Using SAS Token with Azure ServiceBus

Question

I am using new Azure ServiceBus SDK which is .NET Standard 2.0 and I am finding it difficult to use SAS Token. Previously, it used to be MessagingFactory but in new SDK it's not there. ServiceBusConnectionStringBuilder has SAS Token but it also expects a connectionString.

Basically, I want to Send and Receive using SAS Policy (Send rule for Sending and Receive rule for Receiving) and SAS token created from connection string of these policies.

I am able to generate SAS Token but cannot find a way to create QueueClient using this token.

If I am not mistaken, you would still need to create a connection string from the SAS policy. — Gaurav Mantri, Feb 18 '20 at 04:19
@GauravMantri Yes, connection strings can be used but then I won't be able to use SAS Token. I have created SAS Token using connection string. — Amit, Feb 18 '20 at 05:21
That's the whole idea. You create a SAS Policy and the use either its primary or secondary key to create a connection string in the following format: `Endpoint=sb://.servicebus.windows.net/;SharedAccessKeyName=;SharedAccessKey=`. — Gaurav Mantri, Feb 18 '20 at 07:46
It still uses SAS Key associated with policy which do not have an expiry. Where is the use of SAS token ? I want to use an expiring SAS token generated from .NET Program. Format of which is like this `SharedAccessSignature sig=&se=&skn=&sr= ` — Amit, Feb 18 '20 at 08:56
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/208038/discussion-between-as1-and-gaurav-mantri). — Amit, Feb 18 '20 at 11:13
I think I found an answer to your problem. Let me post as an answer. — Gaurav Mantri, Feb 18 '20 at 11:13

score 4 · Accepted Answer · edited Jan 06 '23 at 21:24

I ended up using following override of ServiceBusConnectionStringBuilder that uses a SharedAccess Signature:

public ServiceBusConnectionStringBuilder (string endpoint, string entityPath, string sharedAccessSignature);

Based on this, here's the code I wrote. This first generates a SAS token using RootManagedAccessKey that is valid for an hour and then uses that token to send a message to a queue.

using System;
using System.Text;
using Microsoft.Azure.ServiceBus;
using Microsoft.Azure.ServiceBus.Primitives;

namespace SO60273377
{
    class Program
    {
        static void Main(string[] args)
        {
            var endpoint = "sb://<namespace>.servicebus.windows.net/";
            var queueName = "test";
            var keyName = "RootManageSharedAccessKey";
            var keyValue = "<key>";
            var validityDuration = TimeSpan.FromHours(1);

            TokenScope tokenScope = TokenScope.Entity;
            
            var provider = (SharedAccessSignatureTokenProvider) TokenProvider.CreateSharedAccessSignatureTokenProvider(keyName, keyValue, validityDuration, tokenScope);
            
            var token = provider.GetTokenAsync(endpoint+queueName, validityDuration).GetAwaiter().GetResult();
            var sasToken = token.TokenValue;
            Console.WriteLine("SAS Token: " + sasToken);
            var serviceBusConnectionStringBuilder = new ServiceBusConnectionStringBuilder(endpoint, queueName, sasToken);
            QueueClient client = new QueueClient(serviceBusConnectionStringBuilder, ReceiveMode.PeekLock);
            client.SendAsync(new Message(Encoding.UTF8.GetBytes("This is a test"))).GetAwaiter().GetResult();


            Console.WriteLine("Press any key to continue");
            Console.ReadLine();
        }
    }
}

Yes, it works.On further debugging I also found `ServiceBusConnectionStringuilder` also has `TokenProvider` property. I was looking for `MessagingFactory` alternative to create `QueueClient`, didn't realize `ServiceBusConnectionStringBuiilder` is the one. — Amit, Feb 18 '20 at 18:11

Using SAS Token with Azure ServiceBus

1 Answers1

Linked