public void ValidateSetupAccessPolicyPermissionTest()
        {
            SharedAccessBlobPolicy blobAccessPolicy = new SharedAccessBlobPolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(blobAccessPolicy, null);
            Assert.AreEqual(blobAccessPolicy.Permissions, SharedAccessBlobPermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(blobAccessPolicy, "");
            Assert.AreEqual(blobAccessPolicy.Permissions, SharedAccessBlobPermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(blobAccessPolicy, "D");
            Assert.AreEqual(blobAccessPolicy.Permissions, SharedAccessBlobPermissions.Delete);

            SharedAccessTablePolicy tableAccessPolicy = new SharedAccessTablePolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(tableAccessPolicy, null);
            Assert.AreEqual(tableAccessPolicy.Permissions, SharedAccessTablePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(tableAccessPolicy, "");
            Assert.AreEqual(tableAccessPolicy.Permissions, SharedAccessTablePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(tableAccessPolicy, "ar");
            Assert.AreEqual(tableAccessPolicy.Permissions, SharedAccessTablePermissions.Add | SharedAccessTablePermissions.Query);

            SharedAccessQueuePolicy queueAccessPolicy = new SharedAccessQueuePolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(queueAccessPolicy, null);
            Assert.AreEqual(queueAccessPolicy.Permissions, SharedAccessQueuePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(queueAccessPolicy, "");
            Assert.AreEqual(queueAccessPolicy.Permissions, SharedAccessQueuePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(queueAccessPolicy, "p");
            Assert.AreEqual(queueAccessPolicy.Permissions, SharedAccessQueuePermissions.ProcessMessages);

            SharedAccessFilePolicy fileAccessPolicy = new SharedAccessFilePolicy();
            AccessPolicyHelper.SetupAccessPolicyPermission(fileAccessPolicy, null);
            Assert.AreEqual(fileAccessPolicy.Permissions, SharedAccessFilePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(fileAccessPolicy, "");
            Assert.AreEqual(fileAccessPolicy.Permissions, SharedAccessFilePermissions.None);
            AccessPolicyHelper.SetupAccessPolicyPermission(fileAccessPolicy, "lwc");
            Assert.AreEqual(fileAccessPolicy.Permissions, SharedAccessFilePermissions.List | SharedAccessFilePermissions.Write | SharedAccessFilePermissions.Create); 

        }

 public void SetupAccessPolicyPermissionTest()
 {
     SharedAccessTablePolicy accessPolicy = new SharedAccessTablePolicy();
     command.SetupAccessPolicyPermission(accessPolicy, "");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.None);
     accessPolicy.Permissions = SharedAccessTablePermissions.Add;
     command.SetupAccessPolicyPermission(accessPolicy, "");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Add);
     command.SetupAccessPolicyPermission(accessPolicy, "u");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Update);
     command.SetupAccessPolicyPermission(accessPolicy, "uUUU");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Update);
     command.SetupAccessPolicyPermission(accessPolicy, "drrq");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Delete | SharedAccessTablePermissions.Query);
     command.SetupAccessPolicyPermission(accessPolicy, "rq");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Query);
     command.SetupAccessPolicyPermission(accessPolicy, "q");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Query);
     command.SetupAccessPolicyPermission(accessPolicy, "r");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Query);
     command.SetupAccessPolicyPermission(accessPolicy, "qd");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Delete | SharedAccessTablePermissions.Query);
     command.SetupAccessPolicyPermission(accessPolicy, "audq");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Add 
         | SharedAccessTablePermissions.Query | SharedAccessTablePermissions.Update | SharedAccessTablePermissions.Delete);
     command.SetupAccessPolicyPermission(accessPolicy, "dqaaaau");
     Assert.AreEqual(accessPolicy.Permissions, SharedAccessTablePermissions.Add
         | SharedAccessTablePermissions.Query | SharedAccessTablePermissions.Update | SharedAccessTablePermissions.Delete);
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "rwDl"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "x"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "rwx"));
     AssertThrows<ArgumentException>(() => command.SetupAccessPolicyPermission(accessPolicy, "ABC"));
 }

        static void Main(string[] args)
        {
            const string PolicyName = "TableSasGenPolicy";

            try
            {
                if (args.Length < 3)
                {
                    Console.WriteLine("Usage: TableSasGen.exe <storageAccount> <tableName> <storageKey>");
                    return;
                }

                var storageAccount = args[0];
                var tableName = args[1];
                var storageKey = args[2];

                var storageUri = new Uri(String.Format("https://{0}.table.core.windows.net/", storageAccount));

