Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

object_store Azure Government using OAuth #6759

Open
zadeluca opened this issue Nov 20, 2024 · 2 comments
Open

object_store Azure Government using OAuth #6759

zadeluca opened this issue Nov 20, 2024 · 2 comments
Labels
enhancement Any new improvement worthy of a entry in the changelog good first issue Good for newcomers help wanted

Comments

@zadeluca
Copy link

Which part is this question about
object_store Azure

Describe your question
I have reviewed this issue #4853 which also pertains to using Azure Government. That example uses shared key authentication. For OAuth (ClientSecretOAuthProvider), I believe it is also necessary to set authority_host to authority_hosts::AZURE_GOVERNMENT in order for the token_url to be correct.

Without this setting, I am currently getting this error "AADSTS900382: Confidential Client is not supported in Cross Cloud request. I understand it is possible to override using MicrosoftAzureBuilder::with_authority_host(), however I am using delta-rs which requires that all configuration is provided though storage_options with keys defined in AzureConfigKey. This currently does not allow setting AuthorityHost.

Does that sound correct? If so, is it possible to expose AuthorityHost through AzureConfigKey?

Additional context
I have only tried in Python using delta-rs. I am going to attempt to use arrow-rs directly in order to verify that setting AuthorityHost does indeed resolve the error mentioned above. I am a Rust beginner so it may take some effort.

@zadeluca zadeluca added the question Further information is requested label Nov 20, 2024
@tustvold
Copy link
Contributor

I'm not very familiar with Azure's government offering, but we should expose the option as a config key if it isn't

@tustvold tustvold added good first issue Good for newcomers enhancement Any new improvement worthy of a entry in the changelog help wanted and removed question Further information is requested labels Nov 20, 2024
@zadeluca
Copy link
Author

I have confirmed that including both of these:

            .with_authority_host("https://login.microsoftonline.us")
            .with_endpoint("https://<ACCOUNT>.blob.core.usgovcloudapi.net".to_string())

on the builder allows OAuth to succeed. I will try to submit a PR to add AuthorityHost to AzureConfigKey.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Any new improvement worthy of a entry in the changelog good first issue Good for newcomers help wanted
Projects
None yet
Development

No branches or pull requests

2 participants