如何在 Azure Blob 存储上的静态网站中启用 Azure AD（天蓝色活动目录）身份验证

Question

我通过 azure 存储帐户的 BLOB 存储中的 $web 容器托管一个静态网站，我需要使用 AD（Azure 活动目录）身份验证放置静态站点，但我不知道如何完成这些步骤来放置身份验证

Answer 1

The short answer is that there isn't a toggle you can switch to get this behaviour. But keep reading because there is a way to achieve an equivalent behaviour.

It sounds like you are after something similar to what App Service (including Functions Apps) offer and is often referred to as EasyAuth: https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad .

AFAIK, an equivalent functionality doesn't exist for Blob storage. It is a passive service and will not do any authentication for you. It doesn't have implicit flow enabled. That means it will accept the OAuth tokens you provide, but it will not allow users to authenticate directly against it.

Assuming this is a Single Page Application, and that you don't want to protect the static files (.html, .js, .css, etc.) but only some data that exists either as blobs or sit behind APIs hosted somewhere else, protected by AAD, one way to achieve this is to create two containers:

1. The $web container that gets created when "Static website" is enabled
2. A "data" container, with "Access Level=Private (no anonymous access)"

Once those containers are in place, proceed to assign any permissions to the "data" container, or even to each individual blob in that container, using RBAC .

The final step is to use MSAL.js in your Single Page Application hosted in the $web container to obtain the tokens necessary to access your blobs. Explaining how to do that would make this answer too long, but it's well covered in the MSAL.js documentation.

Answer 2

可直接从MSFT文档站点获得很多内容，这些内容可以在App服务计划-身份验证中找到