Configurar conexões sem senha entre vários aplicativos e serviços do Azure

No seu projeto, instale o Azure.Identity pacote. Esta biblioteca fornece DefaultAzureCredential. Também pode adicionar quaisquer outras bibliotecas do Azure que sejam relevantes para a sua aplicação. Neste exemplo, os Azure.Storage.Blobs pacotes e Azure.Messaging.ServiceBus são adicionados para se conectar ao Armazenamento de Blob e ao Service Bus, respectivamente.

dotnet add package Azure.Identity
dotnet add package Azure.Messaging.ServiceBus
dotnet add package Azure.Storage.Blobs

Instancie clientes de serviço para os serviços do Azure aos quais seu aplicativo deve se conectar. O exemplo de código a seguir interage com o Armazenamento de Blob e o Service Bus usando os clientes de serviço correspondentes.

using Azure.Identity;
using Azure.Messaging.ServiceBus;
using Azure.Storage.Blobs;

// Create DefaultAzureCredential instance that uses system-assigned managed identity
// in the underlying ManagedIdentityCredential.
DefaultAzureCredential credential = new();

BlobServiceClient blobServiceClient = new(
    new Uri("https://<your-storage-account>.blob.core.windows.net"),
    credential);

ServiceBusClient serviceBusClient = new("<your-namespace>", credential);
ServiceBusSender sender = serviceBusClient.CreateSender("producttracking");

No seu projeto, adicione a azure-identity dependência ao seu arquivo pom.xml . Esta biblioteca fornece DefaultAzureCredential. Você também pode adicionar quaisquer outras dependências do Azure que sejam relevantes para seu aplicativo. Para este exemplo, as dependências azure-storage-blob e azure-messaging-servicebus são adicionadas para interagir com o Armazenamento de Blob e o Service Bus.

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.azure</groupId>
      <artifactId>azure-sdk-bom</artifactId>
      <version>1.2.5</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>
<dependencies>
  <dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
  </dependency>
  <dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-storage-blob</artifactId>
  </dependency>
  <dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-messaging-servicebus</artifactId>
  </dependency>
</dependencies>

Instancie clientes de serviço para os serviços do Azure aos quais seu aplicativo deve se conectar. O exemplo de código a seguir interage com o Armazenamento de Blob e o Service Bus usando os clientes de serviço correspondentes.

class Demo {
    public static void main(String[] args) {
        // Create DefaultAzureCredential instance that uses system-assigned managed identity
        // in the underlying ManagedIdentityCredential.
        DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
            .build();

        BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
            .endpoint("https://<your-storage-account>.blob.core.windows.net")
            .credential(credential)
            .buildClient();

        ServiceBusClientBuilder clientBuilder = new ServiceBusClientBuilder()
            .credential(credential);
        ServiceBusSenderClient serviceBusSenderClient = clientBuilder.sender()
            .queueName("producttracking")
            .buildClient();
    }
}

Em seu projeto, você só precisa adicionar dependências de serviço que você usa. Neste exemplo, as dependências spring-cloud-azure-starter-storage-blob e spring-cloud-azure-starter-servicebus são adicionadas para estabelecer ligação ao Armazenamento de Blob e ao Service Bus.

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.azure.spring</groupId>
      <artifactId>spring-cloud-azure-dependencies</artifactId>
      <version>4.5.0</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>
<dependencies>
  <dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-starter-storage-blob</artifactId>
  </dependency>
  <dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-starter-servicebus</artifactId>
  </dependency>
</dependencies>

Instancie clientes de serviço para os serviços do Azure aos quais seu aplicativo deve se conectar. Os exemplos a seguir se conectam ao Armazenamento de Blob e ao Service Bus usando os clientes de serviço correspondentes.

spring:
  cloud:
    azure:
      servicebus:
        namespace: <service-bus-name>
        entity-name: <service-bus-entity-name>
        entity-type: <service-bus-entity-type>
      storage:
        blob:
          account-name: <storage-account-name>

@Service
public class ExampleService {
    @Autowired
    private BlobServiceClient blobServiceClient;

    @Autowired
    private ServiceBusSenderClient serviceBusSenderClient;
}

No seu projeto, instale o @azure/identity pacote. Esta biblioteca fornece DefaultAzureCredential. Neste exemplo, os pacotes @azure/storage-blob e @azure/service-bus são instalados para interagir com o Armazenamento de Blob e o Barramento de Serviço.

npm install --save @azure/identity @azure/storage-blob @azure/service-bus

Instancie clientes de serviço para os serviços do Azure aos quais seu aplicativo deve se conectar. O exemplo de código a seguir interage com o Armazenamento de Blob e o Service Bus usando os clientes de serviço correspondentes.

