Azure 表的授权标头失败，并显示 403 "Authoization header malformed"

Question

我拼凑了一些代码，授权给Microsoft Azure进行存储帐户表操作。

function TAzureStorageAPI.GetAuthHeader(RequestMethod,Ressource,Time:UTF8String): String;
Var
KeyBytes:TBytes;
DataBytes:TBytes;
TimeString,
StringtoSign:UTF8String;
begin
StringtoSign:=Uppercase(RequestMethod)+LF+                                  //RequestMethod
''+LF+                                                        //contentMD5
'application/json; charset=ISO-8859-1'+LF+                                //contentType
TimeString+LF+                                                //requestDate
Ressource;                                                    //Ressource
keyBytes:=TNetEncoding.Base64.DecodeStringToBytes(FAccessKey);
dataBytes:=TEncoding.UTF8.GetBytes(StringToSign);
result:= (TNetEncoding.Base64.EncodeBytesToString(THashSHA2.GetHMACAsBytes(dataBytes, keyBytes)));
end;
function TAzureStorageAPI.Insert(PartitionKey,RowKey:String; Data:tlkJSONObject):tlkJSONObject;
Var
PostHeaders:TStringlist;
Time:TDateTime;
TimeString:String;
begin
Socket.Request.Accept:='application/json;odata=minimalmetadata';
PostHeaders:=TStringlist.Create;
PostHeaders.Add('x-ms-version:2019-07-07');
Time:=TTimeZone.Local.ToUniversalTime(Now);
TimeString:=FormatDateTime('ddd, dd mmm yyyy hh:nn:ss',Time)+' UTC';
PostHeaders.Add('Date:'+TimeString);
PostHeaders.Add('MaxDataServiceVersion:3.0;NetFx');
PostHeaders.Add('DataServiceVersion:3.0;NetFx');
PostHeaders.Add('Authorization:SharedKey '+FStorageAccount+':'+GetAuthHeader('post','/'+FStorageAccount+'/'+FTable,TimeString));
Host:=FStorageAccount+'.table.core.windows.net';
Data.Add('PartitionKey',PartitionKey);
Data.add('RowKey',RowKey);
result:=WebPostData('/'+FTable,PostHeaders,Data)as tlkJSONObject;
PostHeaders.Free;
end;

• StorageAccount是我从SharedKey选项中获得的名称
• Table是表服务中资源的名称
• 并且AccessKey是SharedKey选项中的Key1

StringToSign是

'POST'#$A#$A'application/json; charset=ISO-8859-1'#$A'Mo, 27 Apr 2020 18:02:33 UTC'#$A'/smartflatlog/Log'

我没有对资源使用任何访问策略。

在修复了邮件头传递中的一个错误后，我看到了以下传输：

Ges 27.04.2020 20:02:48: POST /Log HTTP/1.1<EOL>Content-Type: application/json; charset=ISO-8859-1<EOL>Content-Length: 104<EOL>x-ms-version: 2019-07-07<EOL>Date: Mo, 27 Apr 2020 18:02:33 UTC<EOL>MaxDataServiceVersion: 3.0;NetFx<EOL>DataServiceVersion: 3.0;NetFx<EOL>Authorization: SharedKey smartflatlog:KVtJ*********************************A5zOME=<EOL>Host: smartflatlog.table.core.windows.net<EOL>Accept: application/json;odata=minimalmetadata<EOL>User-Agent: Demo<EOL><EOL>
Ges 27.04.2020 20:02:48: {"Level":"Debug","LogText":"something to note","Application":"Demo","PartitionKey":"Demo","RowKey":"13"}
Erh 27.04.2020 20:02:48: HTTP/1.1 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.<EOL>Content-Length: 299<EOL>Content-Type: application/json<EOL>Server: Microsoft-HTTPAPI/2.0<EOL>x-ms-request-id: 86f7fd8d-2002-0021-63be-1c5d47000000<EOL>x-ms-error-code: AuthenticationFailed<EOL>Date: Mon, 27 Apr 2020 18:02:49 GMT<EOL><EOL>{"odata.error":{"code":"AuthenticationFailed","message":{"lang":"en-US","value":"Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.nRequestId:86f7fd8d-2002-0021-63be-1c5d47000000nTime:2020-04-27T18:02:49.6860540Z"}}}

Answer 1

如果你想插入一个带有Sharekey auth的实体，stringtosign应该像一样

StringToSign = VERB + "n" +
Content-MD5 + "n" +
Content-Type + "n" +  
Date + "n" +  
CanonicalizedResource;  

例如

RequestMethod:= 'GET';
dateInRfc1123Format:= TTimeZone.Local.ToUniversalTime(Now);
TheDate:= formatdatetime('ddd, dd mmm yyyy hh:nn:ss "GMT"',dateInRfc1123Format);
contentType:='application/json;odata=nometadata'
canonicalizedResource:= "/yourAccount/yourTable"
stringToSign:= format('%sn'+ // request method
'n' + // content md5
'%sn' + // content type
'%sn' + // date
'%s', // canonicalized ResourceL,
[RequestMethod,
contentType,
TheDate,
canonicalizedResource]);

有关更多详细信息，请参阅文档和文档