For authentication purposes, the must be integrated with an Azure Key Vault keystore.
Please complete the following sections to create and configure your Azure Key Vault.
If you are enabling access to WASB, you must create this token within the Azure Portal.
For more information, see https://docs.microsoft.com/en-us/rest/api/storageservices/delegating-access-with-a-shared-access-signature.
You must specify the storage protocol (
wasbs ) used by the .
In the Key Vault, you can create key and secret pairs for use.
|Base Storage Layer||Description|
The creates its own key-secret combinations in the Key Vault. No additional configuration is required.
Please skip this section and populate the Key Vault URL into the .
|WASB||For WASB, you must create key and secret values that match other values in your Azure configuration. Instructions are below.|
WASB: To enable access to the Key Vault, you must specify your key and secret values as follows:
The value of the key must be specified as the
The value of the secret should match the shared access signature for your storage. This value is specified as
Acquire shared access signature value:
In the Azure portal, please do the following:
Create a custom key:
To create a custom key and secret pair for WASB use by the , please complete the following steps:
Chose an appropriate name for the key.
NOTE: Please retain the name of the key for later use, when it is applied through the as the
For ADLS or WASB, the location of the Azure Key Vault must be specified for the . The location can be found in the properties section of the Key Vault resource in the Azure portal.
This value is the location for the Key Vault. It must be applied in the .
Specify the URL in the following parameter:
"azure.keyVaultURL": "<your key value URL>",
If you are using WASB as your base storage layer, you must apply the SAS token value into the configuration of the .
Paste the value of the SAS Token for the key you created in the Key Vault as the following value:
"azure.wasb.defaultStore.sasTokenId": "<your Sas Token Id>",
Access to the Key Vault requires use of the secure token service (STS) from the . To use STS with Azure, the following properties must be specified.
NOTE: Except in rare cases, the other properties for secure token service do not need to be modified.
|" secure-token-service .autorestart"|
Set this value to
|"secure-token-service.port"||Set this value to |
Enter a base64 string to serve as your encryption key for the refresh token of the secure token service.
A default encryption key is inserted for you.
|"secure-token-service.userIdHashingPepper"||Enter a base64 string.|