Azure-webjobs-sdk: Feature Request: Support Managed Service Identity for Storage connections

[PhoenixHe-msft]

Please provide a succinct description of the issue.

Repro steps

Currently Azure Storage supports Managed Service Identity. But azure webjob sdk only spports connection string for storage account. It would be great that webjob sdk support MSI.

Known workarounds

I've found some workarounds by inject storage account on registering. First I need to generate the CloudStorageAccount by MSI in advance. Then, there are two services I need to inject:

var blobClient = storageAccount.CreateCloudBlobClient();
var container = blobClient.GetContainerReference("webjob-lock");

var builder = new HostBuilder()
   .ConfigureWebJobs(b =>
   {
     b.Services.AddSingleton(new DistributedLockManagerContainerProvider
     {
       InternalContainer = container
     });
     b.Services.AddSingleton<StorageAccountProvider>(new ManagedIdentityStorageAccountProvider(storageAccount));

     b.AddAzureStorageCoreServices();
     b.AddAzureStorage();
     b.AddTimers();
   })

public class ManagedIdentityStorageAccountProvider : StorageAccountProvider
{
  private readonly CloudStorageAccount storageAccount;

  public ManagedIdentityStorageAccountProvider(CloudStorageAccount storageAccount) : base(null)
  {
    this.storageAccount = storageAccount;
  }

  public override StorageAccount Get(string name)
  {
    return StorageAccount.New(this.storageAccount);
  }
}

I'm still looking for official MSI support.

[PhoenixHe-msft]

Any update on this one?

[ross-p-smith]

The above code fails for me as the StorageCredentails does not have an AccountName when created with a Token Credential. This would work if we could approve Pull Request #2000

[mmusin]

A year had passed...

[mdddev]

I want to try out the proposed workaround of @NullMDR but I am to inexperienced to actually apply it properly. Unfortunately the information in the code snippet provided, I don't know where to actually implement it. Is this program.cs or function.cs? Sorry for the lack of knowledge..

[mdddev]

Nevermind the above, it appears I have not read thoroughly enough.
The way I see it, you're explicitly defining the kind of storage account (i.e. the way it is created) in the DI. I am still new to all this, so apologies.

[mdddev]

FYI, this is working for Service Bus and Event Hub. Jeff Hollan, principal pm on the azure functions team informed on the reason why this is on twitter

https://twitter.com/jeffhollan/status/1260600212617179137

[cn894]

Hi, my team is still looking for official MSI support in the SDK. Has there been any update on this issue?