This commit is contained in:
yonghuiye 2022-03-24 16:22:18 +08:00
Родитель 44bc6e20b8
Коммит 6d4ba33977
14 изменённых файлов: 37 добавлений и 35 удалений

Просмотреть файл

@ -31,7 +31,7 @@ inconsistency of project naming, artifact Ids, versions, configurations made the
To improve the development experience across Spring Cloud Azure libraries, a set of design guidelines was introduced to
ensure that Spring Cloud Azure libraries have a natural and idiomatic feel with respect to the Spring ecosystem. Further
details are available in the https://github.com/Azure/azure-sdk-for-java/wiki/Spring-Cloud-Azure-4.0-design[design doc] for those interested.
details are available in the https://github.com/Azure/azure-sdk-for-java/wiki/Spring-Cloud-Azure-4.0-design[design document] for those interested.
The *Spring Cloud Azure 4.0* provides the shared experience across libraries integrating with different Spring
projects, for example Spring Boot, Spring Integration, Spring Cloud Stream, etc. The shared experience includes:
@ -56,8 +56,8 @@ This migration guide will consist following sections:
[#migration-guide-naming]
=== Naming Changes
There has never been a consistent or official name to call all the Spring Cloud Azure libraries, some of them were
called `Azure Spring Boot` and some of them `Spring on Azure`, and all these names will make developer confused. Since
There has never been a consistent or official name to call all the Spring Cloud Azure libraries, some of the were
called `Azure Spring Boot` and some of them `Spring on Azure`, and all these names will make developers confused. Since
4.0, we began to use the project name `Spring Cloud Azure` to represent all the Azure Spring libraries.
[#migration-guide-bom]
@ -1339,7 +1339,7 @@ spring:
resource-group: ${RESOURCE_GROUP}
----
You can also migrate to authenticate and authorize with Azure AD directly without making a detour to ARM. Make sure to grant the security principal necessary `Data` roles for messaging operations. The configuration examples of the service principal and the manged identity are listed as below:
You can also migrate to authenticate and authorize with Azure AD directly without making a detour to ARM. Make sure to grant the security principal necessary `Data` roles for messaging operations. The configuration examples of the service principal and the managed identity are listed as below:
* With a service principal
@ -1529,7 +1529,7 @@ spring:
resource-group: ${SERVICEBUS_RESOURCE_GROUP}
----
You can also migrate to authenticate and authorize with Azure AD directly without making a detour to ARM. Make sure to grant the security principal necessary `Data` roles for messaging operations. The configuration examples of the service principal and the manged identity are listed as below:
You can also migrate to authenticate and authorize with Azure AD directly without making a detour to ARM. Make sure to grant the security principal necessary `Data` roles for messaging operations. The configuration examples of the service principal and the managed identity are listed as below:
* With a service principal

