You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@opendal.apache.org by "Xuanwo (via GitHub)" <gi...@apache.org> on 2026/07/28 15:24:12 UTC
[PR] feat: add scoped credential granting with Azure user delegation SAS [opendal-reqsign]
Xuanwo opened a new pull request, #803:
URL: https://github.com/apache/opendal-reqsign/pull/803
## Overview
reqsign currently composes credential providers with request signers, but it has no lifecycle abstraction for using a service credential to issue another bounded, expiring credential in the same service family. That leaves scoped credential vending to ad-hoc service APIs and makes source credential caching, replacement isolation, post-I/O validity, and redaction difficult to apply consistently.
This introduces `GrantCredential` and `Granter<K>` in `reqsign-core`. `Granter<K>` loads and caches only the source credential, delegates service-specific authorization semantics to `GrantCredential<K>`, and returns credentials that remain directly consumable by the existing `Signer<K>`. The contract standardizes orchestration and lifecycle rather than imposing a cross-cloud scope model or promising strict monotonic downscoping for every service.
Azure User Delegation SAS is the first reference implementation. It exchanges a Bearer credential for a cached User Delegation Key, validates the account, endpoint, resource, path prefix, permissions, and time bounds, and emits an expiration-aware `Credential::SasToken`. Adding expiration to that public variant is an intentional compatibility evolution required for exact validity checks.
Closes #801.
Closes #751.
Closes #750.
Refs #749.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add scoped credential granting with Azure user delegation SAS [opendal-reqsign]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo merged PR #803:
URL: https://github.com/apache/opendal-reqsign/pull/803
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org