Kulkarni 60 Reputation points

2023-12-25T17:49:29.6633333+00:00

I am able to make the connection. However, there seems some issue from microsoft side. for ADLS, SAS URL should be https://<account-name>.dfs.core.windows.net. As of now, it is created as https://<account-name>.blob.core.windows.net. Also, another learning is that even if we want only read access on the container, we also need to select 'list' access as well. Can you guys make these changes as it is easy to forget for users?

Anyway, Thank you for tirelessly suggesting different solution! You can close this thread.
Aswin S 492 Reputation points

2023-12-25T18:05:12.7266667+00:00

Sure. I am posting this as answer. If this answers your question, you may accept, upvote that.

Answer 1

Aswin S 492

Since you are creating container level SAS token, while creating linked service in ADF, make sure you are clicking to file path option in Test connection. Give the container name in the file path.
Also, make sure the format of SAS URL looks like https://<account-name>.dfs.core.windows.net while creating linked service.

linked service screenshot

Share via

Unable to access adls gen2 from synapse using sas token

0 additional answers

Your answer