-
Notifications
You must be signed in to change notification settings - Fork 2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* adding audiences for each class * adding support for all client builders to have audience as field * everything but datalake file api and filesystem api * fromstring test and bugfixes * bugfix and recordings besides blobs * blob recordings * style * spelling errors apparently * more style and rerecording * removed broken test * queue recordings * fileshare recordings * blob recordings * comment changes --------- Co-authored-by: Rabab Ibrahim <[email protected]>
- Loading branch information
1 parent
cea7a30
commit 4133bd2
Showing
48 changed files
with
1,553 additions
and
39 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
66 changes: 66 additions & 0 deletions
66
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/models/BlobAudience.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License. | ||
|
|
||
| package com.azure.storage.blob.models; | ||
|
|
||
| import com.azure.core.util.ExpandableStringEnum; | ||
|
|
||
| import java.util.Collection; | ||
|
|
||
| /** | ||
| * The audience to be used when requesting a token from Azure Active Directory (AAD). | ||
| * Note: This audience only has an effect when authenticating a TokenCredential. | ||
| */ | ||
| public class BlobAudience extends ExpandableStringEnum<BlobAudience> { | ||
|
|
||
| /** | ||
| * Gets default Audience used to acquire a token for authorizing requests to any Azure Storage account. | ||
| * If no audience is specified, this resource ID is the default value: "https://storage.azure.com/". | ||
| */ | ||
| public static final BlobAudience AZURE_PUBLIC_CLOUD = fromString("https://storage.azure.com/"); | ||
|
|
||
| /** | ||
| * Creates a new instance of {@link BlobAudience} without a {@link #toString()} value. | ||
| * This constructor shouldn't be called as it will produce a {@link BlobAudience} which doesn't have a String enum | ||
| * value. | ||
| * | ||
| * @deprecated Use one of the constants or the {@link #fromString(String)} factory method. | ||
| */ | ||
| @Deprecated | ||
| public BlobAudience() { | ||
| } | ||
|
|
||
| /** | ||
| * The service endpoint for a given storage account. Use this method to acquire a token for authorizing requests to | ||
| * that specific Azure Storage account and service only. | ||
| * | ||
| * @param storageAccountName The storage account name used to populate the service endpoint. | ||
| * @return the audience with the blob service endpoint. | ||
| */ | ||
| public static BlobAudience createBlobServiceAccountAudience(String storageAccountName) { | ||
| return fromString(String.format("https://%s.blob.core.windows.net/", storageAccountName)); | ||
| } | ||
|
|
||
| /** | ||
| * The Azure Active Directory audience to use when forming authorization scopes. | ||
| * For the Language service, this value corresponds to a URL that identifies the Azure cloud where the resource is | ||
| * located. | ||
| * For more information see | ||
| * <a href="https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory"> | ||
| * Authorize access to Azure blobs using Azure Active Directory</a>. | ||
| * | ||
| * @param audience The Azure Active Directory audience to use when forming authorization scopes. | ||
| * @return the corresponding BlobAudience. | ||
| */ | ||
| public static BlobAudience fromString(String audience) { | ||
| return fromString(audience, BlobAudience.class); | ||
| } | ||
|
|
||
| /** | ||
| * @return known BlobAudience values. | ||
| */ | ||
| public static Collection<BlobAudience> values() { | ||
| return values(BlobAudience.class); | ||
| } | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
87 changes: 87 additions & 0 deletions
87
...orage/azure-storage-blob/src/samples/java/com/azure/storage/blob/BlobAudienceExample.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package com.azure.storage.blob; | ||
|
|
||
| import com.azure.core.credential.TokenCredential; | ||
| import com.azure.identity.DefaultAzureCredentialBuilder; | ||
| import com.azure.storage.blob.models.BlobAudience; | ||
|
|
||
| import java.util.Locale; | ||
|
|
||
| /** | ||
| * This example shows how to use audience-based authentication with Azure Storage fpr blobs. Audience-based | ||
| * authentication requires AAD authentication. The audience is to be used when requesting a token from | ||
| * Azure Active Directory (AAD). Note: This audience only has an effect when authenticating a TokenCredential. | ||
| */ | ||
| public class BlobAudienceExample { | ||
|
|
||
| public static void main(String[] args) { | ||
| /* | ||
| * From the Azure portal, get your Storage account's name. | ||
| */ | ||
| String accountName = SampleHelper.getAccountName(); | ||
|
|
||
| /* | ||
| * audience will look like: "https://<your storage account>.blob.core.windows.net" | ||
| */ | ||
| BlobAudience audience = BlobAudience.createBlobServiceAccountAudience(accountName); | ||
|
|
||
| /* The credential used is DefaultAzureCredential because it combines commonly used credentials | ||
| * in deployment and development and chooses the credential to used based on its running environment. | ||
| * More information can be found at: https://learn.microsoft.com/java/api/overview/azure/identity-readme | ||
| * AAD authentication is required for audience-based authentication. | ||
| */ | ||
| TokenCredential tokenCredential = new DefaultAzureCredentialBuilder().build(); | ||
|
|
||
| /* | ||
| * From the Azure portal, get your Storage account blob service URL endpoint. | ||
| * The URL typically looks like this: | ||
| */ | ||
| String endpoint = String.format(Locale.ROOT, "https://%s.blob.core.windows.net", accountName); | ||
|
|
||
| /* | ||
| * Create a BlobServiceClient object that wraps the service endpoint, credential and a request pipeline. | ||
| */ | ||
| BlobServiceClient serviceClient = new BlobServiceClientBuilder() | ||
| .endpoint(endpoint) | ||
| .credential(tokenCredential) | ||
| .audience(null) // The default audience is "https://storage.azure.com" | ||
| .buildClient(); | ||
|
|
||
| // This call will succeed because the default audience is "https://storage.azure.com" | ||
| serviceClient.getProperties(); | ||
|
|
||
|
|
||
| /* | ||
| Now create a BlobContainerClient that takes a specific audience. | ||
| */ | ||
| BlobContainerClient containerClient = new BlobContainerClientBuilder() | ||
| .endpoint(endpoint) | ||
| .credential(tokenCredential) | ||
| .audience(audience) | ||
| .containerName("myContainer") | ||
| .buildClient(); | ||
|
|
||
| /* | ||
| Any calls to the service should successfully work with the specified audience. | ||
| */ | ||
| containerClient.create(); | ||
| containerClient.getBlobClient("myBlob").uploadFromFile("path/to/file"); | ||
|
|
||
| /* | ||
| The storage account name must be a valid name. If an incorrect storage account name is specified, authentication | ||
| will fail. | ||
| */ | ||
| BlobAudience badAudience = BlobAudience.createBlobServiceAccountAudience("invalidAccount"); | ||
| BlobContainerClient badContainerClient = new BlobContainerClientBuilder() | ||
| .endpoint(endpoint) | ||
| .credential(tokenCredential) | ||
| .audience(badAudience) // audience will look like: "https://invalidaccount.blob.core.windows.net" | ||
| .containerName("myBadContainer") | ||
| .buildClient(); | ||
|
|
||
| try { | ||
| badContainerClient.create(); | ||
| } catch (Exception e) { | ||
| System.out.println("Authentication failed with invalid storage account name."); | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.