Skip to content

Commit 47275d6

Browse files
v-regandownerv-regandowner
authored
Merge pull request #233553 from scottaddie/scottaddie/blob-storage-migration
Add Java, Node.js, and Python guidance to Blob Storage migration guide
2 parents 6779456 + bd0499d commit 47275d6

File tree

1 file changed

+128
-26
lines changed

1 file changed

+128
-26
lines changed

‎articles/storage/common/migrate-azure-credentials.md

Lines changed: 128 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,16 @@ description: Learn to migrate existing applications away from Shared Key authori
55
author: alexwolfmsft
66
ms.author: alexwolf
77
ms.reviewer: randolphwest
8-
ms.date: 12/07/2022
8+
ms.date: 04/05/2023
99
ms.service: storage
1010
ms.subservice: common
1111
ms.topic: how-to
1212
ms.custom: devx-track-csharp, passwordless-java, passwordless-js, passwordless-python, passwordless-dotnet, devx-track-azurecli, devx-track-azurepowershell
13-
ms.devlang: csharp
1413
---
1514

1615
# Migrate an application to use passwordless connections with Azure Storage
1716

18-
Application requests to Azure Storage must be authenticated using either account access keys or passwordless connections. However, you should prioritize passwordless connections in your applications when possible. Traditional authentication methods that use passwords or secret keys create additional security risks and complications. Visit the [passwordless connections for Azure services](/azure/developer/intro/passwordless-overview) hub to learn more about the advantages of moving to passwordless connections.
17+
Application requests to Azure Storage must be authenticated using either account access keys or passwordless connections. However, you should prioritize passwordless connections in your applications when possible. Traditional authentication methods that use passwords or secret keys create security risks and complications. Visit the [passwordless connections for Azure services](/azure/developer/intro/passwordless-overview) hub to learn more about the advantages of moving to passwordless connections.
1918

2019
The following tutorial explains how to migrate an existing application to connect to Azure Storage to use passwordless connections instead of a key-based solution. These same migration steps should apply whether you're using access keys directly, or through connection strings.
2120

@@ -29,37 +28,115 @@ For local development, make sure you're authenticated with the same Azure AD acc
2928

3029
[!INCLUDE [default-azure-credential-sign-in](../../../includes/passwordless/default-azure-credential-sign-in.md)]
3130

32-
Next you need to update your code to use passwordless connections.
31+
Next, update your code to use passwordless connections.
3332

3433
## [.NET](#tab/dotnet)
3534

36-
1. To use `DefaultAzureCredential` in a .NET application, add the **Azure.Identity** NuGet package to your application.
35+
1. To use `DefaultAzureCredential` in a .NET application, install the `Azure.Identity` package:
3736

3837
```dotnetcli
3938
dotnet add package Azure.Identity
4039
```
4140

42-
1. At the top of your `Program.cs` file, add the following `using` statement:
41+
1. At the top of your file, add the following code:
4342

4443
```csharp
4544
using Azure.Identity;
4645
```
4746

48-
1. Identify the locations in your code that currently create a `BlobServiceClient` to connect to Azure Storage. This task is often handled in `Program.cs`, potentially as part of your service registration with the .NET dependency injection container. Update your code to match the following example:
47+
1. Identify the locations in your code that create a `BlobServiceClient` to connect to Azure Storage. Update your code to match the following example:
4948

5049
```csharp
51-
// TODO: Update <storage-account-name> placeholder to your account name
50+
var credential = new DefaultAzureCredential();
51+
52+
// TODO: Update the <storage-account-name> placeholder.
5253
var blobServiceClient = new BlobServiceClient(
5354
new Uri("https://<storage-account-name>.blob.core.windows.net"),
54-
new DefaultAzureCredential());
55+
credential);
5556
```
5657

57-
1. Make sure to update the storage account name in the URI of your `BlobServiceClient`. You can find the storage account name on the overview page of the Azure portal.
58+
## [Java](#tab/java)
5859

59-
:::image type="content" source="../blobs/media/storage-quickstart-blobs-dotnet/storage-account-name.png" alt-text="Screenshot showing how to find the storage account name.":::
60+
1. To use `DefaultAzureCredential` in a Java application, install the `azure-identity` package via one of the following approaches:
61+
1. [Include the BOM file](/java/api/overview/azure/identity-readme?view=azure-java-stable&preserve-view=true#include-the-bom-file).
62+
1. [Include a direct dependency](/java/api/overview/azure/identity-readme?view=azure-java-stable&preserve-view=true#include-direct-dependency).
63+
64+
1. At the top of your file, add the following code:
65+
66+
```java
67+
import com.azure.identity.DefaultAzureCredentialBuilder;
68+
```
69+
70+
1. Identify the locations in your code that create a `BlobServiceClient` object to connect to Azure Storage. Update your code to match the following example:
71+
72+
```java
73+
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
74+
.build();
75+
76+
// TODO: Update the <storage-account-name> placeholder.
77+
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
78+
.endpoint("https://<storage-account-name>.blob.core.windows.net")
79+
.credential(credential)
80+
.buildClient();
81+
```
82+
83+
## [Node.js](#tab/nodejs)
84+
85+
1. To use `DefaultAzureCredential` in a Node.js application, install the `@azure/identity` package:
86+
87+
```bash
88+
npm install --save @azure/identity
89+
```
90+
91+
1. At the top of your file, add the following code:
92+
93+
```nodejs
94+
const { DefaultAzureCredential } = require("@azure/identity");
95+
```
96+
97+
1. Identify the locations in your code that create a `BlobServiceClient` object to connect to Azure Storage. Update your code to match the following example:
98+
99+
```nodejs
100+
const credential = new DefaultAzureCredential();
101+
102+
// TODO: Update the <storage-account-name> placeholder.
103+
const blobServiceClient = new BlobServiceClient(
104+
"https://<storage-account-name>.blob.core.windows.net",
105+
credential
106+
);
107+
```
108+
109+
## [Python](#tab/python)
60110

