Azure Storage Library
Hi there, I'm implementing a library to interact with Azure Storage. I'm already blocked at the first step: generate the authentication header. The header generation is described there: http://msdn.microsoft.com/en-us/library/azure/dd179428.aspx An SDK exists for Ruby: https://github.com/Azure/azure-sdk-for-ruby I've taken the tests from the Ruby SDK to drive my implementation. I have a mismatch that I can't solve with the authentication header. You can run the tests or execute the small scenario from the AZSharedKeyAuth class comment to see where the problem is (i've created a temporary storage account for testing, the account name and key are in the class comment). Apparently something goes wrong in the signature= Base64(HMAC-SHA256(UTF8(StringToSign))). My StringToSign seems to be ok (cr vs lf vs crlf possibly put some mess). My code is there: http://smalltalkhub.com/#!/~francois/AzureStorage Can someone have a look? If you're a company that can send invoices, I don't mind to pay consulting fees if you can help...
Hi François, You might want to have a look at the code in Zinc-AWS (group AWS in ConfigurationOfZincHTTPComponents), in particular ZnAWSS3Client and ZnAWSS3RequestSignatureTool - it is using similar request signing but does HMAC-SHA1.
From a quick glance at the documentation, it seems you have to use Character lf (\r) else you'll get the wrong result.
Have you tried signing the examples (canonical strings) in the documentation and comparing with their result ? If you really can't make it work, we can discuss further. Sven On 19 Jun 2014, at 10:05, François Stephany <tulipe.moutarde@gmail.com> wrote:
Hi there,
I'm implementing a library to interact with Azure Storage. I'm already blocked at the first step: generate the authentication header.
The header generation is described there: http://msdn.microsoft.com/en-us/library/azure/dd179428.aspx
An SDK exists for Ruby: https://github.com/Azure/azure-sdk-for-ruby
I've taken the tests from the Ruby SDK to drive my implementation. I have a mismatch that I can't solve with the authentication header.
You can run the tests or execute the small scenario from the AZSharedKeyAuth class comment to see where the problem is (i've created a temporary storage account for testing, the account name and key are in the class comment).
Apparently something goes wrong in the signature= Base64(HMAC-SHA256(UTF8(StringToSign))).
My StringToSign seems to be ok (cr vs lf vs crlf possibly put some mess).
My code is there: http://smalltalkhub.com/#!/~francois/AzureStorage
Can someone have a look? If you're a company that can send invoices, I don't mind to pay consulting fees if you can help...
Hello Sven,
You might want to have a look at the code in Zinc-AWS (group AWS in ConfigurationOfZincHTTPComponents), in particular ZnAWSS3Client and ZnAWSS3RequestSignatureTool - it is using similar request signing but does HMAC-SHA1.
Thanks! I wasn't aware of the existence of ZnAWS. Actually, i'm currently using the HMAC-SHA256 implementation of the CloudFork.
From a quick glance at the documentation, it seems you have to use Character lf (\r) else you'll get the wrong result.
I'm using withUnixLineEndings to ensure the Character lf line ending. You meant \n instead of \r, right?
Have you tried signing the examples (canonical strings) in the documentation and comparing with their result ?
The problem is that they don't tell with which key they've signed the string. It makes it quite hard to decompose the problem and see where something breaks. The tests in the Ruby SDK are not really useful neither. I'll the other SDKs, maybe the tests are more revealing.
If you really can't make it work, we can discuss further.
I'll try a bit more and come back if needed! Thanks !
On 19 Jun 2014, at 14:59, François Stephany <tulipe.moutarde@gmail.com> wrote:
Hello Sven,
You might want to have a look at the code in Zinc-AWS (group AWS in ConfigurationOfZincHTTPComponents), in particular ZnAWSS3Client and ZnAWSS3RequestSignatureTool - it is using similar request signing but does HMAC-SHA1.
Thanks! I wasn't aware of the existence of ZnAWS. Actually, i'm currently using the HMAC-SHA256 implementation of the CloudFork.
Is that an all Smalltalk implementation ? Because it would be really good to have SHA256 in the image.
From a quick glance at the documentation, it seems you have to use Character lf (\r) else you'll get the wrong result.
I'm using withUnixLineEndings to ensure the Character lf line ending. You meant \n instead of \r, right?
Yes, of course, sorry.
Have you tried signing the examples (canonical strings) in the documentation and comparing with their result ?
The problem is that they don't tell with which key they've signed the string. It makes it quite hard to decompose the problem and see where something breaks.
How crazy is that ?? (I am trying to be polite here ;-)
The tests in the Ruby SDK are not really useful neither. I'll the other SDKs, maybe the tests are more revealing.