Просмотреть файл

@ -39,9 +39,9 @@ TIP: Please refer to link:index.html#authorize-access-with-azure-active-director
=== Managed Identities
A common challenge for developers is the management of secrets and credentials used to secure communication between different components making up a solution. Managed identities eliminate the need for developers to manage credentials. Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. Applications may use the managed identity to obtain Azure AD tokens. For example, an application may use a managed identity to access resources like Azure Key Vault where developers can store credentials in a secure manner or to access storage accounts.
A common challenge for developers is the management of secrets and credentials used to secure communication between different components making up a solution. Managed identities eliminate the need for developers to manage credentials. Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. Applications may use the managed identity to obtain Azure AD tokens. For example, an application may use a managed identity to access resources like Azure Key Vault where developers can store credentials in a secure manner or access storage accounts.
We encourage using manged identity instead of using connection string or key in your application for it's more secure and will save the trouble of managing secrets and credentials. In this case, `DefaultAzureCredential` could better serve the scenario of developing locally using account information stored locally and deploying the application to Azure Cloud and using Manged Identity.
We encourage using managed identity instead of using connection string or key in your application for it's more secure and will save the trouble of managing secrets and credentials. In this case, `DefaultAzureCredential` could better serve the scenario of developing locally using account information stored locally and deploying the application to Azure Cloud and using Managed Identity.
==== Managed Identity Types
There are two types of managed identities:
@ -53,19 +53,19 @@ NOTE: When using a user-assigned managed identity, you can specify the client ID
TIP: Please refer to link:index.html#authorize-access-with-azure-active-directory[Authorize access with Azure AD] to make sure the security principal has been granted the sufficient permission to access the Azure resource.
TIP: Please refer to link:{managed-identity}[What are managed identities for Azure resources?] for more details about manged identity.
TIP: Please refer to link:{managed-identity}[What are managed identities for Azure resources?] for more details about managed identity.
=== Other Credential Types
Developers who want more control or whose scenario isn't served by the `DefaultAzureCredential` or whose scenario isn't served by the default settings should use other credential types.
==== Authentication and Authorization with Azure AD
With Azure AD, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user, or an application service principal. When a security principal (a user, or an application) attempts to access an Azure resource, for example an Event Hubs resource, the request must be authorized. With Azure AD, access to a resource is a two-step process.
==== Authentication and Authorization with Azure Active Directory
With Azure AD, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user or an application service principal. When a security principal (a user, or an application) attempts to access an Azure resource, for example, an Event Hubs resource, the request must be authorized. With Azure AD, access to a resource is a two-step process.
1. First, the security principal's identity is authenticated, and an OAuth 2.0 token is returned.
2. Next, the token is passed as part of a request to the Azure service to authorize access to the specified resource.
===== Authenticate with Azure AD
===== Authenticate with Azure Active Directory
For applications want to connect to resources that support Azure AD authentication, below configurations could be set with prefix `spring.cloud.azure.credential` or `spring.cloud.azure.<azure-service>.credential`.
.Authentication properties
@ -98,7 +98,7 @@ For applications want to connect to resources that support Azure AD authenticati
TIP: To see the list of all Spring Cloud Azure related configuration properties please check link:appendix.html[the Appendix page].
[#authorize-access-with-azure-active-directory]
===== Authorize Access with Azure AD
===== Authorize Access with Azure Active Directory
The authorization step requires that one or more Azure roles be assigned to the security principal. The roles that are assigned to a security principal decide the permissions that the principal will have.

Просмотреть файл

@ -1,7 +1,7 @@
[#configuration]
== Configuration
Most of Azure SDKs could be divided into two categories by transport type, HTTP-based and AMQP-based. There are properties that are common to all SDKs such as authentication principals and Azure environment settings. Or common to HTTP-based clients, such as logging level to log http requests and responses. Spring Cloud Azure 4.0 provides five common categories of configuration properties, which could be specified to each Azure service.
Most of Azure SDKs could be divided into two categories by transport type, HTTP-based and AMQP-based. There are properties that are common to all SDKs such as authentication principals and Azure environment settings. Or common to HTTP-based clients, such as logging level to log HTTP requests and responses. Spring Cloud Azure 4.0 provides five common categories of configuration properties, which could be specified to each Azure service.
.Service common properties
[cols="2,3", options="header"]

Просмотреть файл

@ -1,7 +1,7 @@
== Getting Help
If you have any questions about this doc, please ask by creating GitHub issue. And Pull Request is welcome.
If you have any questions about this document, please ask by creating GitHub issues. And Pull Request is welcome.
.GitHub repositories
[%autowidth.stretch]
@ -10,10 +10,10 @@ If you have any questions about this doc, please ask by creating GitHub issue. A
|GitHub repositories | Description
|https://github.com/Azure/azure-sdk-for-java/tree/spring-cloud-azure-dependencies_{project-version}/sdk/spring[Azure/azure-sdk-for-java]
|This repository used to hold the source code.
|This repository is used to hold the source code.
|https://github.com/microsoft/spring-cloud-azure/tree/{project-version}/docs/src/main/asciidoc[microsoft/spring-cloud-azure]
|This repository used to hold the document which is displaying in current page.
|This repository is used to hold the document which is displayed on the current page.
|===

Просмотреть файл

@ -111,5 +111,5 @@ Below are starters for **Spring Cloud Stream** support:
=== Learning Spring Cloud Azure
We prepared a full list of samples to show the usages, can be found at https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-cloud-azure_{project-version}[Spring Cloud Azure Samples].
We prepared a full list of samples to show the usages, which can be found at https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-cloud-azure_{project-version}[Spring Cloud Azure Samples].