                CloudTableClient client = new CloudTableClient(storageUri, new StorageCredentials(storageAccount, storageKey));
                CloudTable table = client.GetTableReference(tableName);
                TablePermissions permissions = table.GetPermissions();
                SharedAccessTablePolicy policy = null;
                if (!permissions.SharedAccessPolicies.ContainsKey(PolicyName))
                {
                    policy = new SharedAccessTablePolicy()
                    {
                        Permissions = SharedAccessTablePermissions.Add | SharedAccessTablePermissions.Delete | SharedAccessTablePermissions.Query | SharedAccessTablePermissions.Update,
                        SharedAccessExpiryTime = DateTimeOffset.MaxValue,
                    };

                    permissions.SharedAccessPolicies.Add(PolicyName, policy);

                    table.SetPermissions(permissions);

                }
                else
                {
                    policy = permissions.SharedAccessPolicies[PolicyName];
                }

                var sasToken = table.GetSharedAccessSignature(policy);
                Console.WriteLine("{0}{1}", storageUri, sasToken);
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
        }

        public string GetSas(string partition, SharedAccessTablePermissions permissions)
        {
            SharedAccessTablePolicy policy = new SharedAccessTablePolicy()
            {
                SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(15),
                Permissions = permissions
            };

            string sasToken = this.ServiceClient.GetTableReference("Photos").GetSharedAccessSignature(
                policy   /* access policy */,
                null     /* access policy identifier */,
                partition /* start partition key */,
                null     /* start row key */,
                partition /* end partition key */,
                null     /* end row key */);

            return sasToken;
        }

        public void AddTestStoredAccessPolicy()
        {
            tableMock.tablePermissions.SharedAccessPolicies.Clear();

            SharedAccessTablePolicy testPolicy1 = new SharedAccessTablePolicy();
            testPolicy1.Permissions = SharedAccessTablePermissions.None;
            testPolicy1.Permissions |= SharedAccessTablePermissions.Query;
            testPolicy1.SharedAccessStartTime = DateTime.Today.ToUniversalTime();
            testPolicy1.SharedAccessExpiryTime = DateTime.Today.AddDays(1).ToUniversalTime();
            tableMock.tablePermissions.SharedAccessPolicies.Add(TestPolicy1, testPolicy1);

            SharedAccessTablePolicy testPolicy2 = new SharedAccessTablePolicy();
            testPolicy1.Permissions = SharedAccessTablePermissions.None;
            testPolicy1.Permissions |= SharedAccessTablePermissions.Query;
            testPolicy1.SharedAccessStartTime = DateTime.Today.ToUniversalTime();
            testPolicy1.SharedAccessExpiryTime = DateTime.Today.AddDays(1).ToUniversalTime();
            tableMock.tablePermissions.SharedAccessPolicies.Add(TestPolicy2, testPolicy2);
        }

        public static string GetSasForTable(string username)
        {
            var cloudTableClient = StorageAccount.CreateCloudTableClient();
            var policy = new SharedAccessTablePolicy()
            {
                SharedAccessExpiryTime = DateTime.UtcNow.AddMinutes(15),
                Permissions = SharedAccessTablePermissions.Add | SharedAccessTablePermissions.Delete | SharedAccessTablePermissions.Query | SharedAccessTablePermissions.Update
            };

            var sasToken = cloudTableClient.GetTableReference("Photos").GetSharedAccessSignature(
                policy: policy,
                accessPolicyIdentifier: null,
                startPartitionKey: username,
                startRowKey: null,
                endPartitionKey: username,
                endRowKey: null);

