Feature/storage/session datalocality private drop by browndav-msft · Pull Request #50046 · Azure/azure-sdk-for-java

browndav-msft · 2026-08-05T20:43:33Z

This is the session feature for the private drop

* generate base files based on swagger docs * create live tests for createSession - downgrade blobserviceversion to 2026_04_06 - change AZURE_LIVE_TEST_SERVICE_VERSION to V2026_04_06 in ci.system.properties in azure-storage-common - create both sync and async * add recordings * create new files based on swagger update * add two params to BlobContainerClient#createSessionWithResponse * add sanitizers for SessionToken and SessionKey to BlobTestBase * add recording for createSessionReturnsTokenAndKey * create StorageSessionCredential with isExpired * create BlobSessionClient so that BlobSessionProvider takes it as a dep instead of ContainersImpl * create BlobSEssionClient with tests * add recorings for BlobSessionClient * fix BlobContainerAsyncClient to match new swagger, add new recording * add SessionProvider and SessionProviderTest * add accountName to BlobSessionClient * add accountName to StorageSessionCredential and SesionTestHelper * wip * change sessionprovider to SEssionTokenCredentialPolicy * wip * move session tests from containerapi to blobsessionclienttests * fix blobsessiontests and add place holder for end-to-end tests in containerapitests * add recordings for blobsessionclient * linting * refactor cache into separate class so it follows BearerTokenAuthenticationPolicy + AccessTokenCache pattern * add 503 fallback * add tests for udsas, but disabled for now * refactor createContext to use hardcoded endpoint * add SessionMode and tests for SessionMode * add sessionOptions to buildPipeline, add null to builders not using sessions * move SessionTokenCredentialPolicy ahead of StorageBearerTokenChallengeAuthorizationPolicy * fix linting issues * add session to BlobServiceClients and BlobServiceClientBuildeer * change expiration so that it defaults to 5 minutes, if there is no expiration * move SessionOptions so that it is public * remove old SessionOptions * remove unnecessary references to containerName and serviceVersion * add BlobContainerSessionInfo, add other Copilot recommendations * delete BlobContainerSessionInfo, restore return CreateSessionResponse * create createSession end-to-end test with recordings * only allow get requests for getblob * wrap tests in try-with-resources * make createSession package private * fixes based on copilot suggestions * Update sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/util/BlobSessionClient.java Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * add containerName to SessionOptions * move accountName to SessionOptions * refactor: SessionTokenCredentialPolicy accepts bearer policy as constructor dependency SessionTokenCredentialPolicy now takes StorageBearerTokenChallengeAuthorizationPolicy as a constructor dependency instead of relying on pipeline ordering to coordinate with the bearer policy. Key changes: - SessionTokenCredentialPolicy delegates to bearerPolicy.process() for non-session requests (non-GetBlob, NONE mode, AUTO first request) and fallback (503). - Added getBearerPolicy() accessor for use in per-container pipeline construction. - BuilderHelper updated to pass bearer policy through to SessionTokenCredentialPolicy constructor in both addSessionPolicyIfEnabled and wrapWithSessionPolicy. - Tests updated to mock bearerPolicy and verify delegation behavior. This is step 1 of the session auth refactor to align with the .NET SDK's SessionAuthenticationPolicy pattern. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor: introduce AuthStrategy enum and consolidate analyzeRequest Consolidate isGetBlobRequest() and shouldUseSession() into a single analyzeRequest() method that returns an AuthStrategy enum (USE_BEARER_TOKEN or USE_SESSION_TOKEN), following the .NET SessionAuthenticationPolicy pattern. Also extract response handling into handleSessionResponse() and handleSessionResponseSync() methods for cleaner process()/processSync() flow. The process methods now have a clear structure: 1. analyzeRequest() -> decide strategy 2. USE_BEARER_TOKEN -> delegate to bearer policy 3. USE_SESSION_TOKEN -> acquire session, sign, send, handle response No behavioral changes - all existing tests pass unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor: remove redundant restype check from analyzeRequest The restype query parameter check was redundant because requests with restype=container are container-level operations that have no blob name. They are already filtered by the blob name presence check. This aligns more closely with the .NET SessionAuthenticationPolicy which relies on URL structure rather than query parameter checks. The comp check is retained as a safety measure to exclude sub-operations like GetBlobMetadata (comp=metadata) that have a blob name but are not download operations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * change sessionmode from always to singlespecifciedcontainer, add resolve method * wrap bearer token in sessioncredentialpolicy * fix NPE for SessionOptions, sessionoptions always non null * add tests for sessiontokencredpolicy and storagesessioncred * add logic to avoid wrapping Bearertoken, if session is not needed * add overloaded oauth in blobtestbase to be able to add sessionoptions * add overloaded getOAuthServiceAsyncClient to be able to pass session options * add custom buildStringToSign to remove `0` from get requests * readd versions * readd ci.system.properties * change session options check for null in BuilderHelper which affected other tests * add recordings for create sessions, change time to testResource time * add requestInspectionPolicy and overloaded getoauth client in base test * fix null sessionsoptions issue * add fix in storagesessioncredntial for query params * add SessionTokenCredPolicy to checks for anonymousAccess * remove constructor for BlobSessionClients that uses parse url * linting issues, remove SessionOptions from service methods * add comments to policyrefreshNearExpiry test * fix linting issues * add check for container name * fix return javadoc for SessionMode * add LOGGER and appropriate error throwing in BlobSessionClient * changes based on feedback from isabelle * add single retry for all 401 errors * remove unused imports * add suppression for SessionTokenPolicy for linting * fix ubuntu tests hanging by removing local dns bypass * add session for blob client with tests * create unified http transport between data requests and session request, add ResourceLock for live tests * test multiple concurrency * add branching if for bearer policy * refactor validateSessionMode to builderhelper * add revert to bearertoken for 400 errors * remove unused imports * readd comment to bearertokechallenge --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

