Failing to upload data to blob storage using adls gen 2 rest api RRS feed

  • Question

  • Hi,

    I am trying to upload a simple string to a blob file using the adls gen2 rest api. I am getting a 403 forbidden error returned saying my authorization header is incorrect. The data i am uploading is just a simple string and I have checked that my shared key is correct. I have also already created the file using the api.

    Authorization header signature before encoding:



    x-ms-date:Sat, 16 Mar 2019 14:07:06 GMT

    My code looks like the following:

    private static async Task pathUpdate(string storageAccountName, string storageAccountKey, string filesystem, string path, string action, string postData, CancellationToken cancellationToken)
                // Construct the URI. This will look like this:
                //   https://myaccount.dfs.core.windows.net/resource
                String uri = string.Format("https://{0}.dfs.core.windows.net/{1}/{2}?action={3}?position=0", storageAccountName, filesystem, path, action);
                // Set this to whatever payload you desire. Ours is null because 
                //   we're not passing anything in.
                ASCIIEncoding encoding = new ASCIIEncoding();
                byte[] byte1 = encoding.GetBytes(postData);
                Byte[] requestPayload = byte1;
                //Instantiate the request message with a null payload.
                var method = new HttpMethod("PATCH");
                using (var httpRequestMessage = new HttpRequestMessage(method, uri)
                { Content = (requestPayload == null) ? null : new ByteArrayContent(requestPayload) })
                    // Add the request headers for x-ms-date and x-ms-version.
                    DateTime now = DateTime.UtcNow;
                    httpRequestMessage.Headers.Add("x-ms-date", now.ToString("R", CultureInfo.InvariantCulture));
                    httpRequestMessage.Headers.Add("x-ms-version", "2018-11-09");
                    httpRequestMessage.Headers.Add("ContentLength", byte1.Length.ToString());
                    //httpRequestMessage.Headers.Add("ContentType", "application/octet-stream");
                    // If you need any additional headers, add them here before creating
                    //   the authorization header. 
                    // Add the authorization header.
                    httpRequestMessage.Headers.Authorization = AzureStorageAuthenticationHelper.GetAuthorizationHeader(
                       storageAccountName, storageAccountKey, now, httpRequestMessage);
                    // Send the request.
                    using (HttpResponseMessage httpResponseMessage = await new HttpClient().SendAsync(httpRequestMessage, cancellationToken))
                        // If successful (status code = 200), 
                        //   parse the XML response for the container names.
                        if (httpResponseMessage.StatusCode == HttpStatusCode.OK)
                            String xmlString = await httpResponseMessage.Content.ReadAsStringAsync();

    and the authorization header construction:

    namespace StorageRestApiAuth
        internal static class AzureStorageAuthenticationHelper
            internal static AuthenticationHeaderValue GetAuthorizationHeader(
               string storageAccountName, string storageAccountKey, DateTime now,
               HttpRequestMessage httpRequestMessage, string ifMatch = "", string md5 = "")
                // This is the raw representation of the message signature.
                HttpMethod method = httpRequestMessage.Method;
                String MessageSignature = String.Format("{0}\n\n\n{1}\n{5}\n\n\n\n{2}\n\n\n\n{3}{4}",
                          (method == HttpMethod.Get || method == HttpMethod.Put) ? String.Empty
                            : httpRequestMessage.Content.Headers.ContentLength.ToString(),
                          GetCanonicalizedResource(httpRequestMessage.RequestUri, storageAccountName),
                // Now turn it into a byte array.
                byte[] SignatureBytes = Encoding.UTF8.GetBytes(MessageSignature);
                // Create the HMACSHA256 version of the storage key.
                HMACSHA256 SHA256 = new HMACSHA256(Convert.FromBase64String(storageAccountKey));
                // Compute the hash of the SignatureBytes and convert it to a base64 string.
                string signature = Convert.ToBase64String(SHA256.ComputeHash(SignatureBytes));
                AuthenticationHeaderValue authHV = new AuthenticationHeaderValue("SharedKey",
                    storageAccountName + ":" + Convert.ToBase64String(SHA256.ComputeHash(SignatureBytes)));
                return authHV;
            private static string GetCanonicalizedHeaders(HttpRequestMessage httpRequestMessage)
                var headers = from kvp in httpRequestMessage.Headers
                              where kvp.Key.StartsWith("x-ms-", StringComparison.OrdinalIgnoreCase)
                              orderby kvp.Key
                              select new { Key = kvp.Key.ToLowerInvariant(), kvp.Value };
                StringBuilder sb = new StringBuilder();
                // Create the string in the right format; this is what makes the headers "canonicalized" --
                //   it means put in a standard format. http://en.wikipedia.org/wiki/Canonicalization
                foreach (var kvp in headers)
                    StringBuilder headerBuilder = new StringBuilder(kvp.Key);
                    char separator = ':';
                    // Get the value for each header, strip out \r\n if found, then append it with the key.
                    foreach (string headerValues in kvp.Value)
                        string trimmedValue = headerValues.TrimStart().Replace("\r\n", String.Empty);
                        // Set this to a comma; this will only be used 
                        //   if there are multiple values for one of the headers.
                        separator = ',';
                return sb.ToString();
            private static string GetCanonicalizedResource(Uri address, string storageAccountName)
                // The absolute path is "/" because for we're getting a list of containers.
                StringBuilder sb = new StringBuilder("/").Append(storageAccountName).Append(address.AbsolutePath);
                // Address.Query is the resource, such as "?comp=list".
                // This ends up with a NameValueCollection with 1 entry having key=comp, value=list.
                // It will have more entries if you have more query parameters.
                NameValueCollection values = HttpUtility.ParseQueryString(address.Query);
                foreach (var item in values.AllKeys.OrderBy(k => k))
                return sb.ToString();

    Thanks for any help!

    Saturday, March 16, 2019 2:09 PM

All replies

  • Hi Ewan,

    I have posted a step by step guide in my answer on this thread. Please have a look at my answer and see if it helps you, else we can gladly continue to dive deeper. 


    Thursday, March 21, 2019 12:04 PM