            return sasToken;
        }

        /// <summary>
        /// Get the complete query builder for creating the Shared Access Signature query.
        /// </summary>
        /// <param name="policy">The shared access policy to hash.</param>
        /// <param name="tableName">The name of the table associated with this shared access signature.</param>
        /// <param name="accessPolicyIdentifier">An optional identifier for the policy.</param>
        /// <param name="startPartitionKey">The start partition key, or <c>null</c>.</param>
        /// <param name="startRowKey">The start row key, or <c>null</c>.</param>
        /// <param name="endPartitionKey">The end partition key, or <c>null</c>.</param>
        /// <param name="endRowKey">The end row key, or <c>null</c>.</param>
        /// <param name="signature">The signature to use.</param>
        /// <param name="accountKeyName">The name of the key used to create the signature, or <c>null</c> if the key is implicit.</param>
        /// <param name="sasVersion">A string indicating the desired SAS version to use, in storage service version format. Value must be <c>2012-02-12</c> or later.</param>
        /// <returns>The finished query builder.</returns>
        internal static UriQueryBuilder GetSignature(
            SharedAccessTablePolicy policy,
            string tableName,
            string accessPolicyIdentifier,
            string startPartitionKey,
            string startRowKey,
            string endPartitionKey,
            string endRowKey,
            string signature,
            string accountKeyName,
            string sasVersion)
        {          
            CommonUtility.AssertNotNull("signature", signature);

            UriQueryBuilder builder = new UriQueryBuilder();
 
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedVersion, sasVersion);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SasTableName, tableName);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.StartPartitionKey, startPartitionKey);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.StartRowKey, startRowKey);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.EndPartitionKey, endPartitionKey);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.EndRowKey, endRowKey);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedIdentifier, accessPolicyIdentifier);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedKey, accountKeyName);
            AddEscapedIfNotNull(builder, Constants.QueryConstants.Signature, signature);

            if (policy != null)
            {
                AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedStart, GetDateTimeOrNull(policy.SharedAccessStartTime));
                AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedExpiry, GetDateTimeOrNull(policy.SharedAccessExpiryTime));

                string permissions = SharedAccessTablePolicy.PermissionsToString(policy.Permissions);
                if (!string.IsNullOrEmpty(permissions))
                {
                    AddEscapedIfNotNull(builder, Constants.QueryConstants.SignedPermissions, permissions);
                }
            }

            return builder;
        }

        /// <summary>
        /// Manage stored access policies specified on the table
        /// </summary>
        /// <param name="table"></param>
        /// <returns></returns>
        private static async Task TableAclSample(CloudTable table)
        {
            // Set table permissions
            SharedAccessTablePolicy accessTablePolicy = new SharedAccessTablePolicy();
            accessTablePolicy.SharedAccessStartTime = new DateTimeOffset(DateTime.Now);
            accessTablePolicy.SharedAccessExpiryTime = new DateTimeOffset(DateTime.Now.AddMinutes(10));
            accessTablePolicy.Permissions = SharedAccessTablePermissions.Update;
            TablePermissions permissions = new TablePermissions();
            permissions.SharedAccessPolicies.Add("key1", accessTablePolicy);
            Console.WriteLine("Set table permissions");
            await table.SetPermissionsAsync(permissions);

            // Get table permissions
            Console.WriteLine("Get table permissions:");
            permissions = await table.GetPermissionsAsync();
            foreach (var keyValue in permissions.SharedAccessPolicies)
            {
                Console.WriteLine("  {0}:", keyValue.Key);
                Console.WriteLine("    permissions: {0}:", keyValue.Value.Permissions);
                Console.WriteLine("    start time: {0}:", keyValue.Value.SharedAccessStartTime);
                Console.WriteLine("    expiry time: {0}:", keyValue.Value.SharedAccessExpiryTime);
            }
        }

 /// <summary>
 /// Returns a shared access signature for the table.
 /// </summary>
 /// <param name="policy">A <see cref="SharedAccessTablePolicy"/> object specifying the access policy for the shared access signature.</param>
 /// <param name="accessPolicyIdentifier">A string identifying a stored access policy.</param>
 /// <param name="startPartitionKey">A string specifying the start partition key, or <c>null</c>.</param>
 /// <param name="startRowKey">A string specifying the start row key, or <c>null</c>.</param>
 /// <param name="endPartitionKey">A string specifying the end partition key, or <c>null</c>.</param>
 /// <param name="endRowKey">A string specifying the end row key, or <c>null</c>.</param>
 /// <returns>A shared access signature, as a URI query string.</returns>
 /// <remarks>The query string returned includes the leading question mark.</remarks>
 /// <exception cref="InvalidOperationException">Thrown if the current credentials don't support creating a shared access signature.</exception>
 public string GetSharedAccessSignature(
     SharedAccessTablePolicy policy,
     string accessPolicyIdentifier,
     string startPartitionKey,
     string startRowKey,
     string endPartitionKey,
     string endRowKey)
 {
     return this.GetSharedAccessSignature(
         policy,
         accessPolicyIdentifier,
         startPartitionKey,
         startRowKey,
         endPartitionKey,
         endRowKey,
         null /* sasVersion */);
 }

