本地Azurite跨存储账户调用StartCopyFromUriAsync认证失败求助

使用Azurite进行跨存储账户Blob复制时，直接传递源Blob的普通Uri给StartCopyFromUriAsync会触发认证失败。这是因为Azurite本地存储账户要求身份验证，目标账户访问源Blob时未携带有效授权信息，导致服务端拒绝请求。

为源Blob生成带SAS令牌（Shared Access Signature）的Uri，让目标账户通过SAS获得临时访问权限，从而合法读取源Blob内容完成复制。

var sourceAccountName = "devstoreaccount1";
var sourceAccountKey = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
var sourceBlobEndpoint = $"http://127.0.0.1:10000/{sourceAccountName}";

var destinationAccountName = "devstoreaccount2";
var destinationAccountKey = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
var destinationBlobEndpoint = $"http://127.0.0.1:10000/{destinationAccountName}";

var sourceConnectionString = $"DefaultEndpointsProtocol=http;AccountName={sourceAccountName};AccountKey={sourceAccountKey};BlobEndpoint={sourceBlobEndpoint}";
var destinationConnectionString = $"DefaultEndpointsProtocol=http;AccountName={destinationAccountName};AccountKey={destinationAccountKey};BlobEndpoint={destinationBlobEndpoint}";

var sourceContainerName = "srccontainer";
var destinationContainerName = "destcontainer";

var sourceBlobName = "myblob";  
var destinationBlobName = "destblob";

var sourceBlobServiceClient = new BlobServiceClient(sourceConnectionString);
var destinationBlobServiceClient = new BlobServiceClient(destinationConnectionString);

var sourceContainerClient = sourceBlobServiceClient.GetBlobContainerClient(sourceContainerName);
var sourceBlobClient = sourceContainerClient.GetBlobClient(sourceBlobName);

var destinationContainerClient = destinationBlobServiceClient.GetBlobContainerClient(destinationContainerName);
var destinationBlobClient = destinationContainerClient.GetBlobClient(destinationBlobName);

await destinationContainerClient.CreateIfNotExistsAsync();

// 构建SAS令牌，授予源Blob读取权限，有效期1小时
var sasBuilder = new BlobSasBuilder
{
    BlobContainerName = sourceContainerName,
    BlobName = sourceBlobName,
    Resource = "b", // 指定为Blob资源
    ExpiresOn = DateTimeOffset.UtcNow.AddHours(1)
};
sasBuilder.SetPermissions(BlobSasPermissions.Read);

// 生成SAS令牌并拼接成带权限的Uri
var sasToken = sasBuilder.ToSasQueryParameters(new StorageSharedKeyCredential(sourceAccountName, sourceAccountKey)).ToString();
var sourceBlobSasUri = new Uri($"{sourceBlobClient.Uri}?{sasToken}");

Console.WriteLine($"Starting copy from {sourceBlobSasUri} to {destinationBlobClient.Uri}");

var copyOperation = await destinationBlobClient.StartCopyFromUriAsync(sourceBlobSasUri);
await copyOperation.WaitForCompletionAsync();

Console.WriteLine("Copy completed");

• SAS令牌提供临时、权限受限的源Blob访问能力，是Azurite跨账户复制的必要授权方式。
• 仅授予Read权限即可满足复制需求，避免不必要的权限暴露。
• 有效期需根据复制操作的预期时长合理设置，确保操作在令牌有效期内完成。

内容的提问来源于stack exchange，提问作者binga58