Add support for identity SAS #153

c-w · 2020-01-24T17:07:48Z

Since API version 2018-11-09, we can use Azure Active Directory credentials to authenticate with storage services which is crucial for enterprise and multi-tenancy use-cases. This pull request adds support for this functionality.

Relevant supporting content:

When running the integration tests locally, I noticed that a few of them fail with this branch. However, several of the integration tests also fail for me with the current master branch. Any help that you could provide with regards to working on the integration tests would be much appreciated.

This change also adds a new integration test for the identity SAS which requires three new environment variables to be set: AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. These environment variables specify the Azure Active Directory identity to use for the new integration test. Note that the identity must be granted the "Storage Blob Data Contributor" and "Storage Blob Delegator" permissions on the storage account. The following bash script can be used to set up the required Azure Active Directory configuration and environment variables:

## create service principal for integration tests

service_principal_name="azure-storage-ruby-integtest"  # CHANGE ME

sp="$(az ad sp create-for-rbac --name "${service_principal_name}" --skip-assignment -o json)"
sp_tenant="$(jq -r '.tenant' <<< "${sp}")"
sp_client="$(jq -r '.appId' <<< "${sp}")"
sp_secret="$(jq -r '.password' <<< "${sp}")"

## assign permissions to service principal

storage_resource_id="$(az storage account show --name "${AZURE_STORAGE_ACCOUNT}" -o json | jq -r '.id')"

while ! az role assignment create --role "Storage Blob Data Contributor" --assignee "${sp_client}" --scope "${storage_resource_id}"; do sleep 2s; done

while ! az role assignment create --role "Storage Blob Delegator" --assignee "${sp_client}" --scope "${storage_resource_id}"; do sleep 2s; done

## export environment variables required for integration tests

export AZURE_TENANT_ID="${sp_tenant}"
export AZURE_CLIENT_ID="${sp_client}"
export AZURE_CLIENT_SECRET="${sp_secret}"

coveralls · 2020-01-24T17:10:09Z

Coverage increased (+0.04%) to 87.092% when pulling 04e0917 on c-w:user-delegation-key into 5cf7a82 on Azure:dev.

yaxia · 2020-03-04T04:15:45Z

We merged the code of azure-ruby-asm-core and fixed the merge validation. Please resolve the conflicts on the latest code.
There are also several comments:

Any scenario that you require the minimum Ruby version to v2.4?
As the API version is upgrade to 2018-11-09, there are some server behavior changes. @katmsft will work on the mitigation based on this PR.
Since the api version is bumped up from 2017-11-09, we don't have a timeline to support all the feature in 2018-11-09 and 2018-03-28.

PS: there string-to-sign in the doc: Create a user delegation SAS was wrong. I've sent a PR to fix it. If you already have code to generate the delegation SAS, please modify it accordingly (no signed identifier, singed resource type and signed blob snapshot time should be added).

katmsft

My major concern was about dropping ruby version 2.3.0 and the version bumps up (2.0.0 instead of 1.2.0). Please rebase to the latest dev branch and change them. Thanks!
Also, we can only use target testing to verify the E2E scenario for user delegation key, please confirm in the thread that this is already covered. Thanks for your contribution!

katmsft · 2020-03-05T14:31:10Z

.travis.yml

- 2.2.2
- 2.4.1
- 2.5.0
+- 2.4


Why 2.3 is also dropped? Can we add it back?

I dropped support for 2.3 since it's been end of life since 2019-03-31. I will add back the version.