azure-pipelines · 2026-08-05T20:44:27Z

Azure Pipelines: Successfully started running 1 pipeline(s). 33 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

…hing into BlobSessionClient - Expand SessionProvider with default invalidateSession/refreshSession lifecycle methods - Move AutoRefreshingCache per-container caching from deleted SessionCredentialManager into BlobSessionClient - Extract account cooldown into narrow SessionAcquisitionCooldown helper - SessionTokenCredentialPolicy depends directly on SessionProvider; no manager wrapper - BYO custom providers are used directly without SDK-owned cache wrapping - Remove SessionOptions.orDefault (internal helper made public accidentally) - Update CHANGELOG and SessionOptions JavaDoc to reflect new BYO provider ownership model - Add BlobSessionClientCacheTest, SessionAcquisitionCooldownTest, update SessionTokenCredentialPolicyTest Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Turned back using mirror settings for CFS in CI * Restore POM repository overrides for local dev CFS routing Keep <repositories> and <pluginRepositories> blocks in POMs so local development continues to route through CFS (no-auth) by default. The CI mirror settings in eng/settings.xml handle the tools/extensions that don't respect POM-level repos. * Updated contributing doc * Added clarification for using mirror settings locally * Added azure-artifacts folder to gitignore

…ession tests

…MockHttpClient

…iptedHttpClient

Copilot

Pull request overview

This PR introduces session-based authentication support for Azure Storage (Blob-focused) by adding new session model types, a built-in session provider with caching/refresh semantics, and an HTTP pipeline policy that opportunistically authenticates eligible GET Blob requests with session credentials while falling back to bearer tokens. It also adds/updates a number of tests and makes several CI/build-related changes.

Changes:

Add session-auth primitives (options/mode/credential/request context/provider) and wire them into Blob client pipeline construction via a new SessionTokenCredentialPolicy.
Implement a default TokenCredentialSessionProvider backed by a reusable auto-refreshing cache and add extensive unit/live test coverage and sanitization for session secrets.
Update CI/build tooling (Maven mirror/auth setup, pip auth, agent OS verification step) and contributor documentation.

