Looking for a slightly more detailed explanation of blob authorization about azure-sdk-for-net HOT 5 CLOSED

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

from azure-sdk-for-net.

@jsquire -- Any chance someone is able to pick this up?

from azure-sdk-for-net.

@atrauzzi : I do not have insight. We'll need someone from the @xgithubtriage team who own this library to answer that.

from azure-sdk-for-net.

Any chance we can get their attention?

from azure-sdk-for-net.

Hi @atrauzzi,

When performing regular blob binary operations (upload, download) using the SDK, does the SDK simply abstract around pre-signed requests and then hand those URLs to an HTTP request layer, or does the SDK select different ways of authorizing requests outside of pre-signing based on certain criteria?

When you new up a client in the storage SDK, you need to select if you wish to use Shared Key, OAuth, or SAS for authentication and provide the necessary credentials. This authentication method is then used for all REST request that originate from the storage client in question.

How is container-to-container copy authorization handled? Do all container-to-container operations make use of SAS, or do they support any kind of identity that can be assigned to containers themselves?

Yes, all copies require a source SAS URL, or that the source be publicly accessible. More information can be found in the public rest docs - https://learn.microsoft.com/en-us/rest/api/storageservices/copy-blob-from-url?tabs=microsoft-entra-id. You must create these source SAS URLs, the SDK does not handle this automatically, as the source could be in a different storage account or another source the client in question is not authenticated for.

from azure-sdk-for-net.