Is there a way to programmatically generate Azure SaS token for Blob container even when the user is not authenticated with SaS token java

Question

I am authenticating my user using ClientCredentails. My client does have the permission to generate SaS token. Now I want to generate SaS token from code for a short period of time so that the customer can directly download the file.

  String tenantId = "TenantId";  
        String clientSecret = "XXXX"  
        String clientId = "abc-123"  
  
        String authorityUrl = AzureAuthorityHosts.AZURE_PUBLIC_CLOUD +  tenantId;  
  
        ClientSecretCredential credential = new ClientSecretCredentialBuilder()  
                .authorityHost(authorityUrl)  
                .tenantId(tenantId)  
                .clientSecret(clientSecret)  
                .clientId(clientId)  
                .build();  
  
  
         BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()  
                    .credential(credential)  
                    .endpoint(azureStorageEndPoint)  
                    .buildClient();   
  
  
        // Upload a file              
        BlobContainerClient blobContainerClient = blobServiceClient.getBlobContainerClient(containerName);              
        BlobClient blobClient = blobContainerClient.getBlobClient("Test.txt");  
        BufferedInputStream bufferedInputStream = new BufferedInputStream(new FileInputStream(new File("<FILE_PATH>")));  
        blobClient.upload(bufferedInputStream, bufferedInputStream.available(),true);       
  
  
        BlobSasPermission blobSasPermission = new BlobSasPermission().setReadPermission(true);  
        OffsetDateTime expiryTime = OffsetDateTime.now().plusDays(1);  
        BlobServiceSasSignatureValues values = new BlobServiceSasSignatureValues(expiryTime, blobSasPermission)  
                    .setStartTime(OffsetDateTime.now());  
  
        String generateSas = blobClient.generateSas(values);  
  
  
  
        Getting Error   
  
        java.lang.NullPointerException: The argument must not be null or an empty string. Argument name: storageSharedKeyCredentials.  
  


    

Tried to find some azure docs which clearly says that "Client must be authenticated via StorageSharedKeyCredential"

https://learn.microsoft.com/en-us/java/api/com.azure.storage.blob.blobserviceclient.generateaccountsas?view=azure-java-stable

Question is how to generate StorageSharedKeyCredential programmatically if your code is authenticating with different ways.

Answer 1

@Rajan Shah Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

We don't yet have a Java example, but they should be able to follow the guidance for .NET to create a user delegation SAS, which is signed with Azure AD credentials (instead of the account key):
https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-dotnet

If you wish you can leave your Feedback/UserVoice here. All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

I was able to solve this

https://stackoverflow.com/questions/71832839/is-there-a-way-to-programmatically-generate-azure-sas-token-for-blob-container-e/71861252#71861252