Azure Blob存储BLOB从Azure Active Directory（Azure AD）身份验证访问

Question

 ClientSecretCredential clientSecret = new ClientSecretCredentialBuilder()
          .clientId("********-****-****-****-************").tenantId(
          "********-****-****-****-************")
          .clientSecret("*****~***************************~******").build();
        
        BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
                .credential(clientSecret)
                .endpoint("https://sambhutestsa.blob.core.windows.net/")
                .buildClient();
        
        
            
        BlobContainerClient blobContainerClient = blobServiceClient.getBlobContainerClient("testcontainer");
        
        
        System.out.printf("Identifier for the snapshot is %s%n", blobContainerClient.getBlobClient("2824891.jpg").downloadToFile("C:\\Users\\ss255248\\2824891.jpg");

但是遇到这个错误可以在这里提供帮助。

Exception in thread "main" com.azure.storage.blob.models.BlobStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:d813ea5f-d01e-004d-7b0f-656de3000000
Time:2022-05-11T08:13:50.0902556Z</Message></Error>

Answer 1

要解决错误，请尝试以下操作：

确保您是否具有以下角色分配给安全局的：

• storage blob数据贡献者
• storage noreferrer“> storage blob data所有者< /a>

如果没有，请确保 分配 如下所示：

转到Azure Portal - ＆gt;识别所需范围（订阅/资源组） - ＆gt;访问控制（IAM） - ＆GT;添加角色分配

• 检查您的应用程序是否以下 api permissions ：

有关更多信息，请参阅/strong> this msdoc ：

• 否则，尝试将时区设置为 utc-0 。
• 尝试将 comp = list＆amp; restype =容器 作为解决方法。
• 利用此 so thread 。

有关更多详细信息，请请参阅下面的链接链接：

Azure应用程序服务拒绝了403错误的存储帐户 - 堆栈溢出

[已解决] azure共享访问签名 - 签名不匹配 - 本地编码器