Blob storage authentication example

[mikahe]

I understand that these libraries are still in beta and storage isn't even mentioned in the documentation. However the only sample is for storage blob.

The sample and authentication seems complicated at least with the provided documentation. When comparing to the below working Python example, I'm asking if and how the same can be achieved with the azure-sdk-for-android. Note e.g. that python doesn't need any web application registration:

class AuthSample(object):

    def auth_azure_credential(self):
        from azure.identity import InteractiveBrowserCredential
        interactive_credential = InteractiveBrowserCredential()

        from azure.storage.blob import ContainerClient
        container_client = ContainerClient(
            account_url="https://{storage-account-name}.blob.core.windows.net", 
            container_name="{container-name}",
            credential=interactive_credential
        )
        all_blobs = container_client.list_blobs()
        for blob in all_blobs:
            print(blob['name'])

if __name__ == '__main__':
    sample = AuthSample()
    sample.auth_azure_credential()

[bsiegel]

The storage library is still in early preview and we're currently focusing on the Azure Communication Services libraries as our first set to be released, so Storage is currently in a bit of a holding pattern. That said, each service has different needs when it comes to auth, and the Android SDK is targeted to client scenarios where it's not possible to safely include a credential such as a connection string or shared key.

Beyond that, for storage there are a few options. The first option is to create your own token provider, as we've suggested in the sample. This covers what we believe is the most common scenario for storage - a user's device needs to access a blob or container owned by the app developer, and the app's backend systems have permissions to generate access tokens for those storage resources. The developer can then create scoped, time-limited per-user tokens and provide them to the device via their existing API, where they can then be used to authenticate calls to Azure Storage.

A second option is closer to what you've described above, which is to use the MSAL for Android library to perform an interactive login in order to authenticate calls to Azure Storage. This works if your use case has the user authenticating with their Azure AD or Microsoft Account, and that account already has the necessary privileges to interact with the storage blob or container in question. We don't have an example for that today, but it will definitely be a supported scenario. We do have the basic strokes already in place in our iOS SDK (see here for the implementation and here for a sample that uses the credential).

[vcolin7]

Just to add a small clarification to what @bsiegel said, we do have a small sample app that uses MSAL for authentication which you can use as a starting point. Just keep in mind it is not production ready and exists merely as a tool for testing some of the Storage SDK APIs for the time being. I recently opened a PR to add a README with instructions on how to use it, so if that has not yet been merged by the time you read this, you can at least refer to the pull request to figure out the steps :)