STG100 - Blob Principal Bound Identity SAS #46282
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
API Change CheckAPIView identified API level changes in this PR and created the following API reviews |
….com/Azure/azure-sdk-for-java into stg100/blobPrincipalBoundIdentitySas
ibrandes
requested review from
seanmcc-msft,
kyleknap,
alzimmermsft,
gunjansingh-msft and
browndav-msft
as code owners
ibrandes
commented
Aug 7, 2025
...e-storage-blob/src/main/java/com/azure/storage/blob/implementation/util/BlobSasImplUtil.java
Outdated
Show resolved
Hide resolved
ibrandes
changed the title
There was a problem hiding this comment.
Pull Request Overview
This PR implements Delegated User Object ID for SAS functionality, enabling SAS tokens to be bound to specific Entra ID users for enhanced security. The feature ensures that SAS tokens can only be used when accompanied by valid tokens issued to the specified user.
- Adds
delegatedUserObjectIdfield to core SAS classes and string-to-sign logic - Implements comprehensive tests covering both positive and negative scenarios
- Updates asset tags for the new test assets
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| StorageCommonTestUtils.java | Added helper method to extract OID from JWT tokens |
| CommonSasQueryParameters.java | Added field and getter for delegated user object ID |
| Constants.java | Added SAS parameter constant for delegated user object ID |
| SasClientTests.java | Added comprehensive tests for delegated object ID functionality |
| SasAsyncClientTests.java | Added async test variants for delegated object ID functionality |
| BlobTestBase.java | Improved retry logic for live tests |
| BlobServiceSasSignatureValues.java | Added delegated user object ID field and methods |
| BlobSasImplUtil.java | Integrated delegated user object ID into SAS generation and signing |
| assets.json | Updated asset tag for new test resources |
...common/src/test-shared/java/com/azure/storage/common/test/shared/StorageCommonTestUtils.java
Outdated
Show resolved
Hide resolved
...ge/azure-storage-common/src/main/java/com/azure/storage/common/implementation/Constants.java
Outdated
Show resolved
Hide resolved
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/BlobTestBase.java
Outdated
Show resolved
Hide resolved
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
kyleknap
reviewed
Aug 20, 2025
...e-storage-blob/src/main/java/com/azure/storage/blob/implementation/util/BlobSasImplUtil.java
Show resolved
Hide resolved
….com/Azure/azure-sdk-for-java into stg100/blobPrincipalBoundIdentitySas
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🔐 New Feature: Delegated User Object ID for SAS
This PR adds support for binding a SAS (Shared Access Signature) to a specific Entra ID user via a new field:
delegatedUserObjectId. This ensures that the SAS can only be used in conjunction with a token issued to the specified user.📦 Key Code Changes
New Field Added
delegatedUserObjectIdadded to:BlobServiceSasSignatureValuesBlobSasImplUtilCommonSasQueryParametersConstants.UrlConstantsasSAS_DELEGATED_USER_OBJECT_IDSAS String Construction
delegatedUserObjectIdis now included in the SAS string-to-sign logic and query parameters.Asset Tag Update
assets.json.🧪 Tests Added
New test cases validate the behavior of SAS with
delegatedUserObjectId:🛠️ Utilities
getOidFromTokeninStorageCommonTestUtilsto extract the object ID from a token.