3686562 - Image Conversion Failures due to 403 AuthenticationFailed in SAP Commerce Cloud

Symptom

Images fail during conversion process when using the "Convert missing images" function in backoffice or when importing images via hotfolder. Error messages similar to the following are observed in Kibana logs:

An unexpected problem occurred during conversion of commands -resize 421x281> with error If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call. If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call. Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII. If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call. If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call. Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII. Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:b61f62d8-c01e-0036-1aa6-4d04ba000000 Time:2025-11-04T16:20:19.9994059Z</Message><AuthenticationErrorDetail>Signature not valid in the specified time frame: Start [Tue, 04 Nov 2025 16:20:20 GMT] - Expiry [Tue, 04 Nov 2025 16:25:20 GMT] - Current [Tue, 04 Nov 2025 16:20:19 GMT]</AuthenticationErrorDetail></Error>" com.azure.storage.blob.models.BlobStorageException: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call. If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call. Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII. If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call. If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call. Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII. Status code 403, "<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. RequestId:b61f62d8-c01e-0036-1aa6-4d04ba000000 Time:2025-11-04T16:20:19.9994059Z</Message><AuthenticationErrorDetail>Signature not valid in the specified time frame: Start [Tue, 04 Nov 2025 16:20:20 GMT] - Expiry [Tue, 04 Nov 2025 16:25:20 GMT] - Current [Tue, 04 Nov 2025 16:20:19 GMT]</AuthenticationErrorDetail></Error>" ......

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

Environment

SAP Commerce Cloud

Product

SAP Commerce Cloud all versions

Keywords

image conversion, SAS token, invalid timestamp, Azure Blob Storage, error 403, signature mismatch, expiry, image processing failure, cloud media processing , KBA , CEC-SCC-PLA-PL , Platform , Bug Filed

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP for Me (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.