        public Url UsersUrl()
        {
            var policy = new SharedAccessTablePolicy
            {
                Permissions = SharedAccessTablePermissions.Query,
                SharedAccessExpiryTime = DateTime.UtcNow.AddDays(2)
            };

            var table =
                new CloudStorageAccount(
                    new StorageCredentials(
                        CloudConfigurationManager.GetSetting("storageAccountName"),
                        CloudConfigurationManager.GetSetting("storageAccountKey")),
                    true).CreateCloudTableClient().GetTableReference(ApplicationUserStore.UsersTableName);

            var token = table.GetSharedAccessSignature(policy);

            return new Url(table.Uri.AbsoluteUri + token);
        }

        /// <summary>
        /// Returns a URI containing a SAS for the table.
        /// </summary>
        /// <param name="table">A CloudTable object.</param>
        /// <param name="storedPolicyName">A string containing the name of the stored access policy. If null, an ad-hoc SAS is created.</param>
        /// <returns>A string containing the URI for the table, with the SAS token appended.</returns>
        private static string GetTableSasUri(CloudTable table, string storedPolicyName = null)
        {
            string sasTableToken;

            // If no stored policy is specified, create a new access policy and define its constraints.
            if (storedPolicyName == null)
            {
                // Note that the SharedAccessTablePolicy class is used both to define the parameters of an ad-hoc SAS, and 
                // to construct a shared access policy that is saved to the table's shared access policies. 
                SharedAccessTablePolicy adHocPolicy = new SharedAccessTablePolicy()
                {
                    // Permissions enable users to add, update, query, and delete entities in the table.
                    SharedAccessExpiryTime = DateTime.UtcNow.AddHours(24),
                    Permissions = SharedAccessTablePermissions.Add | SharedAccessTablePermissions.Update |
                        SharedAccessTablePermissions.Query | SharedAccessTablePermissions.Delete
                };

                // Generate the shared access signature on the table, setting the constraints directly on the signature.
                sasTableToken = table.GetSharedAccessSignature(adHocPolicy, null);

                Console.WriteLine("SAS for table (ad hoc): {0}", sasTableToken);
                Console.WriteLine();
            }
            else
            {
                // Generate the shared access signature on the table. In this case, all of the constraints for the
                // shared access signature are specified on the stored access policy, which is provided by name.
                // It is also possible to specify some constraints on an ad-hoc SAS and others on the stored access policy.
                // However, a constraint must be specified on one or the other; it cannot be specified on both.
                sasTableToken = table.GetSharedAccessSignature(null, storedPolicyName);

                Console.WriteLine("SAS for table (stored access policy): {0}", sasTableToken);
                Console.WriteLine();
            }

            // Return the URI string for the table, including the SAS token.
            return table.Uri + sasTableToken;
        }

        /// <summary>
        /// Creates SAS constraints from the given parameters.
        /// </summary>
        /// <param name="permissions">The permission set.</param>
        /// <param name="expiration">The expiration time.</param>
        /// <returns>Returns the access policy.</returns>
        private static SharedAccessTablePolicy GetTableSasConstraints(ResourcePermissions permissions, DateTime? expiration)
        {
            SharedAccessTablePolicy sasConstraints = new SharedAccessTablePolicy();

            // Set the start time to five minutes in the past.
            sasConstraints.SharedAccessStartTime = DateTimeOffset.Now - TimeSpan.FromMinutes(5);

            // Expiration.
            if (expiration != null)
            {
                sasConstraints.SharedAccessExpiryTime = expiration.Value;
            }

