Skip to content

Commit 985ebfe

Browse files
pauljewellmsftpauljewellmsft
committed
Combine SAS articles for containers and blobs
1 parent e10647e commit 985ebfe

File tree

2 files changed

+91
-12
lines changed

2 files changed

+91
-12
lines changed

‎articles/storage/blobs/sas-service-create-java.md

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,49 @@
11
---
22
title: Create a service SAS for a blob with Java
33
titleSuffix: Azure Storage
4-
description: Learn how to create a service shared access signature (SAS) for a blob using the Azure Blob Storage client library for Java.
4+
description: Learn how to create a service shared access signature (SAS) for a container or blob using the Azure Blob Storage client library for Java.
55
author: pauljewellmsft
66

77
ms.service: azure-blob-storage
88
ms.topic: how-to
9-
ms.date: 08/05/2024
9+
ms.date: 09/06/2024
1010
ms.author: pauljewell
1111
ms.reviewer: nachakra
1212
ms.devlang: java
1313
ms.custom: devx-track-java, devguide-java, engagement-fy23, devx-track-java, devx-track-extended-java
1414
---
1515

16-
# Create a service SAS for a blob with Java
16+
# Create a service SAS for a container or blob with Java
1717

1818
[!INCLUDE [storage-dev-guide-selector-service-sas](../../../includes/storage-dev-guides/storage-dev-guide-selector-service-sas.md)]
1919

2020
[!INCLUDE [storage-auth-sas-intro-include](../../../includes/storage-auth-sas-intro-include.md)]
2121

22-
This article shows how to use the storage account key to create a service SAS for a blob with the Blob Storage client library for Java.
22+
This article shows how to use the storage account key to create a service SAS for a container or blob with the Blob Storage client library for Java.
2323

2424
## About the service SAS
2525

2626
A service SAS is signed with the account access key. You can use the [StorageSharedKeyCredential](/java/api/com.azure.storage.common.storagesharedkeycredential) class to create the credential that is used to sign the service SAS.
2727

2828
You can also use a stored access policy to define the permissions and duration of the SAS. If the name of an existing stored access policy is provided, that policy is associated with the SAS. To learn more about stored access policies, see [Define a stored access policy](/rest/api/storageservices/define-stored-access-policy). If no stored access policy is provided, the code examples in this article show how to define permissions and duration for the SAS.
2929

30-
## Create a service SAS for a blob
30+
## Create a service SAS
31+
32+
You can create a service SAS for a container or blob, based on the needs of your app.
33+
34+
### [Container](#tab/container)
35+
36+
You can create a service SAS to delegate limited access to a container resource using the following method:
37+
38+
- [generateSas](/java/api/com.azure.storage.blob.specialized.blobclientbase#method-details)
39+
40+
SAS signature values, such as expiry time and signed permissions, are passed to the method as part of a [BlobServiceSasSignatureValues](/java/api/com.azure.storage.blob.sas.blobservicesassignaturevalues) instance. Permissions are specified as a [BlobContainerSasPermission](/java/api/com.azure.storage.blob.sas.blobcontainersaspermission) instance.
41+
42+
The following code example shows how to create a service SAS with read permissions for a container resource:
43+
44+
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_CreateServiceSASContainer":::
45+
46+
### [Blob](#tab/blob)
3147

3248
You can create a service SAS to delegate limited access to a blob resource using the following method:
3349

@@ -39,8 +55,35 @@ The following code example shows how to create a service SAS with read permissio
3955

4056
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_CreateServiceSASBlob":::
4157

58+
---
59+
4260
## Use a service SAS to authorize a client object
4361

62+
You can use a service SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.
63+
64+
### [Container](#tab/container)
65+
66+
The following code examples show how to use the service SAS to authorize a [BlobContainerClient](/java/api/com.azure.storage.blob.blobcontainerclient) object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.
67+
68+
First, create a [BlobServiceClient](/java/api/com.azure.storage.blob.blobserviceclient) object signed with the account access key:
69+
70+
```java
71+
String accountName = "<account-name>";
72+
String accountKey = "<account-key>";
73+
StorageSharedKeyCredential credential = new StorageSharedKeyCredential(accountName, accountKey);
74+
75+
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
76+
.endpoint(String.format("https://%s.blob.core.windows.net/", accountName))
77+
.credential(credential)
78+
.buildClient();
79+
```
80+
81+
Then, generate the service SAS as shown in the earlier example and use the SAS to authorize a [BlobContainerClient](/java/api/com.azure.storage.blob.blobcontainerclient) object:
82+
83+
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_UseServiceSASContainer":::
84+
85+
### [Blob](#tab/blob)
86+
4487
The following code example shows how to use the service SAS created in the earlier example to authorize a [BlobClient](/java/api/com.azure.storage.blob.blobclient) object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.
4588

4689
First, create a [BlobServiceClient](/java/api/com.azure.storage.blob.blobserviceclient) object signed with the account access key:
@@ -60,10 +103,16 @@ Then, generate the service SAS as shown in the earlier example and use the SAS t
60103

61104
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_UseServiceSASBlob":::
62105

106+
---
107+
63108
## Resources
64109

65110
To learn more about using the Azure Blob Storage client library for Java, see the following resources.
66111

112+
### Code samples
113+
114+
- [View code samples from this article (GitHub)](https://github.com/Azure-Samples/AzureStorageSnippets/blob/master/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java)
115+
67116
[!INCLUDE [storage-dev-guide-resources-java](../../../includes/storage-dev-guides/storage-dev-guide-resources-java.md)]
68117

