User Delegation SAS URL Builder

[eureka-cpu]

@vincenttran-msft @jalauzon-msft

Ref #3330

I started writing a crate for user delegation sas urls that I'd like to upstream here. I also left a comment with some context in the issue references above, but didn't hear back. @heaths suggested opening an issue to discuss it more, maybe you already have some idea of what it would look like. I just used the ms learn docs to get something up and running using a builder pattern focused on preventing improper url generation, since the docs are kind of all over the place in terms of categorization of optional headers, parameters and so on.

Any feedback is welcomed, I just want to get something up and running so I can ship my service this week. I think it's already pretty close to something I'd expect to see API wise, and the generated docs are pretty clear in pointing out where to find things in the ms learn docs.

https://github.com/eureka-cpu/azure-storage-sas

[eureka-cpu]

To be clear, I'm mostly focused on getting it working for blob storage since that's all I'm using it for, but I've also written the library to handle all other supported sas resources. It could be better tested and the examples only include checks for blob resources.

[github-actions]

Thank you for your feedback. Tagging and routing to the team members best able to assist. cc @vincenttran-msft, @jalauzon-msft

Generated by Agentic Triage for issue #4444 · ● 2.3M · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/issue-triage.md@8e6d7c86bba37371d2d0eee1a23563db3e561eb5

[github-actions]

🎯 Agentic Issue Triage

Summary: The author has written a User Delegation SAS URL builder crate for Azure Storage and would like to upstream it into the SDK. They are seeking feedback on the API design and contribution path.

📋 Issue Details

• Crate / module: azure_storage_blob (or a new SAS URL builder crate under sdk/storage/)
• Affected API: User Delegation SAS URL generation
• Scenario: The author implemented a builder pattern for generating user delegation SAS URLs and wants to contribute it upstream
• Root ask: Feedback on API design and guidance on upstreaming the crate into this repository

🔎 Debugging / Reproduction Notes

The author references a working prototype at https://github.com/eureka-cpu/azure-storage-sas and related issue #3330. This is not a bug report but a contribution proposal.

Suggested investigation steps:

1. Review the linked prototype crate for API design and correctness
2. Assess alignment with existing sdk/storage/ patterns and Azure SDK design guidelines
3. Discuss whether this should be a new sub-crate or folded into an existing storage crate

🏷️ Label Confidence

• Category: Client — the crate relates to Azure Storage blob/SAS functionality, not azure_resourcemanager_*
• Service: Storage — explicitly about Azure Storage SAS URL generation
• Confidence: High — the issue clearly targets Azure Storage with no ambiguity

👥 Owner Routing

• Matched CODEOWNERS entry: # ServiceLabel: %Storage — matched on the Storage label
• AzureSDKOwners: @vincenttran-msft, @jalauzon-msft
• ServiceOwners: none listed
• Routing action: Assigned vincenttran-msft (randomly selected from two AzureSDKOwners); added needs-team-attention since issue is customer-reported

Generated by Agentic Triage for issue #4444 · ● 2.3M · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/issue-triage.md@8e6d7c86bba37371d2d0eee1a23563db3e561eb5

[eureka-cpu]

Just reporting back here to say the crate works for my blob upload use case. I'll be working out kinks as I find them, next I need to handle downloads. I will say I've only got this working using the SDK client upload function, which I'm assuming sets the required headers and stuff because I initially tried to just use reqwest but it was a pain to debug which headers it was rejecting or required based on the error response. With the BlobClient::upload way, it just works. I'm using version 2025-07-05 since that's what azurite currently supports up to, but the library is written to the latest version of the spec so it should also support srh/srq too.

[jalauzon-msft]

Hi @eureka-cpu, thanks for reaching out and for your interest in helping to build a SAS crate! SAS building is one of our top priorities now that version 1.0 is out and we have already started prototyping internally.

I took a very brief look at your implementation, and it does seem to align generally with what we are planning to build but SAS has some nuance, and we have design guidelines and patterns established in other languages we would need to follow so we may not take your changes directly upstream. We also don't plan to support account SAS with shared key. We will definitely be looking at and taking inspiration from your implementation though and it will likely save us some work, so the implementation is still very much appreciated.

I would say our implementation is probably still a couple of months out to be fully shipped though, which likely does not align with your timelines so you could definitely make use of your crate until then. One ask I would have is if you plan to release your crate to crates.io, it would be great if you could choose a different name, as azure_storage_sas is probably the name we would like to use. Ideally one without the azure-storage- prefix entirely. Thanks!

[eureka-cpu]

@jalauzon-msft I think there's a misunderstanding. I did write this so that I would be unblocked for the service I'm writing, but I intend to open a pull request targeting the SDK. I can see how that may have been misconstrued as I wrote it as a separate crate in another repo, but I needed somewhere I could quickly get a working copy without fighting the SDK repo.

we have design guidelines and patterns established in other languages we would need to follow so we may not take your changes directly upstream

It would be great if we could deliberate on those details on the pull request

We also don't plan to support account SAS with shared key

Right, the crate I wrote is only for User Delegation SAS, I wrote it that way because I saw your comment on #3330

I would say our implementation is probably still a couple of months out to be fully shipped

I got a working implementation in roughly 3 days, it would be great to get real feedback on a pull request, probably it would take much less time if we just work together on it

it would be great if you could choose a different name, as azure_storage_sas is probably the name we would like to use

I don't plan to release this on crate.io as I would like to be a regular contributor to this repository and provide an implementation that you guys are happy with