            // Permissions.
            sasConstraints.Permissions = SharedAccessTablePermissions.None;
            if ((permissions & ResourcePermissions.Read) == ResourcePermissions.Read)
            {
                sasConstraints.Permissions |= SharedAccessTablePermissions.Query;
            }

            if ((permissions & ResourcePermissions.Add) == ResourcePermissions.Add)
            {
                sasConstraints.Permissions |= SharedAccessTablePermissions.Add;
            }

            if ((permissions & ResourcePermissions.Update) == ResourcePermissions.Update)
            {
                sasConstraints.Permissions |= SharedAccessTablePermissions.Update;
            }

            if ((permissions & ResourcePermissions.Delete) == ResourcePermissions.Delete)
            {
                sasConstraints.Permissions |= SharedAccessTablePermissions.Delete;
            }

            return sasConstraints;
        }

        public async Task TableSasUriTestAsync()
        {
            CloudTableClient tableClient = GenerateCloudTableClient();
            CloudTable table = tableClient.GetTableReference("T" + Guid.NewGuid().ToString("N"));

            try
            {
                await table.CreateAsync();

                BaseEntity entity = new BaseEntity("PK", "RK");
                BaseEntity entity1 = new BaseEntity("PK", "RK1");
                await table.ExecuteAsync(TableOperation.Insert(entity));
                await table.ExecuteAsync(TableOperation.Insert(entity1));

                SharedAccessTablePolicy policy = new SharedAccessTablePolicy()
                {
                    SharedAccessStartTime = DateTimeOffset.UtcNow.AddMinutes(-5),
                    SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddMinutes(30),
                    Permissions = SharedAccessTablePermissions.Delete,
                };

                string sasToken = table.GetSharedAccessSignature(policy, null, null, null, null, null);
                StorageCredentials creds = new StorageCredentials(sasToken);
                CloudStorageAccount sasAcc = new CloudStorageAccount(creds, null /* blobEndpoint */, null /* queueEndpoint */, new Uri(TestBase.TargetTenantConfig.TableServiceEndpoint), null /* fileEndpoint */);
                CloudTableClient client = sasAcc.CreateCloudTableClient();

                CloudTable sasTable = new CloudTable(client.Credentials.TransformUri(table.Uri));
                await sasTable.ExecuteAsync(TableOperation.Delete(entity));

                CloudTable sasTable2 = new CloudTable(new Uri(table.Uri.ToString() + sasToken));
                await sasTable2.ExecuteAsync(TableOperation.Delete(entity1));
            }
            finally
            {
                table.DeleteIfExistsAsync().AsTask().Wait();
            }
        }

        public void TableUpdateSasTestSync()
        {
            CloudTableClient tableClient = GenerateCloudTableClient();
            CloudTable table = tableClient.GetTableReference("T" + Guid.NewGuid().ToString("N"));

            try
            {
                table.Create();

                BaseEntity entity = new BaseEntity("PK", "RK");
                table.Execute(TableOperation.Insert(entity));

                SharedAccessTablePolicy policy = new SharedAccessTablePolicy()
                {
                    SharedAccessStartTime = DateTimeOffset.UtcNow.AddMinutes(-5),
                    SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddMinutes(30),
                    Permissions = SharedAccessTablePermissions.Delete,
                };

                string sasToken = table.GetSharedAccessSignature(policy);
                StorageCredentials creds = new StorageCredentials(sasToken);
                CloudTable sasTable = new CloudTable(table.Uri, creds);
                TestHelper.ExpectedException(
                    () => sasTable.Execute(TableOperation.Insert(new BaseEntity("PK", "RK2"))),
                    "Try to insert an entity when SAS doesn't allow inserts",
                    HttpStatusCode.NotFound);

                sasTable.Execute(TableOperation.Delete(entity));

                SharedAccessTablePolicy policy2 = new SharedAccessTablePolicy()
                {
                    SharedAccessStartTime = DateTimeOffset.UtcNow.AddMinutes(-5),
                    SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddMinutes(30),
                    Permissions = SharedAccessTablePermissions.Delete | SharedAccessTablePermissions.Add,
                };

                string sasToken2 = table.GetSharedAccessSignature(policy2);
                creds.UpdateSASToken(sasToken2);

                sasTable = new CloudTable(table.Uri, creds);

                sasTable.Execute(TableOperation.Insert(new BaseEntity("PK", "RK2")));

