通过Managed Identity c#访问AzureBlobStorage

Question

我想知道是否没有实际的实现来访问c#和azure托管身份的blobstorage？

我知道可以通过弃用的nuget包WindowsAzure.Storage 9.3.3访问它，但是看起来新的Microsoft.Azure.Storage.Blob 11.2.1还没有实现这个功能……

我是不是遗漏了什么？

Answer 1

Azure.Identity库具有TokenCredential抽象类的实现，可用于对Azure.Storage.Blobs库中的客户端进行身份验证。ManagedIdentityCredential可用于在启用了托管身份的azure主机上对客户端进行身份验证。

var blobServiceClient = new BlobServiceClient(new Uri($"https://{AccountName}.blob.core.windows.net"), new ManagedIdentityCredential());

有关Azure.Identity库的更多信息，请访问here。

Answer 2

使用Azure.Storage.Blobs，您可以执行以下操作：

public class ManagedIdentityTokenCredentials : TokenCredential
{
    private const string Resource = "https://storage.azure.com/";
    private readonly string _tenantId;

    public ManagedIdentityTokenCredentials(string tenantId)
    {
        _tenantId = tenantId;
    }

    public override async ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        var result = await new AzureServiceTokenProvider().GetAuthenticationResultAsync(Resource, _tenantId, cancellationToken: cancellationToken);
        return new AccessToken(result.AccessToken, result.ExpiresOn);
    }

    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
    {
        return GetTokenAsync(requestContext, cancellationToken).GetAwaiter().GetResult();
    }
}

...

var blobServiceClient = new BlobServiceClient(new Uri($"https://{AccountName}.blob.core.windows.net"), new ManagedIdentityTokenCredentials(TenantId));