Reviewed changes

Copilot reviewed 50 out of 51 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/storage/azure-storage-file-datalake/src/test/java/com/azure/storage/file/datalake/FileSystemAsyncApiTests.java	Adds a disabled async Data Lake session-auth read test and request inspection.
sdk/storage/azure-storage-file-datalake/src/test/java/com/azure/storage/file/datalake/FileSystemApiTests.java	Adds a disabled sync Data Lake session-auth read test and request inspection.
sdk/storage/azure-storage-file-datalake/src/test/java/com/azure/storage/file/datalake/DataLakeTestBase.java	Adds OAuth client builder helpers that accept `SessionOptions`.
sdk/storage/azure-storage-file-datalake/src/test/java/com/azure/storage/file/datalake/DataLakeServiceClientBuilderTests.java	Adds tests asserting session policy wiring behavior for Data Lake builders.
sdk/storage/azure-storage-file-datalake/src/main/java/com/azure/storage/file/datalake/DataLakeServiceClientBuilder.java	Adds `sessionOptions(SessionOptions)` passthrough to the underlying Blob builder.
sdk/storage/azure-storage-common/src/test/java/com/azure/storage/common/StorageSharedKeyCredentialTests.java	Adds test coverage for canonicalized resource behavior for IP-style URLs.
sdk/storage/azure-storage-common/src/test-shared/java/com/azure/storage/common/test/shared/session/SessionTestHelper.java	Adds shared session test fixtures/constants for session-related tests.
sdk/storage/azure-storage-common/src/test-shared/java/com/azure/storage/common/test/shared/http/ScriptedHttpClient.java	Adds a deterministic scripted HTTP transport for cache/policy unit tests.
sdk/storage/azure-storage-common/src/main/java/module-info.java	Exports a new internal util package to the Blob module.
sdk/storage/azure-storage-common/src/main/java/com/azure/storage/common/implementation/util/AutoRefreshingCache.java	Adds a generic async/sync auto-refreshing cache used for session credentials.
sdk/storage/azure-storage-blob/swagger/README.md	Updates autorest input spec reference for Blob swagger generation.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/RequestInspectionPolicy.java	Adds a test-only policy for recording on-wire requests at PER_RETRY.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/implementation/util/TokenCredentialSessionProviderTests.java	Adds live tests for the built-in session provider behavior.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/implementation/util/TokenCredentialSessionProviderCacheTest.java	Adds deterministic unit tests for provider caching/refresh behavior.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/implementation/util/SessionTokenCredentialPolicyTest.java	Adds unit tests for session auth policy fallback/invalidation/cooldown behaviors.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/implementation/util/SessionProviderTests.java	Adds unit tests validating the `SessionProvider` contract behavior.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/implementation/util/SessionCredentialTest.java	Adds unit tests for `SessionCredential` expiry and null handling.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/ContainerAsyncApiTests.java	Adds session CreateSession and session-auth download/list live tests (async).
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/ContainerApiTests.java	Adds session CreateSession and session-auth download/list/rotation live tests (sync).
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/BuilderHelperTests.java	Updates pipeline construction tests and adds coverage for session policy wiring.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/BlobTestBase.java	Adds session secret sanitizers and adds session-aware OAuth client helpers.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/BlobAsyncApiTests.java	Adds a live async chunked download test asserting session auth usage.
sdk/storage/azure-storage-blob/src/test/java/com/azure/storage/blob/BlobApiTests.java	Adds a live sync chunked download test asserting session auth usage.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/specialized/SpecializedBlobClientBuilder.java	Updates pipeline construction call signature to pass new session args.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/models/SessionRequestContext.java	Introduces request-scoped context object for session acquisition.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/models/SessionProvider.java	Introduces public provider interface for session lifecycle/caching customization.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/models/SessionOptions.java	Introduces options bag for enabling/disabling sessions and configuring provider/overrides.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/models/SessionMode.java	Introduces session mode enum (enabled/disabled).
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/models/SessionCredential.java	Introduces session credential model carrying token/key/expiry/account.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/util/TokenCredentialSessionProvider.java	Adds built-in provider calling CreateSession and caching per container.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/util/SessionTokenCredentialPolicy.java	Adds pipeline auth policy selecting session vs bearer and handling fallback/cooldown.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/util/BuilderHelper.java	Wires session support into pipeline construction and shares transport for CreateSession/data.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/models/SessionCredentials.java	Adds generated model for session credentials returned by CreateSession.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/models/CreateSessionResponse.java	Adds generated CreateSession response model.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/models/CreateSessionConfiguration.java	Adds generated CreateSession request payload model.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/models/AuthenticationType.java	Adds generated AuthenticationType enum (ExpandableStringEnum).
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/implementation/ContainersImpl.java	Adds generated CreateSession REST wiring (sync + async).
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobServiceClientBuilder.java	Adds `sessionOptions(...)` and ensures session policy counts as a credential policy.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobServiceClient.java	Minor formatting change near container client creation.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerClientBuilder.java	Updates pipeline construction to pass service version into BuilderHelper.
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerClient.java	Adds CreateSession APIs (currently non-public).
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerAsyncClient.java	Adds CreateSession APIs (currently non-public).
sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobClientBuilder.java	Updates pipeline construction to pass service version into BuilderHelper.
sdk/storage/azure-storage-blob/checkstyle-suppressions.xml	Suppresses HttpPipelinePolicy checkstyle rule for the new session policy.
sdk/storage/azure-storage-blob/assets.json	Updates asset tag reference.
eng/settings.xml	Adds Maven mirror settings for routing requests through Azure Artifacts.
eng/pipelines/templates/steps/maven-authenticate.yml	Copies mirror settings into ~/.m2 before MavenAuthenticate runs.
eng/pipelines/templates/jobs/ci.yml	Adds pip authentication for Python feed used by CI steps.
eng/common/pipelines/templates/steps/verify-agent-os.yml	Removes bypass-local-dns step from agent OS verification template.
CONTRIBUTING.md	Documents how to match CI Maven mirror behavior locally.
.gitignore	Ignores Azure Artifacts credential provider runtime directory.

Suppressed comments (2)

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerClient.java:1535

The new CreateSession API is package-private, which makes it unusable to library consumers despite being annotated with @ServiceMethod. If this is intended to be part of the public client surface, it should be declared public.