import { DefaultAzureCredential } from "@azure/identity";
import { BlobServiceClient } from "@azure/storage-blob";
import { ServiceBusClient } from "@azure/service-bus";

// Azure resource names
const storageAccount = process.env.AZURE_STORAGE_ACCOUNT_NAME;
const serviceBusNamespace = process.env.AZURE_SERVICE_BUS_NAMESPACE;

// Create DefaultAzureCredential instance that uses system-assigned managed identity
// in the underlying ManagedIdentityCredential.
const credential = new DefaultAzureCredential();

// Create client for Blob Storage
const blobServiceClient = new BlobServiceClient(
  `https://${storageAccount}.blob.core.windows.net`,
  credential
);

// Create client for Service Bus
const serviceBusClient = new ServiceBusClient(
  `https://${serviceBusNamespace}.servicebus.windows.net`,
  credential
);

No seu projeto, adicione uma referência ao azure-identity pacote. Esta biblioteca fornece DefaultAzureCredential. Também pode adicionar quaisquer outras bibliotecas do Azure que sejam relevantes para a sua aplicação. Neste exemplo, os azure-storage-blob pacotes e azure-service-bus são adicionados para se conectar ao Armazenamento de Blob e ao Service Bus, respectivamente.

pip install azure-identity azure-servicebus azure-storage-blob

Instancie clientes de serviço para os serviços do Azure aos quais seu aplicativo deve se conectar. O exemplo de código a seguir interage com o Armazenamento de Blob e o Service Bus usando os clientes de serviço correspondentes.

from azure.identity import DefaultAzureCredential
from azure.servicebus import ServiceBusClient, ServiceBusMessage
from azure.storage.blob import BlobServiceClient
import os

# Create DefaultAzureCredential instance that uses system-assigned managed identity
# in the underlying ManagedIdentityCredential.
credential = DefaultAzureCredential()

blob_service_client = BlobServiceClient(
    account_url="https://<my-storage-account-name>.blob.core.windows.net/",
    credential=credential
)

fully_qualified_namespace = os.environ['SERVICEBUS_FULLY_QUALIFIED_NAMESPACE']
queue_name = os.environ['SERVICE_BUS_QUEUE_NAME']

with ServiceBusClient(fully_qualified_namespace, credential) as service_bus_client:
    with service_bus_client.get_queue_sender(queue_name) as sender:
        # Sending a single message
        single_message = ServiceBusMessage("Single message")
        sender.send_messages(single_message)

No seu projeto, instale os pacotes necessários. A biblioteca de Identidade do Azure fornece DefaultAzureCredential.

dotnet add package Azure.Identity
dotnet add package Azure.Storage.Blobs
dotnet add package Microsoft.Azure.Cosmos
dotnet add package Microsoft.Data.SqlClient

Adicione o seguinte ao seu código:

using Azure.Core;
using Azure.Identity;
using Azure.Storage.Blobs;
using Microsoft.Azure.Cosmos;
using Microsoft.Data.SqlClient;

string clientIdStorage =
    Environment.GetEnvironmentVariable("Managed_Identity_Client_ID_Storage")!;

// Create a DefaultAzureCredential instance that configures the underlying
// ManagedIdentityCredential to use a user-assigned managed identity.
DefaultAzureCredential credentialStorage = new(
    new DefaultAzureCredentialOptions
    {
        ManagedIdentityClientId = clientIdStorage,
    });

// First Blob Storage client
BlobServiceClient blobServiceClient1 = new(
    new Uri("https://<receipt-storage-account>.blob.core.windows.net"),
    credentialStorage);

// Second Blob Storage client
BlobServiceClient blobServiceClient2 = new(
    new Uri("https://<contract-storage-account>.blob.core.windows.net"),
    credentialStorage);

string clientIdDatabases =
    Environment.GetEnvironmentVariable("Managed_Identity_Client_ID_Databases")!;

// Create a DefaultAzureCredential instance that configures the underlying
// ManagedIdentityCredential to use a user-assigned managed identity.
DefaultAzureCredential credentialDatabases = new(
    new DefaultAzureCredentialOptions
    {
        ManagedIdentityClientId = clientIdDatabases,
    });

// Create an Azure Cosmos DB client
CosmosClient cosmosClient = new(
    Environment.GetEnvironmentVariable("COSMOS_ENDPOINT", EnvironmentVariableTarget.Process),
    credentialDatabases);

// Open a connection to Azure SQL
string connectionString =
    $"Server=<azure-sql-hostname>.database.windows.net;User Id={clientIdDatabases};Authentication=Active Directory Default;Database=<database-name>";

using (SqlConnection connection = new(connectionString)
{
    AccessTokenCallback = async (authParams, cancellationToken) =>
    {
        const string defaultScopeSuffix = "/.default";
        string scope = authParams.Resource.EndsWith(defaultScopeSuffix)
            ? authParams.Resource
            : $"{authParams.Resource}{defaultScopeSuffix}";
        AccessToken token = await credentialDatabases.GetTokenAsync(
            new TokenRequestContext([scope]),
            cancellationToken);

        return new SqlAuthenticationToken(token.Token, token.ExpiresOn);
    }
})
{
    connection.Open();
}