Просмотреть файл

@ -1,5 +1,5 @@
== Migration Guide for 4.0
To learn how to migration to 4.0, please check link:appendix.html#migration-guide-for-4-0[the Appendix page].
To learn how to migrate to 4.0, please check link:appendix.html#migration-guide-for-4-0[the Appendix page].

Просмотреть файл

@ -28,7 +28,7 @@ Add the Spring Cloud Azure Actuator Starter dependency. This dependency will als
|Storage Queue |management.health.*azure-storage-queue*.enabled
|===
IMPORTANT: Calling the health endpoint of Azure services may cause extra charge. For example, calling `http://HOST_NAME:{port}/actuator/health/cosmos` to get the Cosmos DB health info, it will calculate https://docs.microsoft.com/azure/cosmos-db/request-units[RUs].
IMPORTANT: Calling the health endpoint of Azure services may cause extra charges. For example, calling `http://HOST_NAME:{port}/actuator/health/cosmos` to get the Cosmos DB health info, it will calculate https://docs.microsoft.com/azure/cosmos-db/request-units[RUs].
=== Enable Sleuth
@ -42,6 +42,6 @@ Add the Spring Cloud Azure Trace Sleuth dependency when you want to trace Azure
</dependency>
----
NOTE: Only HTTP-based Azure SDK clients are supported now, for example, Eventhub and ServiceBus with AMQP transport are currently not supported, we recommend to use https://docs.microsoft.com/azure/azure-monitor/app/app-insights-overview[Azure Application Insights] for such requirement.
NOTE: Only HTTP-based Azure SDK clients are supported now, for example, Eventhub and ServiceBus with AMQP transport are currently not supported, we recommend using https://docs.microsoft.com/azure/azure-monitor/app/app-insights-overview[Azure Application Insights] for such requirements.

Просмотреть файл

@ -140,7 +140,7 @@ Resource storageFileResource = resourceLoader.getResource("azure-file://[your-fi
----
===== Get Resources by Searching Pattern
You can use implementation class of `ResourcePatternResolver` to search resources. Use `AzureStorageBlobProtocolResolver` to search `blob` resources, and `AzureStorageFileProtocolResolver` to search `file` resources.
You can use the implementation class of `ResourcePatternResolver` to search resources. Use `AzureStorageBlobProtocolResolver` to search `blob` resources, and `AzureStorageFileProtocolResolver` to search `file` resources.
- Pattern search, the **searchPattern** should start with `azure-blob://` or `azure-file://`. Such as `azure-blob://+++**+++/+++**+++`, it means list all blobs in all containers; `azure-blob://demo-container/**`, it means list all blobs in the demo-container container, including any sub-folders.
- Location search, the **searchLocation** should start with `azure-blob://` or `azure-file://`, the remaining file path should exist, otherwise an exception will be thrown.

