允许选定用户访问 Azure 存储节点？
给定 Azure 存储上的存储文件（blob、表或队列 - 无关紧要），是否可以允许所有人访问它，但仅基于权限？
例如，我有大量图像存储，以及包含用户和授权的数据库。我希望用户 X 只能访问图像 Y 和 Z。因此，该 URL 通常无法访问，除非您提供某种临时安全令牌。这怎么可能？ 我知道我可以将存储与外界隔离，只允许通过应用程序检查这些内容来访问它，但这需要应用程序也位于 Azure 上，并且本地应用程序将无法提供Azure 存储中的任何内容。
据我了解，大多数 CDN 都提供这种功能，我当然希望 Azure 也能为此提供解决方案！
伊塔玛。
Given a stored file on Azure Storage (blobs, tables or queues -- doesn't matter), is it possible to allow access to it for all, but only based on permissions?
For example, I have a big storage of images, and a DB containing users and authorizations. I want user X to only be able to access images Y and Z. So, the URL will be generally inaccessible, unless you provide some sort of a temporary security token along with it. How's that possible?
I know I can shut the storage from the outside world, and allow access to it only through an application checking this stuff, but this would require the application to be on Azure as well, and on-premise app won't be able to deliver any content from Azure Storage.
It is from my understanding that most CDNs provide such capability, and I sure hope so Azure provides a solution for this as well!
Itamar.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为您无法实现这种级别的访问过滤。我所知道的唯一方法在这篇 msdn 文章
管理对容器的访问中 进行了描述和 Blobs
以及这里的博客，描述了实现它的一小部分代码
在 Windows Azure 存储中使用容器级访问策略
我不确定这是否满足您的需求。如果我理解正确的话我会这样做：
1. 在与角色匹配的容器中组织内容
2. 在您的本地应用程序上检查用户是否具有访问权限，如果是，则生成正确的 URL 以授予他对资源的临时访问权限。
当然，这仅在用户必须通过中心点才能访问 blob 中的内容时才有效。如果他们为生成的链接添加书签，一旦过期日期就会失败。
祝你好运。
I don't think you can achieve this level of access filtering. The only methods I'm aware of are described in this msdn article
Managing Access to Containers and Blobs
and here a blog that describes a little part of code to implement it
Using Container-Level Access Policies in Windows Azure Storage
I'm not sure this would fit your need. If I understood it right I would do it this way :
1. Organize your content in container that match the roles
2. On your on premise application check if user has access and if yes generate the right URL to give him a temporary access to the resource.
Of course this only works if the users have to go through a central point to get access to the content in the blob. If they bookmark the generated link it will fail once the expiration date is passed.
Good luck.
这实际上可以通过 Blob 存储来实现。考虑 (a) 类似资源管理器的 UI，以及 (b) 用户已经过身份验证（可以使用访问控制服务，但不需要）。
类似资源管理器的 UI 可以公开适合经过身份验证的用户的资源。对这些资源的底层访问将以适合对象的粒度进行共享访问签名控制 - 例如，限制只能查看文件夹中的一个文件或整个文件夹，或者限制在文件夹中创建文件的能力等。 ，都可以表达。
这个类似于浏览器的 UI，但需要访问为给定用户提供正确文件的逻辑，同时还根据需要创建适当的共享访问签名。请注意，此逻辑不需要托管在 Azure 中，而只需要访问正确的存储密钥（从 Azure 门户）。
This is actually possible to implement with Blob storage. Consider (a) a UI that is like explorer, and (b) that users are already authenticated (could use Access Control Service, but don't need to).
The explorer-like UI could expose resources that are appropriate to the authenticated user. The underlying access to these resources would be Shared Access Signature-controlled at the granularity appropriate for the objects - for example, restrict only see one file in a folder, or the whole folder, or ability to create a file in a folder, etc., can all be expressed.
This explorer-like UI but would need access to logic that would present the right files for a given user, while also creating the appropriate Shared-Access-Signatures as needed. Note that this logic would not need to be hosted in Azure, rather would just need access to the proper storage key (from the Azure portal).