-
Notifications
You must be signed in to change notification settings - Fork 437
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Upgrade storage client & support Entra identities for storage in more scenarios #3573
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi, I've tried your fork and with a few minor exceptions, it worked perfectly and solved my deployment problem. Thank you!
There are just two small changes I've made to allow working with a Storage Account that has Shared Keys turned off.
{ | ||
var storageAccount = await ArmClient.FindStorageAccount(accountName); | ||
blobContainerClient = new BlobContainerClient(new UriBuilder(storageAccount.Properties.PrimaryEndpoints.Blob) { Path = containerName }.Uri, | ||
new Storage.StorageSharedKeyCredential(accountName, storageAccount.Key.Value)); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove the StorageSharedKeyCredential and use this.Credential instead.
This allows disabling Shared Keys on the storage account altogether.
|
||
return blob.Uri + blobToken; | ||
return blob.GenerateSasUri(sasConstraints).ToString(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Again, to allow disabling Shared Keys on the storage account, return blob.Uri in case managed identity is used.
Issue describing the changes in this PR
Resolves #3376
Pull request checklist
PR overview:
AzureCliCredential
andAzurePowerShellCredential
to fetch an access token instead of the code that calls the CLIsDefaultAzureCredential
to preserve the current behavior, as it might require the user to specify a tenant ID under certain conditionsAzureWebJobsStorage__accountName
in more scenarios: