How do I use the credentials in ~/.azure folder?

[apengwin]

I'm playing around with Azure blob storage, and I currently pass in my authentication info manually in my python code.

from azure.storage.blob import BlockBlobService
foo = BlockBlobService(account_name, access_key)

I was wondering if there was to use the access tokens or credentials stored in the ~/.azure folder to automatically populate the authentication credentials, similar to how boto3 searches in ~/.aws/credentials?

For reference, this is the contents of the ~/.azure folder

(venv) airbears2-10-142-32-217:~ allanpeng$ ls ~/.azure
accessTokens.json	az.json			az.sess			azureProfile.json	clouds.config		config

[lmazuel]

Hi @apengwin

This is an excellent question, and this has moved a lot recently. Today, my response would be:

• Use az login to authenticate using Service Principal to the CLI (do not use interactive login)
• Use the CLI profile loader to get your client:
  https://docs.microsoft.com/python/azure/python-sdk-azure-authenticate#cli-based-authentication

In a few days, you will be able to save a authentication file and load it in the SDK like:

        from azure.common.client_factory import get_client_from_auth_file
        from azure.mgmt.compute import ComputeManagementClient
        client = get_client_from_auth_file(ComputeManagementClient)

I will release that probably tomorrow, it's nothing but updating release notes and pushing to PyPI.

However, this is not working for client not based on Service Principal authentication, like Storage. What you can do with Storage, is to use a service principal credentials to get the Storage credentials:

client = get_client_from_auth_file(StorageManagementClient)
storage_keys = storage_client.storage_accounts.list_keys(resource_group_name, storage_account_name)
storage_keys = {v.key_name: v.value for v in storage_keys.keys}

storage_client = CloudStorageAccount(storage_account_name, storage_keys['key1'])
blob_service = storage_client.create_block_blob_service()

FYI @yugangw-msft

[lmazuel]

@apengwin can we close this issue or you think it does not respond correctly to it?
Thanks!

[apengwin]

@lmazuel yup. thanks!

[zeelot]

Hello! So I'm still pretty confused about this a few years later…
I am trying to create a blob client with the credentials generated by az login but have the blob calls be traceable back to my user (through the monitoring logs).

I don't know where to ask the question but this issue seemed like the best lead I had but using the storage account keys directly is not what I want :(

Can someone help me find the right approach?