Adicione o seguinte ao seu ficheiro pom.xml :

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.azure</groupId>
      <artifactId>azure-sdk-bom</artifactId>
      <version>1.2.5</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>
<dependencies>
  <dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-identity</artifactId>
  </dependency>
  <dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-storage-blob</artifactId>
  </dependency>
  <dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-cosmos</artifactId>
  </dependency>
  <dependency>
    <groupId>com.microsoft.sqlserver</groupId>
    <artifactId>mssql-jdbc</artifactId>
    <version>11.2.1.jre17</version>
  </dependency>
</dependencies>

Adicione o seguinte ao seu código:

class Demo {
    public static void main(String[] args) {
        String clientIdStorage = System.getenv("Managed_Identity_Client_ID_Storage");

        // Create a DefaultAzureCredential instance that configures the underlying
        // ManagedIdentityCredential to use a user-assigned managed identity.
        DefaultAzureCredential credentialStorage = new DefaultAzureCredentialBuilder()
            .managedIdentityClientId(clientIdStorage)
            .build();

        // First Blob Storage client
        BlobServiceClient blobServiceClient1 = new BlobServiceClientBuilder()
            .endpoint("https://<receipt-storage-account>.blob.core.windows.net")
            .credential(credentialStorage)
            .buildClient();

        // Second Blob Storage client
        BlobServiceClient blobServiceClient2 = new BlobServiceClientBuilder()
            .endpoint("https://<contract-storage-account>.blob.core.windows.net")
            .credential(credentialStorage)
            .buildClient();

        String clientIdDatabases = System.getenv("Managed_Identity_Client_ID_Databases");

        // Create a DefaultAzureCredential instance that configures the underlying
        // ManagedIdentityCredential to use a user-assigned managed identity.
        DefaultAzureCredential credentialDatabases = new DefaultAzureCredentialBuilder()
            .managedIdentityClientId(clientIdDatabases)
            .build()

        // Create an Azure Cosmos DB client
        CosmosClient cosmosClient = new CosmosClientBuilder()
            .endpoint("https://<cosmos-db-account>.documents.azure.com:443/")
            .credential(credentialDatabases)
            .buildClient();

        // Open a connection to Azure SQL using a managed identity.
        // The DefaultAzureCredential instance stored in the credentialDatabases variable can't be 
        // used here, so sharing isn't possible between Cosmos DB and Azure SQL.
        String connectionUrl = "jdbc:sqlserver://<azure-sql-hostname>.database.windows.net:1433;"
            + "database=<database-name>;encrypt=true;trustServerCertificate=false;hostNameInCertificate=*.database"
            + ".windows.net;loginTimeout=30;Authentication=ActiveDirectoryMSI;";
        try {
            Connection connection = DriverManager.getConnection(connectionUrl);
            Statement statement = connection.createStatement();
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}

Adicione o seguinte ao seu ficheiro pom.xml :

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.azure.spring</groupId>
      <artifactId>spring-cloud-azure-dependencies</artifactId>
      <version>4.5.0</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>
<dependencies>
  <dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-starter-storage-blob</artifactId>
  </dependency>
  <dependency>
    <groupId>com.azure.spring</groupId>
    <artifactId>spring-cloud-azure-starter-cosmos</artifactId>
  </dependency>
  <dependency>
    <groupId>com.microsoft.sqlserver</groupId>
    <artifactId>mssql-jdbc</artifactId>
  </dependency>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
  </dependency>
</dependencies>

Adicione o seguinte ao seu ficheiro application.yml :

spring:
  cloud:
    azure:
      cosmos:
        endpoint: https://<cosmos-db-account>.documents.azure.com:443/
        credential:
          client-id: <Managed_Identity_Client_ID_Databases>
          managed-identity-enabled: true
      storage:
        blob:
          endpoint: https://<contract-storage-account>.blob.core.windows.net
          credential:
            client-id: <Managed_Identity_Client_ID_Storage>
            managed-identity-enabled: true
  datasource:
    url: jdbc:sqlserver://<azure-sql-hostname>.database.windows.net:1433;database=<database-name>;encrypt=true;trustServerCertificate=false;hostNameInCertificate=*.database.windows.net;loginTimeout=30;Authentication=ActiveDirectoryMSI;

Adicione o seguinte ao seu código:

