Returns a shared access signature for the blob. Namespace: Microsoft.WindowsAzure.StorageClient
Assembly: Microsoft.WindowsAzure.StorageClient (in Microsoft.WindowsAzure.StorageClient.dll)
Usage
| Visual Basic |
|---|
Dim instance As CloudBlob Dim policy As SharedAccessPolicy Dim returnValue As String returnValue = instance.GetSharedAccessSignature(policy) |
Syntax
| Visual Basic |
|---|
Public Function GetSharedAccessSignature ( _ policy As SharedAccessPolicy _ ) As String |
| C# |
|---|
public string GetSharedAccessSignature ( SharedAccessPolicy policy ) |
| C++ |
|---|
public: String^ GetSharedAccessSignature ( SharedAccessPolicy^ policy ) |
| J# |
|---|
| JScript |
|---|
Parameters
- policy
Type: Microsoft.WindowsAzure.StorageClient.SharedAccessPolicy
The access policy for the shared access signature.
Return Value
Type: System.StringA shared access signature.Example
The following code example creates a shared access signature for a blob. It then uses the signature to create a service client based on the shared access credentials, and uses the client to perform a write operation and a read operation against the blob.
| C# | Copy Code |
|---|---|
static void WriteToBlobViaSAS(Uri blobEndpoint, string accountName, string accountKey)
{
// Create service client for credentialed access to the Blob service.
CloudBlobClient blobClient =
new CloudBlobClient(blobEndpoint, new StorageCredentialsAccountAndKey(accountName, accountKey));
CloudBlob blob = blobClient.GetBlobReference("mycontainer/myblob.txt");
// Upload text to the blob, which will create it if it does not already exist.
blob.UploadText("a text blob");
// Create a shared access signature to use for delegated access to the blob.
// Specify an access policy which indicates the start time, expiry time, and permissions
// granted for the signature.
string signature = blob.GetSharedAccessSignature(new SharedAccessPolicy()
{
// If valid immediately, don’t set SharedAccessStartTime,
// And use a duration below 1 hour
// to avoid clock skew risk.
// SharedAccessStartTime = DateTime.Now,
// Specify the expiration time for the signature.
SharedAccessExpiryTime = DateTime.Now.AddMinutes(55),
// Specify the permissions granted by the signature.
Permissions = SharedAccessPermissions.Write | SharedAccessPermissions.Read
});
// Get a reference to the blob using the shared access signature.
CloudBlob blobSAS = new CloudBlob("http://storagesample.blob.core.windows.net/mycontainer/myblob.txt",
new StorageCredentialsSharedAccessSignature(signature));
// Update the contents of the blob, then read them.
blobSAS.UploadText("a text blob updated using a shared access signature");
Console.WriteLine(blobSAS.DownloadText());
}
| |
Exceptions
| Exception type | Condition |
|---|---|
| InvalidOperationException | Thrown if the current credentials don't support creating a shared access signature. |
| NotSupportedException | Thrown if blob is a snapshot. |
Remarks
A shared access signature is a token that provides delegated access to blob resources. You can provide this token to clients in order to grant them specific permissions to resources for a controlled period of time. A shared access signature created for a blob resource can grant access just to the content and metadata of that blob.
A shared access signature created for a container resource can grant access to the content and metadata of any blob in the container, and to the list of blobs in the container. To create a shared access signature for a container, see the GetSharedAccessSignature method of the CloudBlobContainer object.
The parameters of the shared access signature that govern access are:
The start time at which the signature becomes valid.
The time at which it expires.
The permissions that it grants.
These parameters are specified in an access policy, represented by the SharedAccessPolicy class. There are three ways to specify an access policy:
You can specify it on a single shared access signature. In this case, the interval over which the signature may be valid is limited to one hour.
You can specify it by creating a container-level access policy, which can be associated with one or more shared access signatures. This approach has the advantage of making it possible to revoke a shared access signature, if it should be compromised. To specify that the access policy should be used by the signature, call the overload that includes the groupPolicyIdentifier parameter.
You can also specify some parameters of the access policy on the signature and some on a container-level access policy. Note that you cannot specify the same parameter in both places; doing so results in an error (HTTPStatusCode.BadRequest).
Note that when you regenerate your account key, any shared access signature generated using the original key is no longer valid.
For more information on shared access signatures, see Creating a Shared Access Signature. For details on container-level access policies, see Specifying a Container-Level Access Policy.