Просмотреть файл

@ -65,7 +65,9 @@ public class SampleApplication implements CommandLineRunner {
Key Vault secret name only support characters in `[0-9a-zA-Z-]`. Refs: link:https://docs.microsoft.com/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name[Vault-name and Object-name]. If your property name contains other characters, you can use these workarounds:
- Use `-` instead of `.` in secret name. `.` is not supported in secret name. If your application have property name which contain `.`, like `spring.datasource.url`, just replace `.` to `-` when save secret in Azure Key Vault. For example: Save `spring-datasource-url` in Azure Key Vault. In your application, you can still use `spring.datasource.url` to retrieve property value. **NOTE**: This method can not satisfy requirement like `spring.datasource-url`. When you save `spring-datasource-url` in Key Vault, only `spring.datasource.url` and `spring-datasource-url` is supported to retrieve property value, `spring.datasource-url` is not supported. To handle this case, please refer to the following option: Use property placeholders.
- Use `-` instead of `.` in secret name. `.` is not supported in secret name. If your application have property name which contains `.`, like `spring.datasource.url`, just replace `.` to `-` when save secret in Azure Key Vault. For example: Save `spring-datasource-url` in Azure Key Vault. In your application, you can still use `spring.datasource.url` to retrieve property value.
**NOTE**: This method can not satisfy requirement like `spring.datasource-url`. When you save `spring-datasource-url` in Key Vault, only `spring.datasource.url` and `spring-datasource-url` is supported to retrieve property value, `spring.datasource-url` is not supported. To handle this case, please refer to the following option: Use property placeholders.
- Use property placeholders. For example: setting this property in your application.properties: `property.with.special.character_=${propertyWithoutSpecialCharacter}`. The application will get `propertyWithoutSpecialCharacter` key name and assign its value to `property.with.special.character_`.

Просмотреть файл

@ -518,8 +518,8 @@ public void producerError(Message<?> message) {
===== Event Hubs Message Headers
See the <<si-eh-headers, Event Hubs message headers>> for the basic message headers supported.
===== Multi Binder Support
Connection to mutiple Event Hubs namespaces is also supported by using multi binders.This sample takes connection string as example. Credentials of service principals and managed identities are also supported, users can set related properties in each binder's environment settings.
===== Multiple Binder Support
Connection to multiple Event Hubs namespaces is also supported by using multiple binders.This sample takes connection string as example. Credentials of service principals and managed identities are also supported, users can set related properties in each binder's environment settings.
Step 1. To use multiple binders of EventHubs, we need to configure below properties in application.yml
[source,yaml]
@ -937,7 +937,7 @@ public Supplier<Message<String>> supply() {
The binder supports link:https://docs.microsoft.com/azure/service-bus-messaging/service-bus-partitioning[Service Bus partitioning] by allowing setting partition key and session id in the message header. This section introduces how to set partition key for messages.
Spring Cloud Stream provides a partition key SpEL expression property `spring.cloud.stream.bindings.<binding-name>.producer.partition-key-expression`. For example, setting this properts as `&quot;&#39;partitionKey-&#39; + headers[&lt;message-header-key&gt;]&quot;` and add a header called <message-header-key>. Spring Cloud Stream will use the value for this header when evaluating the above expression to assign a partition key. Here is an example producer code:
Spring Cloud Stream provides a partition key SpEL expression property `spring.cloud.stream.bindings.<binding-name>.producer.partition-key-expression`. For example, setting this property as `&quot;&#39;partitionKey-&#39; + headers[&lt;message-header-key&gt;]&quot;` and add a header called <message-header-key>. Spring Cloud Stream will use the value for this header when evaluating the above expression to assign a partition key. Here is an example producer code:
[source,java]
----
@ -977,7 +977,7 @@ the value of the session id will eventually be used to overwrite the value of th
This channel is open by default, and a default consumer error channel handler is used to send failed messages to the dead-letter queue when `spring.cloud.stream.servicebus.bindings.<binding-name>.consumer.requeue-rejected` is enabled, otherwise the failed messages will be abandoned.
To customize the consumer error channel handler, you can register you own error handler to the related consumer error channel in this way:
To customize the consumer error channel handler, you can register your own error handler to the related consumer error channel in this way:
[source,java]
----
// Replace destination with spring.cloud.stream.bindings.input.destination
@ -1025,8 +1025,8 @@ See the <<si-sb-headers, Service Bus message headers>> for the basic message hea
NOTE: When setting the partiton key, the priority of message header is higher than Spring Cloud Stream property. So `spring.cloud.stream.bindings.<binding-name>.producer.partition-key-expression` will take effect only when none of the headers of `ServiceBusMessageHeaders#SESSION_ID`, `ServiceBusMessageHeaders#PARTITION_KEY`, `AzureHeaders#PARTITION_KEY` is configured.
===== Multi Binder Support
Connection to mutiple Service Bus namespaces is also supported by using multi binders. This sample takes connection string as example. Credentials of service principals and managed identities are also supported, users can set related properties in each binder's environment settings.
===== Multiple Binder Support
Connection to multiple Service Bus namespaces is also supported by using multiple binders. This sample takes connection string as example. Credentials of service principals and managed identities are also supported, users can set related properties in each binder's environment settings.
Step 1. To use multiple binders of ServiceBus, we need to configure below properties in application.yml
[source,yaml]

