You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -345,6 +345,42 @@ Public images from other registries are still pulled (if requested by a Task) wh
345
345
specified via the :ref:`container <process-container>` directive using the format: ``[server]/[your-organization]/[your-image]:[tag]``.
346
346
Read more about image fully qualified image names in the `Docker documentation <https://docs.docker.com/engine/reference/commandline/pull/#pull-from-a-different-registry>`_.
347
347
348
+
Active Directory Authentication
349
+
===============================
350
+
351
+
As of version ``22.11.0-edge``, `Service Principal <https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal>`_ credentials can optionally be used instead of Shared Keys for Azure Batch and Storage accounts.
352
+
353
+
The Service Principal should have the at least the following role assignments :
354
+
355
+
1. Contributor
356
+
357
+
2. Storage Blob Data Reader
358
+
359
+
3. Storage Blob Data Contributor
360
+
361
+
.. note::
362
+
To assign the necessary roles to the Service Principal refer to the `official Azure documentation <https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal?tabs=current>`_.
363
+
364
+
The credentials for Service Principal can be specified as follows::
365
+
366
+
azure {
367
+
activeDirectory {
368
+
servicePrincipalId = '<YOUR SERVICE PRINCIPAL CLIENT ID>'
369
+
servicePrincipalSecret = '<YOUR SERVICE PRINCIPAL CLIENT SECRET>'
370
+
tenantId = '<YOUR TENANT ID>'
371
+
}
372
+
373
+
storage {
374
+
accountName = '<YOUR STORAGE ACCOUNT NAME>'
375
+
}
376
+
377
+
batch {
378
+
accountName = '<YOUR BATCH ACCOUNT NAME>'
379
+
location = '<YOUR BATCH ACCOUNT LOCATION>'
380
+
}
381
+
}
382
+
383
+
348
384
Advanced settings
349
385
==================
350
386
@@ -353,10 +389,13 @@ The following configuration options are available:
azure.activeDirectory.servicePrincipalId The service principal client ID
393
+
azure.activeDirectory.servicePrincipalSecret The service principal client secret
394
+
azure.activeDirectory.tenantId The Azure tenant ID
356
395
azure.storage.accountName The blob storage account name
357
396
azure.storage.accountKey The blob storage account key
358
397
azure.storage.sasToken The blob storage shared access signature token. This can be provided as an alternative to the ``accountKey`` setting.
359
-
azure.storage.tokenDuration The duration of the shared access signature token created by Nextflow when the ``sasToken`` option is *not* specified (default: ``12h``).
398
+
azure.storage.tokenDuration The duration of the shared access signature token created by Nextflow when the ``sasToken`` option is *not* specified (default: ``48h``).
360
399
azure.batch.accountName The batch service account name.
361
400
azure.batch.accountKey The batch service account key.
362
401
azure.batch.endpoint The batch service endpoint e.g. ``https://nfbatch1.westeurope.batch.azure.com``.
0 commit comments