R: Azure Table entity query via REST call fails - r

Question

I am working with Azure, Databricks and R. I am trying to call Azure Table Storages from R cell in Databricks notebook via ATS REST API. I am able to create/delete tables and I also can insert new entities into existing tables. However, if I try to query entities I always get an 403 error. Here is my code that tries to filter on "RowKey=1" and select "Name" property.
library(httr)
key <- "myStorageKey"
url <- "https://myAccount.table.core.windows.net/myTable()?$filter=(RowKey%20eq%20'1')?$select=Name"
canonResource <- paste0("/", account, "/myTable()?$filter=(RowKey%20eq%20'1')?$select=Name")
Now I am using SharedKeyLite authentiction as described here
requestdate <- format(Sys.time(),"%a, %d %b %Y %H:%M:%S %Z", tz="GMT")
signStr <- paste(requestdate, canonResource, sep = "\n")
auth <- paste0("SharedKeyLite myAccount:",
RCurl::base64(digest::hmac(key = RCurl::base64Decode(key, mode = "raw"),
object = enc2utf8(signStr),
algo = "sha256", raw = TRUE)))
Now, according to the query entities description, i need to form a header like that:
header <- httr::add_headers(#`x-ms-version` = "2015-12-11 ",
`x-ms-date` = requestdate,
Authorization = auth,
#Accept = "application/json;odata=nometadata",
#`Accept-Charset` = "UTF-8",
DataServiceVersion = "3.0;NetFx",
#Date = requestdate,
MaxDataServiceVersion = "3.0;NetFx")
However, calling
httr::GET(url = url, config = header, verbose())
gives me
HTTP/1.1 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
Does anyone see what I am missing or doing wrong? I played around with the header un-/commenting out several optional ones, but it still fails. As said, other calls on that api work for me. What I find a bit confusing is, that the documentation of the query call say I must specify the (Max)DataServiceVersion header, even if it is an optional header!

Answer 1

The issue was with how you're creating your canonResource.
Based on the documentation:
Shared Key Lite and Table service format for 2009-09-19 and later
This format supports Shared Key and Shared Key Lite for all versions
of the Table service, and Shared Key Lite for version 2009-09-19 and
later of the Blob and Queue services and version 2014-02-14 and later
of the File service. This format is identical to that used with
previous versions of the storage services. Construct the
CanonicalizedResource string in this format as follows:
Beginning with an empty string (""), append a forward slash (/),
followed by the name of the account that owns the resource being
accessed.
Append the resource's encoded URI path. If the request URI addresses a
component of the resource, append the appropriate query string. The
query string should include the question mark and the comp parameter
(for example, ?comp=metadata). No other parameters should be included
on the query string.
Based on this, your canonResource should be
canonResource <- paste0("/", account, "/myTable()")
Here's the complete code I used:
library(httr)
library(RCurl)
library(digest)
key <- "<account-key>"
account <- "<account-name>"
url <- "https://<account-name>.table.core.windows.net/myTable()?$filter=RowKey%20eq%20'1'&$select=Name"
canonResource <- paste0("/", account, "/myTable()")
print(canonResource)
requestdate <- format(Sys.time(),"%a, %d %b %Y %H:%M:%S %Z", tz="GMT")
print(requestdate)
signStr <- paste(requestdate, canonResource, sep = "\n")
print(signStr)
auth <- paste0("SharedKeyLite ", account, ":",
RCurl::base64(digest::hmac(key = RCurl::base64Decode(key, mode = "raw"),
object = enc2utf8(signStr),
algo = "sha256", raw = TRUE)))
print(auth)
header <- httr::add_headers(`x-ms-version` = "2015-12-11 ",
`x-ms-date` = requestdate,
Authorization = auth,
Accept = "application/json;odata=nometadata",
#`Accept-Charset` = "UTF-8",
DataServiceVersion = "3.0;NetFx",
#Date = requestdate,
MaxDataServiceVersion = "3.0;NetFx")
print(header)
httr::GET(url = url, config = header, verbose())