search

rsm-hcd / AndcultureCode.Cli

and-cli command-line tool to manage the development of software applications
https://andculture.com
Apache License 2.0
14 stars 15 forks source link

Update Azure restoration process to support multiple authentication methods #150

Open KevinBusch opened 3 years ago

KevinBusch commented 3 years ago

See src/and-cli-restore-azure-storage.ts. Currently, this aspect only supports authentication via a means of passing in an already generated SAS token. This is not ideal because this forces the SAS token to be generated up front for a very long period of time (lifetime of product). SAS tokens are required for interacting with blob storage using azcopy. Suggest adding in support to use az cli to generate SAS using https://docs.microsoft.com/en-us/cli/azure/storage/container?view=azure-cli-latest#az_storage_container_generate_sas by first authenticating using az in some other manner (service principle, username, etc...)

KevinBusch commented 3 years ago

Took a quick look at this and ran into issues when generating SAS tokens and attempting to use those SAS tokens when authenticating azcopy requests. For clarity, the current SAS tokens being used in the currently supported functionality is an account level SAS token that have an expiration date that can be set to any time in the future without limitation (100 years from now for instance). When generating them using Azure AD, it creates user SAS tokens that have a 7 day in the future expiration date limit.