Azure.Storage.Sas.DataLakeSasBuilder

public class DataLakeSasBuilder

DataLakeSasBuilder is used to generate a Shared Access Signature (SAS) for a Data Lake file system or path For more information, see Constructing a Service SAS.

public string AgentObjectId { get; set; }

Optional. Beginning in version 2020-02-10, this value will be used for the AAD Object ID of a user authorized by the owner of the User Delegation Key to perform the action granted by the SAS. The Azure Storage service will ensure that the owner of the user delegation key has the required permissions before granting access. the Azure Storage Service will perform an additional POSIX ACL check to determine if the user is authorized to perform the requested operation. This cannot be used in conjuction with PreauthorizedAgentObjectId. This is only used with generating User Delegation SAS.

public string CacheControl { get; set; }

Override the value returned for Cache-Control response header.

public string ContentDisposition { get; set; }

Override the value returned for Content-Disposition response header.

public string ContentEncoding { get; set; }

Override the value returned for Cache-Encoding response header.

public string ContentLanguage { get; set; }

Override the value returned for Cache-Language response header.

public string ContentType { get; set; }

Override the value returned for Cache-Type response header.

public string CorrelationId { get; set; }

Optional. Beginning in version 2020-02-10, this value will be used for to correlate the storage audit logs with the audit logs used by the principal generating and distributing SAS. This is only used for User Delegation SAS.

public string DelegatedUserObjectId { get; set; }

Optional. Beginning in version 2025-07-05, this value specifies the Entra ID of the user would is authorized to use the resulting SAS URL. The resulting SAS URL must be used in conjunction with an Entra ID token that has been issued to the user specified in this value.

public string EncryptionScope { get; set; }

Optional. Encryption scope to use when sending requests authorized with this SAS URI.

public DateTimeOffset ExpiresOn { get; set; }

The time at which the shared access signature becomes invalid. This field must be omitted if it has been specified in an associated stored access policy.

public string FileSystemName { get; set; }

The name of the file system being made accessible.

public string Identifier { get; set; }

An optional unique value up to 64 characters in length that correlates to an access policy specified for the file system.

public SasIPRange IPRange { get; set; }

Specifies an IP address or a range of IP addresses from which to accept requests. If the IP address from which the request originates does not match the IP address or address range specified on the SAS token, the request is not authenticated. When specifying a range of IP addresses, note that the range is inclusive.

public bool? IsDirectory { get; set; }

Beginning in version 2020-02-10, this value defines whether or not the Path is a directory. If this value is set to true, the Path is a Directory for a Directory SAS. If set to false or default, the Path is a File Path for a File Path SAS.

public string Path { get; set; }

The name of the path being made accessible, or Empty for a file system SAS. Beginning in version 2020-02-10, setting IsDirectory to true means we will accept the Path as a directory for a directory SAS. If not set, this value is assumed to be a File Path for a File Path SAS.

public string Permissions { get; }

The permissions associated with the shared access signature. The user is restricted to operations allowed by the permissions. This field must be omitted if it has been specified in an associated stored access policy. The DataLakeSasPermissions, DataLakeFileSystemSasPermissions or DataLakeAccountSasPermissions can be used to create the permissions string.

public string PreauthorizedAgentObjectId { get; set; }

Optional. Beginning in version 2020-02-10, this value will be used for the AAD Object ID of a user authorized by the owner of the User Delegation Key to perform the action granted by the SAS. The Azure Storage service will ensure that the owner of the user delegation key has the required permissions before granting access. No additional permission check for the user specified in this value will be performed. This cannot be used in conjuction with AgentObjectId. This is only used with generating User Delegation SAS.

public SasProtocol Protocol { get; set; }

The optional signed protocol field specifies the protocol permitted for a request made with the SAS. Possible values are HttpsAndHttp, Https, and None.

public string Resource { get; set; }

Specifies which resources are accessible via the shared access signature. Specify "b" if the shared resource is a blob. This grants access to the content and metadata of the blob. Specify "c" if the shared resource is a blob container. This grants access to the content and metadata of any blob in the container, and to the list of blobs in the container. Beginning in version 2018-11-09, specify "bs" if the shared resource is a blob snapshot. This grants access to the content and metadata of the specific snapshot, but not the corresponding root blob. Beginning in version 2020-02-10, specify "d" if the shared resource is a DataLake directory. This grants access to the paths in the directory and to list the paths in the directory. When "d" is specified, the sdd query parameter is also required.

public DateTimeOffset StartsOn { get; set; }

Optionally specify the time at which the shared access signature becomes valid. If omitted when DateTimeOffset.MinValue is used, start time for this call is assumed to be the time when the storage service receives the request.

public string Version { get; set; }

The storage service version to use to authenticate requests made with this shared access signature, and the service version to use when handling requests made with this shared access signature.

public DataLakeSasBuilder()

Initializes a new instance of the DataLakeSasBuilder class.

public DataLakeSasBuilder(DataLakeSasPermissions permissions, DateTimeOffset expiresOn)

Initializes a new instance of the DataLakeSasBuilder class to create a Blob Service Sas.

public DataLakeSasBuilder(DataLakeFileSystemSasPermissions permissions, DateTimeOffset expiresOn)

Initializes a new instance of the DataLakeSasBuilder class to create a Blob Service Sas.

public void SetPermissions(DataLakeSasPermissions permissions)

Sets the permissions for a file SAS.

public void SetPermissions(DataLakeAccountSasPermissions permissions)

Sets the permissions for a path account level SAS.

public void SetPermissions(DataLakeFileSystemSasPermissions permissions)

Sets the permissions for a file system SAS.

public void SetPermissions(string rawPermissions, bool normalize = false)

Sets the permissions for the SAS using a raw permissions string.

public void SetPermissions(string rawPermissions)

Sets the permissions for the SAS using a raw permissions string.

public DataLakeSasQueryParameters ToSasQueryParameters(StorageSharedKeyCredential sharedKeyCredential)

Use an account's StorageSharedKeyCredential to sign this shared access signature values to produce the proper SAS query parameters for authenticating requests.

public DataLakeSasQueryParameters ToSasQueryParameters(StorageSharedKeyCredential sharedKeyCredential, out string stringToSign)

Use an account's StorageSharedKeyCredential to sign this shared access signature values to produce the proper SAS query parameters for authenticating requests.

public DataLakeSasQueryParameters ToSasQueryParameters(UserDelegationKey userDelegationKey, string accountName)

Use an account's UserDelegationKey to sign this shared access signature values to produce the proper SAS query parameters for authenticating requests.

public DataLakeSasQueryParameters ToSasQueryParameters(UserDelegationKey userDelegationKey, string accountName, out string stringToSign)

Use an account's UserDelegationKey to sign this shared access signature values to produce the proper SAS query parameters for authenticating requests.