Externally managed Restricted Access to Blob Storage

Question

Hello everyone,

Is there any way to manage restricted access to blob storage from an external server, without having to set up AAD?
For our use case: We have an existing web app with Keycloak as auth service (using JWT), but a more fine grained access control logic inside our own node server. We want to host a bunch of media files on Azure blob storage. Those access must be restricted based on the logic inside our own server.

Is it possible, so that media links also cannot be shared to other users? e.g. a logged in user gets the access for media file X, and only that user can access that resource inside our app. Maybe with a temporary link (can this be done with Shared Access Signature?)? Preferredly, without having to also synchronize users with AAD.

Any help or ideas where to find more information is much appreciated - Thank you!

Kind regards

Answer 1

@SQ_94
I understand you wish to authenticate outside of AAD by using your own application. Please let me know if I am misunderstanding.

It does sound like Shared Access Signatures are going to be the best method for your based on your requirements. A shared access signature (SAS) enables you to grant limited access to containers and blobs in your storage account. When you create a SAS, you specify its constraints, including which Azure Storage resources a client is allowed to access, what permissions they have on those resources, and how long the SAS is valid. Both a service SAS and an account SAS are signed with the storage account key. To create a SAS that is signed with the account key, an application must have access to the account key.

When a request includes a SAS token, that request is authorized based on how that SAS token is signed. The access key or credentials that you use to create a SAS token are also used by Azure Storage to grant access to a client that possesses the SAS.

Hope this helps! Let us know if you have further questions or issues.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.