I build an app in angular and i want to enable authenticated users the ability to downlead files acording their access permissions for this I try to use Azure AD and azure rbac for authentication and autheriztion, and use azure blob in order to store my files ,I searched a lot on the internet, and although I came across solutions on how to authenticate by msal library I did not find any solution on how to authenticate and AUTHERIZE users to use blob storage , I would very appreciate many instructions or tutorial how to do solve this issue . best regards , gal
2 Answers
Is your code running in browser? Currently for browser @azure/blob-storage only supports using SAS token
BlobServiceClient constructor does take a TokenCredential, which is an interface you could implement:
The SDK library will use the provided token as a Bearer token when sending requests to Azure Blob Service. I haven't tried this with RBAC though.
Hope in the future the SDK will have better integration with AAD/RBAC for browsers.
1 Comment
גל אורן
As far as I know you can be authenticated in blob in front of the ad. I found this example that does this in .dnot: learn.microsoft.com/en-us/azure/storage/common/… and another example that does this in react,dev.to/425show/… but I did not find an explanation how to do it in angular. i quite lost and I would love to get any help on how to do this.
You need to get the token for blob storage using :-
this.authService
.acquireTokenSilent({
scopes: ['https://storage.azure.com/user_impersonation'],
})
.then((tokenResponse) => {tokenResponse.accessToken})
Then wrap the token something like this :-
TestTokenCredential(tokenResponse.accessToken) {
return {
getToken: function (_scope, _opts) {
return {
token: tokenResponse.accessToken,
expiresOnTimestamp: Date.now() + 60 * 60 * 1000,
};
},
};
}
And ultimately use the token return by the above function to get the blob container client like :-
private containerClient(token: any): ContainerClient {
return new BlobServiceClient(
`https://${this.picturesAccount}.blob.core.windows.net`,
token
).getContainerClient(this.picturesContainer);
}
