Azure-docs: Configure Publisher to Use Distributor

[thecherrytree]

Since this is still in public preview...

The configuration requires the use of a Secure Access Token. In lieu of the Secure Access Token, is it possible to use a Shared Access Signature for this configuration? The URI constructs are essentially the same.

File Storage SAS contruct:

FileEndpoint=https://storagesample.file.core.windows.net;
SharedAccessSignature=sv=2015-07-08&sig=iCvQmdZngZNW%2F4vw43j6%2BVz6fndHF5LI639QJba4r8o%3D&spr=https&st=2016-04-12T03%3A24%3A31Z&se=2016-04-13T03%3A29%3A31Z&srt=s&ss=bf&sp=rwl

Config requirements using the Storage Account Access Key:

:setvar file_storage "\\storage-account-name.file.core.windows.net\file-share-name"
:setvar file_storage_key "DefaultEndpointsProtocol=https;AccountName=<Storage-Account-Name>;AccountKey=****;EndpointSuffix=core.windows.net"

I'm proposing:

FileEndpoint = file_storage
SharedAccessSignature = file_storage_key 

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: d7cd1942-8ac7-eae9-4ac8-eb716ecd7b7b
• Version Independent ID: 559730f0-71fd-b16c-ecac-56954d5f2f64
• Content: Configure replication in an Azure SQL Database managed instance database
• Content Source: articles/sql-database/replication-with-sql-database-managed-instance.md
• Service: sql-database
• Sub-service: data-movement
• GitHub Login: @allenwux
• Microsoft Alias: xiwu

[Mike-Ubezzi-MSFT]

@thecherrytree Thank you very much for this inquiry and suggestion. We are investigating whether the Shared Access Signature is a functional alternative to using the Shared Access Token.

[Mike-Ubezzi-MSFT]

@thecherrytree Here is the first issue with using the Shared Access Signature. It allows for temporary access only as it has a Start and Expiry duration which is set along with Allowed IP Addresses and Allowed protocols, before being generated:

Also, the :setvar variables of file_storage and file_storage_key are currently recognized and I see that you have pointed the new variables, FileEndpoint and SharedAccessSignature, to the existing:

FileEndpoint = file_storage
SharedAccessSignature = file_storage_key

So, have you tried generating a SAS and using that instead of an Access Key, without redirecting the variables?

[thecherrytree]

Hey Mike - the documentation I've read on Shared Access Signatures indicates that you can set the expiry in a storage access policy within storage. This would enable the SAS URI to work for a very long (i.e. a year) period of time.

You can use the access policy to specify constraints for a service SAS on the container or its blobs.

What is unclear, is whether or not configuration in the tutorial can be alternatively done with a SAS instead of the storage account key. It would be preferable to use a shared access signature (constrained by a storage access policy) rather than use the storage account key. The tutorial implies that only the storage account key can be used. If this is the case, is it possible to make this configuration more flexible so that SAS can be used? If this is not the case, can you provide guidance as to how to configure this using SAS?

My example above was an attempt to more succintly indicate what would be desirable (e.g. use a SAS URI and TOKEN for the file_storage and file_storage_key) in the configuration.

As of this point, we are determining if the storage account key shows up anywhere in our logging using the current configuration. We have plans to try and use a SAS in place of the storage account key, but had doubts since that configuration alternative is not clearly outlined as a possibility.

[Mike-Ubezzi-MSFT]

@thecherrytree Perfect, this feedback is sufficient to request a doc-enhancement. This is not necessarily a doc-bug but brings up a great discussion point. I am assigning this to the content author to see if the SAS option can be added to the documentation, even adding that it is not supported if that is the case.

[Mike-Ubezzi-MSFT]

@allenwux Can this tutorial also leverage SAS? Configure replication in an Azure SQL Database managed instance database (link)

[thecherrytree]

Thanks, @Mike-Ubezzi-MSFT, since this is in public preview, how would one go about requesting a feature enhancement if SAS is not supported?

[Mike-Ubezzi-MSFT]

@thecherrytree The Azure SQL Uservoice is the best place to make feature requests. Please post this request here. I took a quick look through for any existing related topics but did not.

[thecherrytree]

@allenwux - have you had a chance to review? We'd like to raise this as a feature request with Uservoice if this is not an optional config pattern, but are planning to wait until we have an indication one way or the other.

[stevestein]

@thecherrytree - Let me take a look and see if I can find someone who can assist on this. Thanks!

reassign:stevestein

[psongms]

Azure file does not support SAS key for mounting (https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows). Therefore it can't be supported.

[stevestein]

@psongms - thanks for the response. Looks like it's called out in this section: https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows#prerequisites

@thecherrytree - thanks for the feedback. As Mike indicated, Azure SQL Uservoice is the best place to make feature requests.

please-close