            }
            finally
            {
                table.DeleteIfExists();
            }
        }

        public void CloudTableSASWithAbsoluteUri()
        {
            CloudTableClient tableClient = GenerateCloudTableClient();

            CloudTable table = tableClient.GetTableReference(tableClient.BaseUri + GenerateRandomTableName());
            try
            {
                table.CreateIfNotExists();

                BaseEntity entity = new BaseEntity("PK", "RK");
                table.Execute(TableOperation.Insert(entity));

                SharedAccessTablePolicy policy = new SharedAccessTablePolicy()
                {
                    Permissions = SharedAccessTablePermissions.Delete,
                    SharedAccessStartTime = DateTimeOffset.UtcNow.AddMinutes(-5),
                    SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddMinutes(10)
                };

                string sasToken = table.GetSharedAccessSignature(policy);
                StorageCredentials creds = new StorageCredentials(sasToken);

                CloudTable sasTable = new CloudTable(table.Uri, creds);
                sasTable.Execute(TableOperation.Delete(entity));
            }
            finally
            {
                table.DeleteIfExists();
            }
        }

        /// <summary>
        /// Get the signature hash embedded inside the Shared Access Signature.
        /// </summary>
        /// <param name="policy">The shared access policy to hash.</param>
        /// <param name="accessPolicyIdentifier">An optional identifier for the policy.</param>
        /// <param name="startPartitionKey">The start partition key, or null.</param>
        /// <param name="startRowKey">The start row key, or null.</param>
        /// <param name="endPartitionKey">The end partition key, or null.</param>
        /// <param name="endRowKey">The end row key, or null.</param>
        /// <param name="resourceName">The canonical resource string, unescaped.</param>
        /// <param name="keyValue">The key value retrieved as an atomic operation used for signing.</param>
        /// <returns>The signed hash.</returns>
        internal static string GetSharedAccessSignatureHashImpl(
            SharedAccessTablePolicy policy,
            string accessPolicyIdentifier,
            string startPartitionKey,
            string startRowKey,
            string endPartitionKey,
            string endRowKey,
            string resourceName,
            byte[] keyValue)
        {
            if (policy == null)
            {
                return GetSharedAccessSignatureHashImpl(
                    null /* policy.Permissions */,
                    null /* policy.SharedAccessStartTime */,
                    null /* policy.SharedAccessExpiryTime */,
                    startPartitionKey,
                    startRowKey,
                    endPartitionKey,
                    endRowKey,
                    true /* using table SAS */,
                    accessPolicyIdentifier,
                    resourceName,
                    keyValue);
            }

            return GetSharedAccessSignatureHashImpl(
                SharedAccessTablePolicy.PermissionsToString(policy.Permissions),
                policy.SharedAccessStartTime,
                policy.SharedAccessExpiryTime,
                startPartitionKey,
                startRowKey,
                endPartitionKey,
                endRowKey,
                true /* using table SAS */,
                accessPolicyIdentifier,
                resourceName,
                keyValue);
        }

        /// <summary>
        /// Get the complete query builder for creating the Shared Access Signature query.
        /// </summary>
        /// <param name="policy">The shared access policy to hash.</param>
        /// <param name="tableName">The name of the table associated with this shared access signature.</param>
        /// <param name="accessPolicyIdentifier">An optional identifier for the policy.</param>
        /// <param name="startPartitionKey">The start partition key, or null.</param>
        /// <param name="startRowKey">The start row key, or null.</param>
        /// <param name="endPartitionKey">The end partition key, or null.</param>
        /// <param name="endRowKey">The end row key, or null.</param>
        /// <param name="signature">The signature to use.</param>
        /// <param name="accountKeyName">The name of the key used to create the signature, or null if the key is implicit.</param>
        /// <returns>The finished query builder.</returns>
        internal static UriQueryBuilder GetSharedAccessSignatureImpl(
            SharedAccessTablePolicy policy,
            string tableName,
            string accessPolicyIdentifier,
            string startPartitionKey,
            string startRowKey,
            string endPartitionKey,
            string endRowKey,
            string signature,
            string accountKeyName)
        {          
            CommonUtility.AssertNotNull("signature", signature);