111+
1. To use `DefaultAzureCredential` in a Python application, install the `azure-identity` package:
112+
113+
```bash
114+
pip install azure-identity
115+
```
116+
117+
1. At the top of your file, add the following code:
118+
119+
```python
120+
from azure.identity import DefaultAzureCredential
121+
```
122+
123+
1. Identify the locations in your code that create a `BlobServiceClient` to connect to Azure Storage. Update your code to match the following example:
124+
125+
```python
126+
credential = DefaultAzureCredential()
127+
128+
# TODO: Update the <storage-account-name> placeholder.
129+
blob_service_client = BlobServiceClient(
130+
account_url = "https://<storage-account-name>.blob.core.windows.net",
131+
credential = credential
132+
)
133+
```
61134
---
62135

136+
4. Make sure to update the storage account name in the URI of your `BlobServiceClient`. You can find the storage account name on the overview page of the Azure portal.
137+
138+
:::image type="content" source="../blobs/media/storage-quickstart-blobs-dotnet/storage-account-name.png" alt-text="Screenshot showing how to find the storage account name.":::
139+
63140
### Run the app locally
64141

65142
After making these code changes, run your application locally. The new configuration should pick up your local credentials, such as the Azure CLI, Visual Studio, or IntelliJ. The roles you assigned to your local dev user in Azure allows your app to connect to the Azure service locally.
@@ -83,7 +160,7 @@ Complete the following steps in the Azure portal to associate an identity with y
83160
* Azure Spring Apps
84161
* Azure Container Apps
85162
* Azure virtual machines
86-
* Azure Kubernetes Service.
163+
* Azure Kubernetes Service
87164

88165
1. Navigate to the overview page of your web app.
89166
1. Select **Identity** from the left navigation.
@@ -155,27 +232,52 @@ If you connected your services using Service Connector you don't need to complet
155232

156233
### Update the application code
157234

158-
You need to configure your application code to look for the specific managed identity you created when it is deployed to Azure. In some scenarios, explicitly setting the managed identity for the app also prevents other environment identities from accidentally being detected and used automatically.
159-
160-
## [.NET](#tab/dotnet)
235+
You need to configure your application code to look for the specific managed identity you created when it's deployed to Azure. In some scenarios, explicitly setting the managed identity for the app also prevents other environment identities from accidentally being detected and used automatically.
161236
162237
1. On the managed identity overview page, copy the client ID value to your clipboard.
163-
1. Update the `DefaultAzureCredential` object in the `Program.cs` file of your app to specify this managed identity client ID.
238+
1. Update the `DefaultAzureCredential` object to specify this managed identity client ID:
164239
240+
## [.NET](#tab/dotnet)
241+
165242
```csharp
166-
// TODO: Update the <your-storage-account-name> and <your-managed-identity-client-id> placeholders
167-
var blobServiceClient = new BlobServiceClient(
168-
new Uri("https://<your-storage-account-name>.blob.core.windows.net"),
169-
new DefaultAzureCredential(
170-
new DefaultAzureCredentialOptions()
171-
{
172-
ManagedIdentityClientId = "<your-managed-identity-client-id>"
173-
}));
243+
// TODO: Update the <managed-identity-client-id> placeholder.
244+
var credential = new DefaultAzureCredential(
245+
new DefaultAzureCredentialOptions
246+
{
247+
ManagedIdentityClientId = "<managed-identity-client-id>"
248+
});
174249
```
175250
176-
3. Redeploy your code to Azure after making this change in order for the configuration updates to be applied.
251+
## [Java](#tab/java)
252+
253+
```java
254+
// TODO: Update the <managed-identity-client-id> placeholder.
255+
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
256+
.managedIdentityClientId("<managed-identity-client-id>")
257+
.build();
258+
```
259+
260+
## [Node.js](#tab/nodejs)
261+
262+
```nodejs
263+
// TODO: Update the <managed-identity-client-id> placeholder.
264+
const credential = new DefaultAzureCredential({
265+
managedIdentityClientId: "<managed-identity-client-id>"
266+
});
267+
```
268+
269+
## [Python](#tab/python)
270+
271+
```python
272+
# TODO: Update the <managed-identity-client-id> placeholder.
273+
credential = DefaultAzureCredential(
274+
managed_identity_client_id = "<managed-identity-client-id>"
275+
)
276+
```
177277
178-
---
278+
---
279+
280+
3. Redeploy your code to Azure after making this change in order for the configuration updates to be applied.
179281
180282
### Test the app
181283

0 commit comments

Comments
 (0)