Missing feature: Credential support for AzureBlobStorageImageProvider and AzureBlobStorageCache

[marklagendijk]

Currently both the AzureBlobStorageImageProvider and the AzureBlobStorageCache require a ConnectionString to function.
Authenticating with a ConnectionString is only one of the many possible ways to authenticate with Azure Blob Storage.

In our software we use the DefaultAzureCredential. This automatically recognizes which authentication method is supplied on the system and uses that.
On our production systems we use a Managed Identity with roles based authentication to get access to all the resources it needs.

I think the easiest way of allowing all authentication types would be to inject the BlobServiceClient so that the setup of the BlobServiceClient becomes the concern of the user.

In this example I added an option UseBlobServiceClientFromDi and inject the BlobServiceClient when that option is used:

    public AzureBlobStorageCache(IOptions<AzureBlobStorageCacheOptions> cacheOptions, IServiceProvider serviceProvider)
    {
        var options = cacheOptions.Value;
        
        var blobServiceClient = options.UseBlobServiceClientFromDi
            ? serviceProvider.GetRequiredService<BlobServiceClient>()
            : new BlobServiceClient(options.ConnectionString);

        container = blobServiceClient.GetBlobContainerClient(options.ContainerName);

        cacheFolder = string.IsNullOrEmpty(options.CacheFolder)
            ? string.Empty
            : options.CacheFolder.Trim().Trim('/') + '/';
    }

In our sofware we actually support both the ConnectionString and Account Name + DefaultAzureCredential approaches, so that we can easily use Azurite for local development, by using the UseDevelopmentStorage=true connection string:

using Azure.Core;
using Azure.Storage.Blobs;
using Azure.Storage.Queues;
using Microsoft.Extensions.Azure;
using Microsoft.Extensions.Configuration;

namespace PMP.Azure.Storage;

public static class AzureClientFactoryBuilderExtensions
{
    public static void AddStorageServiceClients(this AzureClientFactoryBuilder builder, IConfiguration configuration)
    {
        var storageConnectionString = configuration["StorageConnectionString"];
        var storageAccountName = configuration["StorageAccountName"];
        if (string.IsNullOrEmpty(storageConnectionString) && string.IsNullOrEmpty(storageAccountName))
            throw new InvalidOperationException(
                "Missing configuration. Either configure StorageConnectionString or StorageAccountName.\n" +
                "Set StorageConnectionString to `UseDevelopmentStorage=true` to connect to the Azurite Storage Emulator."
            );

        builder.AddBlobServiceClient(storageConnectionString, storageAccountName);
        builder.AddQueueServiceClient(storageConnectionString, storageAccountName);
    }

    private static void AddBlobServiceClient(
        this AzureClientFactoryBuilder builder, string? storageConnectionString, string? storageAccountName
    )
    {
        builder.AddClient((BlobClientOptions options, TokenCredential credential) =>
            !string.IsNullOrEmpty(storageAccountName)
                ? new BlobServiceClient(
                    new Uri($"https://{storageAccountName}.blob.core.windows.net"),
                    credential,
                    options
                )
                : new BlobServiceClient(
                    storageConnectionString,
                    options
                )
        );
    }

    private static void AddQueueServiceClient(
        this AzureClientFactoryBuilder builder, string? storageConnectionString, string? storageAccountName
    )
    {
        builder.AddClient((QueueClientOptions options, TokenCredential credential) =>
        {
            options.MessageEncoding = QueueMessageEncoding.Base64;
            return !string.IsNullOrEmpty(storageAccountName)
                ? new QueueServiceClient(
                    new Uri($"https://{storageAccountName}.queue.core.windows.net"),
                    credential,
                    options
                )
                : new QueueServiceClient(
                    storageConnectionString,
                    options
                );
        });
    }
}

[tocsoft]

A similar but different option/pattern I've seen used in various places would be to extend AzureBlobStorageCacheOptions with a nullable Func<AzureBlobStorageCacheOptions, IServiceProvider, BlobServiceClient> that way users get ultimate flexibility and can go from anything from a hard coded global static client to pulling from DI or any other combination including deriving from there own configs

public partial class AzureBlobStorageCacheOptions{
+    public Func<AzureBlobStorageCacheOptions, IServiceProvider, BlobServiceClient>? ClientProvider { get; set; } = null;
}

public partial class AzureBlobStorageCache {
    public AzureBlobStorageCache(IOptions<AzureBlobStorageCacheOptions> cacheOptions, IServiceProvider serviceProvider)
    {
        var options = cacheOptions.Value;
        if (options .ClientProvider == null) 
        {
            this.container = new BlobContainerClient(options.ConnectionString, options.ContainerName);
        }
        else 
        {
            this.container = options .ClientProvider(options, serviceProvider);
        }

        this.cacheFolder = string.IsNullOrEmpty(options.CacheFolder)
            ? string.Empty
            : options.CacheFolder.Trim().Trim('/') + '/';
    }
}

This makes it possible to use separate BlobServiceClients for image caching to other places in a users application too without lots of extra overhead.

It would also make sense to add the same pattern in for the AWs provider too

[JimBobSquarePants]

Yeah that sound sensible 👍

[marklagendijk]

@tocsoft yes, that is even better!
While I was away I came up with the same possible solution, and I was planning on posting it now, but you beat me to it :).

[marklagendijk]

I created a pull request with this implemented as discussed here: #361.
Only deviation is that I use BlobContainerClient as the return type of the Provider, because that is actually the thing we need here.

[marklagendijk]

Also created a pull request for AWS: #362.
Only thing currently missing is tests for these new options.