            if (policy == null)
            {
                return GetSharedAccessSignatureImpl(
                    null /* policy.Permissions */,
                    null /* policy.SharedAccessStartTime */,
                    null /* policy.SharedAccessExpiryTime */,
                    startPartitionKey,
                    startRowKey,
                    endPartitionKey,
                    endRowKey,
                    accessPolicyIdentifier,
                    null /* resourceType (blob only) */,
                    tableName,
                    signature,
                    accountKeyName);
            }

            string permissions = SharedAccessTablePolicy.PermissionsToString(policy.Permissions);
            if (string.IsNullOrEmpty(permissions))
            {
                permissions = null;
            }

            return GetSharedAccessSignatureImpl(
                permissions,
                policy.SharedAccessStartTime,
                policy.SharedAccessExpiryTime,
                startPartitionKey,
                startRowKey,
                endPartitionKey,
                endRowKey,
                accessPolicyIdentifier,
                null /* resourceType (blob only) */,
                tableName,
                signature,
                accountKeyName);
        }

		static string RequestSasToken(CloudTable table, string customerId)
		{
			// Omitting any authentication code since this is beyond the scope of
			// this sample code

			// creating a shared access policy that expires in 1 day.
			// No start time is specified, which means that the token is valid immediately.
			// The policy specifies full permissions.
			SharedAccessTablePolicy policy = new SharedAccessTablePolicy()
			{
				SharedAccessStartTime = DateTime.UtcNow.AddMinutes(-15),
				SharedAccessExpiryTime = DateTime.UtcNow.AddDays(1.0),
				Permissions = SharedAccessTablePermissions.Add
					| SharedAccessTablePermissions.Query
					| SharedAccessTablePermissions.Update
					| SharedAccessTablePermissions.Delete
			};

			// Generate the SAS token. No access policy identifier is used which
			// makes it a non-revocable token
			// limiting the table SAS access to only the request customer's id
			string sasToken = table.GetSharedAccessSignature(
				policy   /* access policy */,
				null     /* access policy identifier */,
				customerId /* start partition key */,
				null     /* start row key */,
				customerId /* end partition key */,
				null     /* end row key */);

			return sasToken;
		}

        internal static string GetHash(
            SharedAccessTablePolicy policy,
            string accessPolicyIdentifier,
            string startPartitionKey,
            string startRowKey,
            string endPartitionKey,
            string endRowKey,
            string resourceName,
            string sasVersion,
            byte[] keyValue)
        {
            CommonUtility.AssertNotNullOrEmpty("resourceName", resourceName);
            CommonUtility.AssertNotNull("keyValue", keyValue);
            CommonUtility.AssertNotNullOrEmpty("sasVersion", sasVersion);

            string permissions = null;
            DateTimeOffset? startTime = null;
            DateTimeOffset? expiryTime = null;
            if (policy != null)
            {
                permissions = SharedAccessTablePolicy.PermissionsToString(policy.Permissions);
                startTime = policy.SharedAccessStartTime;
                expiryTime = policy.SharedAccessExpiryTime;
            }

            //// StringToSign =      signedpermissions + "\n" +
            ////                     signedstart + "\n" +
            ////                     signedexpiry + "\n" +
            ////                     canonicalizedresource + "\n" +
            ////                     signedidentifier + "\n" +
            ////                     signedversion + "\n" +
            ////                     startpk + "\n" +
            ////                     startrk + "\n" +
            ////                     endpk + "\n" +
            ////                     endrk
            ////
            //// HMAC-SHA256(UTF8.Encode(StringToSign))

            string stringToSign = string.Format(
                                     CultureInfo.InvariantCulture,
                                     "{0}\n{1}\n{2}\n{3}\n{4}\n{5}\n{6}\n{7}\n{8}\n{9}",
                                     permissions,
                                     GetDateTimeOrEmpty(startTime),
                                     GetDateTimeOrEmpty(expiryTime),
                                     resourceName,
                                     accessPolicyIdentifier,
                                     sasVersion,
                                     startPartitionKey,
                                     startRowKey,
                                     endPartitionKey,
                                     endRowKey);

            return CryptoUtility.ComputeHmac256(keyValue, stringToSign);
        }