Search code examples
azureazure-storageazure-sas

Azure Get User Delegation Failing on Expiry Format

I'm trying to get a user delegation SAS token for Azure Storage, using the REST API.

I've got an account, which has the required roles for the storage account, and the account has authenticated successfully and returned a Bearer token from the login endpoint.

When I request the user delegation key, I keep getting the following error:

<?xml version="1.0" encoding="utf-8"?>
<Error>
    <Code>InvalidXmlNodeValue</Code>
    <Message>The value for one of the XML nodes is not in the correct format.
RequestId:9b7a22e3-601e-0082-7bee-060981000000
Time:2021-02-19T18:38:48.1286734Z</Message>
    <XmlNodeName>Expiry</XmlNodeName>
    <XmlNodeValue>2021-02-19T19:30:00</XmlNodeValue>
</Error>

The body I'm submitting is copied from the Azure docs, :

<?xml version="1.0" encoding="utf-8"?>  
<KeyInfo>  
    <Start>2021-02-19T18:30:00</Start>
    <Expiry>2021-02-19T19:30:00</Expiry>
</KeyInfo>

Any idea what I'm doing wrong or missing for this to be failing?

The roles assigned on Azure are:

Azure user roles

And the request headers:

Authorization: Bearer ...
x-ms-version: 2020-04-08
Content-Type: text/xml
User-Agent: PostmanRuntime/7.26.10
Accept: */*
Postman-Token: df276a57-747c-45dd-a849-15ac6ad7b45b
Host: ....blob.core.windows.net
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 147
Solution

  • The issue might be your token life time is too short to get it effective. My suggestion is, set the expiry time more than 8 hours longer than start time.

    The value of the expiry time may be a maximum of seven days from the start time.

    Format your expiry time like this:

    2021-02-19T19:30:00Z

    Refer to: https://learn.microsoft.com/en-us/rest/api/storageservices/formatting-datetime-values