Просмотреть файл

@ -2,7 +2,7 @@
== Spring JMS Support
To use Azure Service Bus by the JMS API integrated into the Spring JMS framework.
Azure Service Bus connection string have to be provided which is to be parsed into the login username, password and remote URI for the AMQP broker.
Azure Service Bus connection string has to be provided which is to be parsed into the login username, password and remote URI for the AMQP broker.
=== Dependency Setup
@ -103,7 +103,7 @@ Adding below dependencies if you want to migrate your Spring JMS application to
|===
NOTE: Spring JMS general configuration is omited for short.
Please refer to link:https://docs.spring.io/spring-framework/docs/3.2.x/spring-framework-reference/html/jms.html[Spring JMS Doc] for more details.
Please refer to link:https://docs.spring.io/spring-framework/docs/3.2.x/spring-framework-reference/html/jms.html[Spring JMS Document] for more details.
=== Basic Usage

Просмотреть файл

@ -1,6 +1,6 @@
== Spring Security Support
=== Spring Security With Azure AD
=== Spring Security With Azure Active Directory
When you are building a web application, identity and access management will always be foundational pieces.
@ -695,7 +695,7 @@ public class AadOAuth2LoginSecurityConfig extends AadWebSecurityConfigurerAdapte
Please refer to link:https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-cloud-azure_{project-version}[azure-spring-boot-samples] for more details.
=== Spring Security With Azure AD B2C
=== Spring Security With Azure Active Directory B2C
Azure Active Directory (Azure AD) B2C is an identity management service that enables you to customize and control how customers sign up, sign in, and manage their profiles when using your applications. Azure AD B2C enables these actions while protecting the identities of your customers at the same time.

Просмотреть файл

@ -1,2 +1,2 @@
This doc is only for Spring Cloud Azure: **{project-version}**. Please refer to https://github.com/Azure/azure-sdk-for-java/wiki/Spring-Versions-Mapping[Spring Versions Mapping] to get more information about supported versions.
This document is only for Spring Cloud Azure: **{project-version}**. Please refer to https://github.com/Azure/azure-sdk-for-java/wiki/Spring-Versions-Mapping[Spring Versions Mapping] to get more information about supported versions.

Просмотреть файл

@ -2,11 +2,11 @@
This page covers changes made in 4.0 since 3.10. With this major release, we aim to bring better security, leaner dependencies, support for production readiness, and more.
TIP: To learn how to migration to 4.0, please check link:appendix.html#migration-guide-for-4-0[the Appendix page].
TIP: To learn how to migrate to 4.0, please check link:appendix.html#migration-guide-for-4-0[the Appendix page].
=== Unified Development Experience
We constantly challenge ourselves on how we can make things more consistent and easier to understand, so our customers are not confronted with haphazard development choices. This is a long and self-evolving journey as consistency is relative and there will be things that are outside our control. We now humbly take another step in this direction to improve to our developer experience by unifying project name, artifact ID and properties.
We constantly challenge ourselves on how we can make things more consistent and easier to understand, so our customers are not confronted with haphazard development choices. This is a long and self-evolving journey as consistency is relative and there will be things that are outside our control. We now humbly take another step in this direction to improve our developer experience by unifying project name, artifact ID and properties.
=== Simplified Dependency Management