    Response<CreateSessionResponse> createSessionWithResponse(Duration timeout, Context context) {

sdk/storage/azure-storage-blob/src/main/java/com/azure/storage/blob/BlobContainerAsyncClient.java:1715

The new createSessionWithResponse() method is package-private. For a service-client operation annotated with @ServiceMethod, this should be public so SDK consumers can call it.

    Mono<Response<CreateSessionResponse>> createSessionWithResponse() {

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 50 out of 51 changed files in this pull request and generated 4 comments.

 ``` yaml
 use: '@autorest/java@4.1.63'
-input-file: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/15d7f54a5389d5906ffb4e56bb2f38fe5525c0d3/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-06-06/blob.json
+input-file: https://raw.githubusercontent.com/nickliu-msft/azure-rest-api-specs/013866b01623e6f2cc6c313b44c9c6460de3e91e/specification/storage/data-plane/Microsoft.BlobStorage/stable/2026-10-06/blob.json


+    @ServiceMethod(returns = ReturnType.SINGLE)
+    public Mono<CreateSessionResponse> createSession() {
+        return createSessionWithResponse().flatMap(FluxUtil::toMono);


+        startSessionCreationAsync().subscribe(ignored -> {
+        }, error -> LOGGER.warning("Background session refresh failed.", error));


+    @ServiceMethod(returns = ReturnType.SINGLE)
+    public CreateSessionResponse createSession() {
+        return createSessionWithResponse(null, Context.NONE).getValue();


browndav-msft and others added 9 commits June 11, 2026 12:19

fix bug in storage session credential with get content length 0

db1c3da

patch to enable session with environement variables

314c99c

Potential fix for pull request finding

44a9ee3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

add code to ensure container name only accepted when session enabled

45b7a4b

fix formatting and javadocs alignment

06aa7ef

add forceRefreshSessionInBackground() to SessionTokenCredentialPolicy

51fbeb0

remove .env initialization for sessions

7faf5db

change SessionCredentialCache to AutoRefreshingCache<T>

00a9c6c

github-actions Bot added the Storage Storage Service (Queues, Blobs, Files) label Aug 5, 2026

browndav-msft and others added 19 commits August 7, 2026 10:53

rename params for SessionTokenCrednetialPolicy

3482998

add autorefreshcasche specific tests for blob session credential

3849bcc

wip

773be49

remove sessionacquisitioncooldown, remove log entry

fd1c082

remove SessionRequestSigner, rename SessionClient to SessionProvider

cec3ba6

rename SessionProviderSeamTests to SessionProviderTests

ec36ad0

create helper method for session provider inside BuilderHelper

88c29c4

refactor beginAccountCooldown

974c904

inline error codes, make async code easier to read

737253c

rename BlobSessionProvider to TokenCredentialSessionProvider

bbb79a1

Added pip auth step for using internal feed (Azure#48717)

9871ec5

consolidate testing resources in session package in common, improve s…

0749ecb

…ession tests

rework SessionTokenCredentialPolicyTest to remove warnings

10b9c4e

remove normal and trims from TokenCredentialSessionProviderCacheTests

86eb96a

remove unnecessary tests in BuilderHelper

f9f4cc9

add recordings for tests

587be54

fix linting

90484bb

browndav-msft added 5 commits August 12, 2026 14:47

consolidate session mocks to scriptedHttpClient, remove createSession…

5f2aa0e

…MockHttpClient

refactor builderhelper test to test customer provided SessionProvider

cc80195

clean up javadoc for sessionprovider, remove unneeded returns for Scr…

a6749aa

…iptedHttpClient

add support for dfs hns

708560c

create live tests for datalake

1651afc

browndav-msft requested a lite review from Copilot August 13, 2026 01:01

Copilot started reviewing on behalf of browndav-msft August 13, 2026 01:02 View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

add public accessors to session methods

1e6ec15

browndav-msft requested a balanced review from Copilot August 13, 2026 02:18

Copilot started reviewing on behalf of browndav-msft August 13, 2026 02:18 View session

Copilot AI reviewed Aug 13, 2026

View reviewed changes

Navigation Menu

Uh oh!

Feature/storage/session datalocality private drop - #50046

Feature/storage/session datalocality private drop#50046
browndav-msft wants to merge 34 commits into
Azure:feature/storage/bifrost-private-dropfrom
browndav-msft:feature/storage/session-datalocality-private-drop

browndav-msft commented Aug 5, 2026

Uh oh!

azure-pipelines Bot commented Aug 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		startSessionCreationAsync().subscribe(ignored -> {
		}, error -> LOGGER.warning("Background session refresh failed.", error));

Uh oh!

Conversation

browndav-msft commented Aug 5, 2026

Uh oh!

azure-pipelines Bot commented Aug 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants