Forum Discussion

SachinNandanwar's avatar
SachinNandanwar
Icon for Impactful Individual rankImpactful Individual
1 year ago

SAS Token in fabric-Not Working

I created a SAS token for Fabric but it gives an error when I try to use it.   I am unsure as to why is the request expecting a bearer token while using SAS ? Here are the parameter...
lakehouse
Yao-MSFT's avatar
Yao-MSFT
Icon for Microsoft Employee rankMicrosoft Employee
1 year ago

Hi SachinNandanwar, I see some code in your blog that needs to be changed, could you please make following changes to your code and try again?

  • Use the endpoint  https://onelake.dfs.fabric.microsoft.com to construct the DataLakeServiceClient
  • Use following code to construct the DataLakeSasBuilder, _keyStartTime and _keyExpiryTime should be the same value that you used when getting the user delegation key.

 

DataLakeSasBuilder sasBuilder = new DataLakeSasBuilder()
{
    FileSystemName = workspaceName,
    Resource = "d",
    IsDirectory = true,
    Path = lakehouseName, // Should be {your lakehouse}.Lakehouse/Files
    StartsOn = _keyStartTime,
    ExpiresOn = _keyExpiryTime
};

 

  •  Use onelake as the account name instead of the endpoint when calling ToSasQueryParameters
  • SachinNandanwar's avatar
    SachinNandanwar
    Icon for Impactful Individual rankImpactful Individual
    1 year ago

    Hi Yao-MSFT ,

    I am using onelake.dfs endpoints. See the belwo screenshot of the code from my blog where I set the endpoint values to a variable.



    Also, If you check my earlier screenshots of POST MAN in this post, you can see that I am using dfs endpoints.

    and my delegation expiration is set to an hour from the time the SAS token is generated


    The SAS token expiry is also set to an hour


    After making your suggested changes its still the same error

    • YKXC's avatar
      YKXC
      Regular Visitor
      1 year ago

      I was having this same issue for a few days trying to figure out what the problem is. I finally got it to work in Python with the following code:

       

      # Requires 'pip install azure-storage-file-datalake azure-identity'
from azure.storage.filedatalake import (
    DataLakeServiceClient,
    generate_directory_sas,
)
from azure.identity import DefaultAzureCredential
from datetime import datetime, timedelta
import pytz


def get_user_delegation_sas(workspace: str, data_path: str) -> str:
    """
    Generates a User Delegation SAS token for accessing a Data Lake in Azure.
    """
    token_credential = DefaultAzureCredential()
    service_client = DataLakeServiceClient(
        account_url="https://onelake.dfs.fabric.microsoft.com",
        credential=token_credential
    )

    # Get a user delegation key that's valid for 30 minutes
    delegation_key_start_time = (datetime.now(pytz.utc) - timedelta(minutes=5)).replace(second=0, microsecond=0)
    delegation_key_expiry_time = delegation_key_start_time + timedelta(minutes=30)
    user_delegation_key = service_client.get_user_delegation_key(
        key_start_time=delegation_key_start_time,
        key_expiry_time=delegation_key_expiry_time,
    )

    return generate_directory_sas(
        account_name="onelake",
        file_system_name=workspace,
        directory_name=data_path,
        credential=user_delegation_key,
        permission="racwdl",
        expiry=delegation_key_expiry_time,
        start=delegation_key_start_time,
    )


if __name__ == "__main__":
    ACCOUNT_URL = "https://onelake.dfs.fabric.microsoft.com"
    WORKSPACE_NAME = "<workspace name>"
    LAKEHOUSE_NAME = "<Lakehouse name>"
    root_path = f"{LAKEHOUSE_NAME}.Lakehouse"
    data_path = f"{root_path}/Files"

    # SAS token has permission on lakehouse root path, could be more specific
    sas_token = get_user_delegation_sas(WORKSPACE_NAME, root_path)
    print("SAS token: ", sas_token)

    # Try to use sas token to list files
    service_client = DataLakeServiceClient(ACCOUNT_URL, credential=sas_token)
    file_system_client = service_client.get_file_system_client(WORKSPACE_NAME)
    paths = file_system_client.get_paths(path=data_path, recursive=True)
    for path in paths:
        print(path.name + "\n")

       

      My main issue was that I used the endpoint in the generation and signing of the SAS token, but the right answer is to use "onelake" only. I have also been trying to use lakehouse and workspace Item IDs, but I only got it to work with names.