Azure credential subscoping

[eric-maynard]

Describe the solution you'd like

Polaris currently doesn't subscope Azure credentials based on the provided locations, which is different from the other two storage formats.

[raveendra11]

hi @eric-maynard I'll check on this, could you assign?

[raveendra11]

Describe the solution you'd like

Polaris currently doesn't subscope Azure credentials based on the provided locations, which is different from the other two storage formats.

are we talking about aws/gcp here for other two storages?

[eric-maynard]

Yes @raveendra11, those support credential subscoping.

[raveendra11]

Shall we do ? -
*Replace findAny() with iterator().next() in the getSubscopedCreds method to always pick the first location in the list. This makes the choice consistent every time.
*Add a check at the start of getSubscopedCreds to throw an error called IllegalArgumentException.
*Add a new helper method called extractCommonPathPrefix to find a shared path among all the provided locations. like, if locations are /path1/file1 and /path1/file2, the common path is path1.

[eric-maynard]

@raveendra11 the issue is that the credentials are not subscoped to the base location for Azure

[raveendra11]

@eric-maynard So, the main issue is not just about picking one of the allowed locations, but that we need to generate the Azure SAS token in a way that only allows access to the shared base path from all the given read/write locations. Is it?

If so, we'll find the common path shared by all allowed locations. and use that common path to scope the SAS token, so access is limited just to that path.

[eric-maynard]

If possible, we should prefer to subscope the credentials to a list of locations, rather than to a shared prefix.

[raveendra11]

If possible, we should prefer to subscope the credentials to a list of locations, rather than to a shared prefix.

Hi @eric-maynard Really sorry, I'm occupied with my academics. Couldn't be able to check anymore on this as of now. if this is critical, you could please re-assign to someone.
Thank you.