[FEATURE REQ] Support Generation of SAS tokens using User Delegation Keys for Queues and Tables, not just Blob

[neilrees]

Library name

Azure.Storage.Queues & Azure.Data.Tables

Please describe the feature.

It is possible to create a SAS token to a Blob or a Container using a UserDelegationKey and code similar to the following:

var defaultAzureCredential = new DefaultAzureCredential();
var blobServiceClient = new BlobServiceClient(new Uri($"https://{storageAccountName}.blob.core.windows.net"), defaultAzureCredential);
var containerClient = blobServiceClient.GetBlobContainerClient(containerName);

var sasBuilder = new BlobSasBuilder(BlobContainerSasPermissions.All, expiry)
{
    BlobContainerName = containerClient.Name,
    Protocol = SasProtocol.Https
};

var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(DateTimeOffset.UtcNow, expiry);
var sasQueryParameters = sasBuilder.ToSasQueryParameters(userDelegationKey, storageAccountName);
var blobUriBuilder = new BlobUriBuilder(containerClient.Uri)
{
    Sas = sasQueryParameters
};

var uri = blobUriBuilder.ToUri();

However, whilst SAS tokens are supported for Queues and Tables, it requires use of a StorageSharedKeyCredential:

var queueServiceClient = new QueueServiceClient(
   new Uri($"https://{storageAccountName}.queue.core.windows.net"), 
   new StorageSharedKeyCredential(storageAccountName, storageAccountKey));

var queueClient = queueServiceClient.GetQueueClient(tableName);

var sasBuilder = new QueueSasBuilder(QueueSasPermissions.All, expiry)
{
    QueueName = queueClient.Name,
    Protocol = SasProtocol.Https,
};

var uri = queueClient.GenerateSasUri(sasBuilder);

and for Tables a TableSharedKeyCredential:

var tableServiceClient = new TableServiceClient(
   new Uri($"https://{storageAccountName}.table.core.windows.net"), 
   new TableSharedKeyCredential(storageAccountName, userDelegationKey.Value.Value));

var tableClient = tableServiceClient.GetTableClient(tableName);

var sasBuilder = new TableSasBuilder(tableClient.Name, TableSasPermissions.All, expiry)
{
    Protocol = TableSasProtocol.Https
};

var uri = tableClient.GenerateSasUri(sasBuilder);

To create SAS tokens for Queue and Table use of a StorageSharedKeyCredential or a TableSharedKeyCredential and access to the Storage Account Key is required, there is no support for UserDelegationKey.

The same seems to be true in az cli , as az storage container generate-sas has an --as-user argument, which is missing from az storage queue generate-sas and az storage table generate-sas

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

[amnguye]

The SDK currently supports what is supported in the REST API. The Queue and Tables REST API currently does not support retrieving the User Delegation Key.

If you would like to submit a general Azure Storage Feature Request we recommend using
https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request