Authentication and authorization way for Azure Blobs

Question

In my azure blob storage, I have a container where I have multiple folders with folder name as project name and each folder has a metadata.json file along with subfolders in first level.

Blob Container --> Folder A, FolderB
Folder A --> metadata.json, subfolder(s)
Folder B --> metadata.json, subfolders(s)..

Now, I have a Powershell commandlet which I have created to get the blob metadata file of a project. So if It is like Get-Documents -Project "FolderA" and I get all the information from metadata.json in Folder A. To get this I am having my Blob storage account, SAS token and container stored in a config file in the solution.

Going forward, I would like to make it more secure and would like my customers, if they call Get-Documents command, user should be prompted with login prompt and once their authentication is verified ie they are in organization active directory and have permission to Blob folder, they should be able to get metadata information.

How do I start with this? if anyone can guide to me proper documentation or share similar solution if implemented.

Answer 1

You could access Azure blob storage with Azure AD , and get Blob with Rest API .

Code sample with Powershell:

# login
Connect-AzAccount

# get accessToken
$resource = "https://storage.azure.com/"
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$accessToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, $resource).AccessToken

#request REST API
$uri = "https://<myaccount>.blob.core.windows.net/<mycontainer>/<myblob>"

$xmsdate = get-date
$xmsdate = $xmsdate.ToUniversalTime()
$xmsdate = $xmsdate.toString('r')

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("x-ms-version", "2019-12-12")
$headers.Add("x-ms-date", $xmsdate)
$headers.Add("Authorization", "Bearer " + $accessToken)

Invoke-RestMethod -Method 'Get' -Uri $uri -Headers $headers

For more details, see here . It will help you understand.