Skip to content

Draft: Add support for Service Principal authentication and Azure REST API

Richard Sheppardrequested to merge
issue/az_blob_fs-3327278:3327278-service-principal-authentication into 8.3.x
  • Introduced AzBlobAuthService with bearer token handling via Azure AD
  • Added AzBlobRestClient for native REST-based blob operations (upload, download, delete, check)
  • Created AzBlobTestController for verifying operations manually via route endpoints
  • Extended config form to support 'sas' or 'service_principal' auth modes
  • Updated schema and config validation to support new key-based secrets
  • Registered new services and ensured full DI compatibility
  • Defined a logger.channel.az_blob_fs and injected it into new service classes

This modernizes az_blob_fs for REST-based authentication workflows and lays the groundwork for a 3.x architecture

To-do:

  • Refactor existing stream wrapper classes (AzBlobFsStreamWrapper, etc.) to route operations through AzBlobRestClient instead of the SDK-based AzBlobRestProxyAlter.
  • Refactor AzBlobFsStream and AzBlobFsStreamWrapper to use AzBlobRestClient for file streaming operations (fwrite, etc.) via authenticated REST calls.
  • Add unit tests for AzBlobRestClient with proper mocking of Guzzle responses and access token handling.
  • Evaluate deprecation strategy for microsoft/azure-storage-blob SDK and align with roadmap for 3.x.
  • Consider extracting an interface for AzBlobAuthService to support both SAS and Service Principal implementations (if shared use emerges).
  • Write functional test coverage for upload, download, and delete via custom test controller or BrowserTestBase.

Closes #3327278

Merge request reports