Crate reqsign_azure_storage

Available on crate feature services-azblob only.

Expand description

Re-export of the reqsign_azure_storage crate that this service signs requests with.

Azblob::credential_provider_chain takes a chain of providers for reqsign_azure_storage::Credential. Implement providers against this re-export and opendal_core::reqsign_core rather than depending on the reqsign crates directly, so that the types always match the ones this service is built with. Azure Storage signing implementation for reqsign.

This crate provides comprehensive signing support for Azure Storage services including Blob Storage, File Storage, Queue Storage, and Table Storage.

§Overview

Azure Storage supports multiple authentication methods, and this crate implements all major ones:

Shared Key: Using storage account access keys
SAS Token: Pre-generated Shared Access Signature tokens
Bearer Token: OAuth2/Azure AD authentication

§Quick Start

use anyhow::Result;
use reqsign_azure_storage::{DefaultCredentialProvider, RequestSigner};
use reqsign_core::{Context, Signer};
use reqsign_file_read_tokio::TokioFileRead;
use reqsign_http_send_reqwest::ReqwestHttpSend;
use reqwest::Client;

#[tokio::main]
async fn main() -> Result<()> {
    // Create context
    let ctx = Context::new()
        .with_file_read(TokioFileRead::default())
        .with_http_send(ReqwestHttpSend::default());

    // Create credential loader (will try multiple methods)
    let loader = DefaultCredentialProvider::new();

    // Create request builder
    let builder = RequestSigner::new();

    // Create the signer
    let signer = Signer::new(ctx, loader, builder);

    // Sign requests
    let mut req = http::Request::get("https://mystorageaccount.blob.core.windows.net/container/blob")
        .body(())
        .unwrap()
        .into_parts()
        .0;

    signer.sign(&mut req, None).await?;
    Ok(())
}

§Credential Sources

§Environment Variables

# For Shared Key authentication
export AZURE_STORAGE_ACCOUNT_NAME=mystorageaccount
export AZURE_STORAGE_ACCOUNT_KEY=base64key

# For SAS Token authentication
export AZURE_STORAGE_SAS_TOKEN=sv=2021-06-08&ss=b&srt=sco...

# For Azure AD authentication
export AZURE_CLIENT_ID=client-id
export AZURE_CLIENT_SECRET=client-secret
export AZURE_TENANT_ID=tenant-id

§Managed Identity

When running on Azure services (VMs, App Service, AKS), the crate automatically uses managed identity:

use reqsign_azure_storage::DefaultCredentialProvider;

// Create loader that will try managed identity
let loader = DefaultCredentialProvider::new();

Customize the default chain with slot-based builder APIs:

use reqsign_azure_storage::{
    ClientSecretCredentialProvider, DefaultCredentialProvider,
};

let loader = DefaultCredentialProvider::builder()
    .no_env()
    .client_secret(ClientSecretCredentialProvider::new().with_tenant_id("tenant-id"))
    .no_imds()
    .build();

§Storage Services

§Blob Storage

// List containers
let req = Request::get("https://account.blob.core.windows.net/?comp=list")
    .body(())
    .unwrap();

// Get blob
let req = Request::get("https://account.blob.core.windows.net/container/blob.txt")
    .body(())
    .unwrap();

§File Storage

// List shares
let req = Request::get("https://account.file.core.windows.net/?comp=list")
    .body(())
    .unwrap();

§Advanced Features

§Account SAS Generation

Generate SAS tokens for delegated access:

// Account SAS is not yet exposed in the public API
// This is planned for future releases

§Using Specific Credential Providers

use reqsign_azure_storage::{StaticCredentialProvider, EnvCredentialProvider};

// Use static credentials
let static_loader = StaticCredentialProvider::new_shared_key(
    "mystorageaccount",
    "base64key"
);

// Or use environment variables
let env_loader = EnvCredentialProvider::new();

§Examples

Check out the examples directory for more detailed usage:

Structs§

AzureCliCredentialProvider: AzureCliCredentialProvider provides credentials from Azure CLI
AzurePipelinesCredentialProvider: AzurePipelinesCredentialProvider provides credentials using Azure Pipelines workload identity
ClientCertificateCredentialProvider: ClientCertificateCredentialProvider provides credentials using a client certificate
ClientSecretCredentialProvider: Load credential from Azure Client Secret.
DefaultCredentialProvider: Default loader that tries multiple credential sources in order.
DefaultCredentialProviderBuilder: Builder for DefaultCredentialProvider.
EnvCredentialProvider
ImdsCredentialProvider: Load credential from Azure Instance Metadata Service (IMDS).
RequestSigner: RequestSigner that implement Azure Storage Shared Key Authorization.
ServiceSharedAccessSignature: Service SAS generator using Shared Key.
StaticCredentialProvider
WorkloadIdentityCredentialProvider: Load credential from Azure Workload Identity.

Enums§

Credential: Credential enum for different Azure Storage authentication methods.
ServiceSasResource: Resource level for Azure Storage Service SAS.