Good luck.
If you really can't make it work, we can discuss further.
I'll try a bit more and come back if needed!
Thanks !
You might want to have a look at the code in Zinc-AWS (group AWS in
ConfigurationOfZincHTTPComponents), in particular ZnAWSS3Client and ZnAWSS3RequestSignatureTool - it is using similar request signing but does HMAC-SHA1.
Thanks! I wasn't aware of the existence of ZnAWS. Actually, i'm currently using the HMAC-SHA256 implementation of the
CloudFork.
Is that an all Smalltalk implementation ? Because it would be really good to have SHA256 in the image.
Yes it is. The class comment says: " http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.p... This class represnets the implementation of CFSHA256 as describied above. Please direct questions or comments about this implementation to Ron Teitelbaum: Ron@USMedRec.com This code was extensively coppied from SHA1 by Luciano Notarfrancesco lnotarfrancesco@yahoo.com " It seems to work for AWS, I wonder what I'm doing wrong here...
On 19 Jun 2014, at 15:52, François Stephany <tulipe.moutarde@gmail.com> wrote:
You might want to have a look at the code in Zinc-AWS (group AWS in ConfigurationOfZincHTTPComponents), in particular ZnAWSS3Client and ZnAWSS3RequestSignatureTool - it is using similar request signing but does HMAC-SHA1.
Thanks! I wasn't aware of the existence of ZnAWS. Actually, i'm currently using the HMAC-SHA256 implementation of the CloudFork.
Is that an all Smalltalk implementation ? Because it would be really good to have SHA256 in the image.
Yes it is. The class comment says:
" http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.p... This class represnets the implementation of CFSHA256 as describied above. Please direct questions or comments about this implementation to Ron Teitelbaum: Ron@USMedRec.com This code was extensively coppied from SHA1 by Luciano Notarfrancesco lnotarfrancesco@yahoo.com "
It seems to work for AWS, I wonder what I'm doing wrong here...
You have to be 100% sure that the SHA256, HMAC-SHA256 code works (as opposed to the SHA1, HMAC-SHA1 code) then you absolutely need examples: a known canonical string and keys with a Base64 signature output. Start by making sure you can replicate this in your reference implementation (Ruby, Java, C#) and then start to go to Pharo. Look *very* carefully at each element of the canonical string, one letter difference, one header, punctuation, whitespace, case, date or time format difference will break the whole thing - that is the point of being a signature.
Got it. It's super stupid. The key they give to feed the HMAC-SHA256 is actually a base64 string that needs to be decoded. It's not mentionned in the docs and I missed the constructor of the Signer in Ruby: # Public: Initialize the Signer. # # access_key - The access_key encoded in Base64. Defaults to the one # in the global configuration. def initialize(access_key=Azure.config.storage_access_key) @access_key = Base64.strict_decode64(access_key) end Tests are passing now :) Thanks for your patience Sven! On Thu, Jun 19, 2014 at 4:01 PM, Sven Van Caekenberghe <sven@stfx.eu> wrote:
On 19 Jun 2014, at 15:52, François Stephany <tulipe.moutarde@gmail.com> wrote:
You might want to have a look at the code in Zinc-AWS (group AWS in
ConfigurationOfZincHTTPComponents), in particular ZnAWSS3Client and ZnAWSS3RequestSignatureTool - it is using similar request signing but does HMAC-SHA1.
Thanks! I wasn't aware of the existence of ZnAWS. Actually, i'm currently using the HMAC-SHA256 implementation of the
CloudFork.
Is that an all Smalltalk implementation ? Because it would be really good to have SHA256 in the image.
Yes it is. The class comment says:
"
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.p... This class represnets the implementation of CFSHA256 as describied above.
Please direct questions or comments about this implementation to Ron Teitelbaum: Ron@USMedRec.com This code was extensively coppied from SHA1 by Luciano Notarfrancesco lnotarfrancesco@yahoo.com "
It seems to work for AWS, I wonder what I'm doing wrong here...
You have to be 100% sure that the SHA256, HMAC-SHA256 code works (as opposed to the SHA1, HMAC-SHA1 code) then you absolutely need examples: a known canonical string and keys with a Base64 signature output. Start by making sure you can replicate this in your reference implementation (Ruby, Java, C#) and then start to go to Pharo.
Look *very* carefully at each element of the canonical string, one letter difference, one header, punctuation, whitespace, case, date or time format difference will break the whole thing - that is the point of being a signature.
participants (2)
-
François Stephany -
Sven Van Caekenberghe