69118
### See also

‎articles/storage/blobs/storage-blob-user-delegation-sas-create-java.md

Lines changed: 37 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,53 @@
11
---
22
title: Create a user delegation SAS for a blob with Java
33
titleSuffix: Azure Storage
4-
description: Learn how to create a user delegation SAS for a blob with Microsoft Entra credentials by using the Azure Storage client library for Java.
4+
description: Learn how to create a user delegation SAS for a container or blob with Microsoft Entra credentials by using the Azure Storage client library for Java.
55
services: storage
66
author: pauljewellmsft
77
ms.author: pauljewell
88
ms.service: azure-blob-storage
99
ms.topic: how-to
10-
ms.date: 08/05/2024
10+
ms.date: 09/06/2024
1111
ms.reviewer: dineshm
1212
ms.devlang: java
1313
ms.custom: devx-track-java, devguide-java, devx-track-extended-java
1414
---
1515

16-
# Create a user delegation SAS for a blob with Java
16+
# Create a user delegation SAS for a container or blob with Java
1717

1818
[!INCLUDE [storage-dev-guide-selector-user-delegation-sas](../../../includes/storage-dev-guides/storage-dev-guide-selector-user-delegation-sas.md)]
1919

2020
[!INCLUDE [storage-auth-sas-intro-include](../../../includes/storage-auth-sas-intro-include.md)]
2121

22-
This article shows how to use Microsoft Entra credentials to create a user delegation SAS for a blob using the [Azure Storage client library for Java](/java/api/overview/azure/storage-blob-readme).
22+
This article shows how to use Microsoft Entra credentials to create a user delegation SAS for a container or blob using the [Azure Storage client library for Java](/java/api/overview/azure/storage-blob-readme).
2323

2424
[!INCLUDE [storage-auth-user-delegation-include](../../../includes/storage-auth-user-delegation-include.md)]
2525

2626
## Assign Azure roles for access to data
2727

28-
When a Microsoft Entra security principal attempts to access blob data, that security principal must have permissions to the resource. Whether the security principal is a managed identity in Azure or a Microsoft Entra user account running code in the development environment, the security principal must be assigned an Azure role that grants access to blob data. For information about assigning permissions via Azure RBAC, see [Assign an Azure role for access to blob data](assign-azure-role-data-access.md).
28+
When a Microsoft Entra security principal attempts to access data, that security principal must have permissions to the resource. Whether the security principal is a managed identity in Azure or a Microsoft Entra user account running code in the development environment, the security principal must be assigned an Azure role that grants access to data. For information about assigning permissions via Azure RBAC, see [Assign an Azure role for access to blob data](assign-azure-role-data-access.md).
2929

3030
[!INCLUDE [storage-dev-guide-user-delegation-sas-java](../../../includes/storage-dev-guides/storage-dev-guide-user-delegation-sas-java.md)]
3131

32-
## Create a user delegation SAS for a blob
32+
## Create a user delegation SAS
3333

34-
Once you've obtained the user delegation key, you can create a user delegation SAS. You can create a user delegation SAS to delegate limited access to a blob resource using the following method from a [BlobClient](/java/api/com.azure.storage.blob.blobclient) instance:
34+
You can create a user delegation SAS for a container or blob, based on the needs of your app.
35+
36+
### [Container](#tab/container)
37+
38+
Once you've obtained the user delegation key, you can create a user delegation SAS. You can create a user delegation SAS to delegate limited access to a container resource using the following method from a [BlobContainerClient](/java/api/com.azure.storage.blob.blobcontainerclient) instance:
39+
40+
- [generateUserDelegationSas](/java/api/com.azure.storage.blob.specialized.blobclientbase#method-details)
41+
42+
The user delegation key to sign the SAS is passed to this method along with specified values for [BlobServiceSasSignatureValues](/java/api/com.azure.storage.blob.sas.blobservicesassignaturevalues). Permissions are specified as a [BlobContainerSasPermission](/java/api/com.azure.storage.blob.sas.blobcontainersaspermission) instance.
43+
44+
The following code example shows how to create a user delegation SAS for a container:
45+
46+
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_CreateUserDelegationSASContainer":::
47+
48+
### [Blob](#tab/blob)
49+
50+
Once you've obtained the user delegation key, you can create a user delegation SAS. You can create a user delegation SAS to delegate limited access to a blob using the following method from a [BlobClient](/java/api/com.azure.storage.blob.blobclient) instance:
3551

3652
- [generateUserDelegationSas](/java/api/com.azure.storage.blob.specialized.blobclientbase#method-details)
3753

@@ -41,12 +57,26 @@ The following code example shows how to create a user delegation SAS for a blob:
4157

4258
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_CreateUserDelegationSASBlob":::
4359

60+
---
61+
4462
## Use a user delegation SAS to authorize a client object
4563

64+
You can use a user delegation SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.
65+
66+
### [Container](#tab/container)
67+
68+
The following code example shows how to use the user delegation SAS created in the earlier example to authorize a [BlobContainerClient](/java/api/com.azure.storage.blob.blobcontainerclient) object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.
69+
70+
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_UseUserDelegationSASContainer":::
71+
72+
### [Blob](#tab/blob)
73+
4674
The following code example shows how to use the user delegation SAS created in the earlier example to authorize a [BlobClient](/java/api/com.azure.storage.blob.blobclient) object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.
4775

4876
:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_UseUserDelegationSASBlob":::
4977

78+
---
79+
5080
## Resources
5181

5282
To learn more about creating a user delegation SAS using the Azure Blob Storage client library for Java, see the following resources.

0 commit comments

Comments
 (0)