@Configuration
public class AzureStorageConfiguration {
    @Bean("secondBlobServiceClient")
    public BlobServiceClient secondBlobServiceClient(BlobServiceClientBuilder builder) {
        return builder.endpoint("https://<receipt-storage-account>.blob.core.windows.net")
            .buildClient();
    }

    @Bean("firstBlobServiceClient")
    public BlobServiceClient firstBlobServiceClient(BlobServiceClientBuilder builder) {
        return builder.buildClient();
    }
}

@Service
public class ExampleService {
    @Autowired
    @Qualifier("firstBlobServiceClient")
    private BlobServiceClient blobServiceClient1;

    @Autowired
    @Qualifier("secondBlobServiceClient")
    private BlobServiceClient blobServiceClient2;

    @Autowired
    private CosmosClient cosmosClient;

    @Autowired
    private JdbcTemplate jdbcTemplate;
}

No seu projeto, instale os pacotes necessários. A biblioteca de Identidade do Azure fornece DefaultAzureCredential.

npm install --save @azure/identity @azure/storage-blob @azure/cosmos tedious

Adicione o seguinte ao seu código:

import { DefaultAzureCredential } from "@azure/identity";
import { BlobServiceClient } from "@azure/storage-blob";
import { CosmosClient } from "@azure/cosmos";
import { Connection } from "tedious";

// Create a DefaultAzureCredential instance that configures the underlying
// ManagedIdentityCredential to use a user-assigned managed identity.
const credentialStorage = new DefaultAzureCredential({
  managedIdentityClientId: process.env.MANAGED_IDENTITY_CLIENT_ID_STORAGE
});

// First Blob Storage client
const blobServiceClient1 = new BlobServiceClient(
  `https://${process.env.AZURE_STORAGE_ACCOUNT_NAME_1}.blob.core.windows.net`,
  credentialStorage
);

// Second Blob Storage client
const blobServiceClient2 = new BlobServiceClient(
  `https://${process.env.AZURE_STORAGE_ACCOUNT_NAME_2}.blob.core.windows.net`,
  credentialStorage
);

// Create a DefaultAzureCredential instance that configures the underlying
// ManagedIdentityCredential to use a user-assigned managed identity.
const credentialDatabases = new DefaultAzureCredential({
  managedIdentityClientId: process.env.MANAGED_IDENTITY_CLIENT_ID_DATABASES
});

// Create an Azure Cosmos DB client
const cosmosClient = new CosmosClient({
  endpoint: process.env.COSMOS_ENDPOINT,
  credential: credentialDatabases
});

// Configure connection and connect to Azure SQL
const config = {
  server: process.env.AZURE_SQL_SERVER,
  authentication: {
    type: 'azure-active-directory-access-token',
    options: {
      token: credentialDatabases.getToken("https://database.windows.net//.default").token
    }
  },
  options: {
    database: process.env.AZURE_SQL_DATABASE,
    encrypt: true
  }
};

const connection = new Connection(config);
connection.connect();

No seu projeto, instale os pacotes necessários. A biblioteca de Identidade do Azure fornece DefaultAzureCredential.

pip install azure-identity azure-storage-blob azure-cosmos pyodbc

Adicione o seguinte ao seu código:

from azure.cosmos import CosmosClient
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient
import os, pyodbc, struct

# Create a DefaultAzureCredential instance that configures the underlying
# ManagedIdentityCredential to use a user-assigned managed identity.
credential_storage = DefaultAzureCredential(
    managed_identity_client_id=os.environ['Managed_Identity_Client_ID_Storage']
)

# First Blob Storage client
blob_service_client_1 = BlobServiceClient(
    account_url="https://<receipt-storage-account>.blob.core.windows.net/",
    credential=credential_storage
)

# Second Blob Storage client
blob_service_client_2 = BlobServiceClient(
    account_url="https://<contract-storage-account>.blob.core.windows.net/",
    credential=credential_storage
)

# Create a DefaultAzureCredential instance that configures the underlying
# ManagedIdentityCredential to use a user-assigned managed identity.
credential_databases = DefaultAzureCredential(
    managed_identity_client_id=os.environ['Managed_Identity_Client_ID_Databases']
)

# Create an Azure Cosmos DB client
cosmos_client = CosmosClient(
    os.environ['COSMOS_ENDPOINT'],
    credential=credential_databases
)

# Connect to Azure SQL
token_bytes = credential_databases.get_token("https://database.windows.net/.default").token.encode("UTF-16-LE")
token_struct = struct.pack(f'<I{len(token_bytes)}s', len(token_bytes), token_bytes)
SQL_COPT_SS_ACCESS_TOKEN = 1256  # This connection option is defined by microsoft in msodbcsql.h
conn = pyodbc.connect(connection_string, attrs_before={SQL_COPT_SS_ACCESS_TOKEN: token_struct})