STG100 - Queue User Delegation SAS

[ibrandes]

🔐 New Feature: User Delegation SAS Support for Azure Queue Storage

This PR adds comprehensive support for generating User Delegation Shared Access Signatures (SAS) for Azure Queue Storage. These enhancements allow SAS tokens to be scoped to specific Entra ID users, improving security and access control.

---

📦 Key Additions

1. New Models Introduced

   • UserDelegationKey: Represents a user-scoped key with metadata like object ID, tenant ID, start/expiry times, service, version, and base64 value.
   • KeyInfo: Encapsulates start and expiry timestamps for delegation keys.
   • ServicesGetUserDelegationKeyHeaders: Captures HTTP headers returned when fetching a user delegation key.

2. Updated SAS Signature Logic

   • QueueSasImplUtil now supports generating SAS tokens signed with a UserDelegationKey.
   • New method generateUserDelegationSas(...) added to both QueueAsyncClient and QueueClient.

3. Extended Signature Values

   • QueueServiceSasSignatureValues now includes a delegatedUserObjectId field to bind SAS usage to a specific Entra ID user.

4. Client Enhancements

   • QueueServiceClient and QueueServiceAsyncClient now support fetching user delegation keys via getUserDelegationKey(...).

---

🧪 Test Coverage

New tests validate:

• Successful SAS generation and usage with delegated user object ID.
• Failure scenarios when the SAS is used without proper Entra ID token.
• Integration of user delegation SAS with queue operations like sendMessage, getProperties, and receiveMessages.

[ibrandes]

/azp run java - pullrequest

[azure-pipelines]

Azure Pipelines could not run because the pipeline triggers exclude this branch/path.

[Copilot]

Pull Request Overview

This PR introduces User Delegation Shared Access Signatures (SAS) support for Azure Queue Storage, enabling SAS tokens to be scoped to specific Entra ID users for enhanced security and access control.

Key Changes:

• Adds user delegation key retrieval functionality to queue service clients
• Extends SAS signature generation to support user delegation keys
• Introduces new model classes for user delegation key management
• Updates API specifications to use the new 2026-02-06 service version

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
swagger/README.md	Updates API specification to 2026-02-06 version and adds new custom types
QueueTestBase.java	Adds test utilities and OAuth client helper methods for user delegation testing
QueueServiceAsyncApiTests.java	Adds tests for getUserDelegationKey functionality in async client
QueueServiceApiTests.java	Adds tests for getUserDelegationKey functionality in sync client
QueueSasClientTests.java	Adds comprehensive tests for user delegation SAS generation and usage
QueueSasAsyncClientTests.java	Adds async tests for user delegation SAS functionality
QueueAsyncApiTests.java	Minor method name correction for OAuth service client
QueueServiceSasSignatureValues.java	Adds delegatedUserObjectId field and related methods
UserDelegationKey.java	New generated model class for user delegation key representation
KeyInfo.java	New generated model class for key timing information
QueueSasImplUtil.java	Core implementation for user delegation SAS generation
ServicesGetUserDelegationKeyHeaders.java	New generated class for HTTP headers
ServicesImpl.java	Adds service implementation for getUserDelegationKey operations
QueueServiceClient.java	Adds getUserDelegationKey methods to sync service client
QueueServiceAsyncClient.java	Adds getUserDelegationKey methods to async service client
QueueClient.java	Adds generateUserDelegationSas methods to sync queue client
QueueAsyncClient.java	Adds generateUserDelegationSas methods to async queue client

[kyleknap]

Looks good. Just had a couple of comments.

[kyleknap]

Looks good! 🚢

[github-actions]

API Change Check

APIView identified API level changes in this PR and created the following API reviews

com.azure:azure-storage-queue

[ibrandes]

merging - failure is just from re-running and the artifacts already existing.