Integrating data access among disparate platforms over a cloud storage scheme
A method, computer system, and computer program product are provided for integrating access to multiple cloud storage sources from different applications. A storage account is joined to a local domain. The storage account is registered with a directory service in the local domain. A first service accesses the storage account by using a domain credential for accessing the local domain. A second service accesses the storage account by using a directory service credential to the directory service. The first service and the second service may concurrently access the storage account.
1. A method comprising:
joining a storage account to a local domain;
registering the storage account with a directory service in the local domain;
accessing the storage account by a first service using a domain credential for accessing the local domain; and
accessing the storage account by a second service using a directory service credential to the directory service,
wherein the first service and the second service concurrently access the storage account.
2. The method of claim 1 , wherein joining the storage account to the local domain further comprises:
configuring the storage account to communicate with the directory service.
3. The method of claim 1 , wherein registering the storage account with the directory service further comprises:
creating a service account within the directory service that has been granted one or more permissions to the storage account.
4. The method of claim 1 , wherein the storage account is an Azure Storage account.
5. The method of claim 1 , wherein accessing the storage account by the first service further comprises:
authenticating the first service with the local domain using a Kerberos protocol.
6. The method of claim 1 , wherein accessing the storage account by the first service further comprises:
accessing the storage account via a Server Message Block driver over a Server Message Block protocol connection.
7. The method of claim 1 , wherein the first service is running on a virtual machine within the local domain.
8. The method of claim 1 , wherein the second service is a cloud-native service running in a containerized environment.
9. The method of claim 1 , wherein accessing the storage account by the second service further comprises:
obtaining, by the second service, a security token from Azure Active Directory; and
presenting, by the second service, the security token to access the storage account.
10. The method of claim 1 , wherein the directory service credential used by the second service is a managed identity that is not joined to the local domain.
11. The method of claim 1 , wherein accessing the storage account by the second service further comprises:
accessing the storage account via a container Storage Interface driver over a Hypertext Transfer Protocol Secure connection.
12. The method of claim 1 , wherein the concurrent access by the first service and the second service further comprises:
coordinating concurrent access by a concurrency management mechanism within the storage account.
13. A system comprising:
a computer processor; and
a non-transitory computer readable storage medium storing program code, which when executed by the computer processor, performs a plurality of operations comprising:
joining a storage account to a local domain;
registering the storage account with a directory service in the local domain;
accessing the storage account by a first service using a domain credential for accessing the local domain; and
accessing the storage account by a second service using a directory service credential to the directory service,
wherein the first service and the second service concurrently access the storage account.
14. The system of claim 13 , wherein joining the storage account to the local domain further comprises:
configuring the storage account to communicate with an Active Directory Domain Services instance; and
wherein registering the storage account with the directory service further comprises:
creating a service account within the directory service that has been granted one or more permissions to the storage account.
15. The system of claim 13 , wherein accessing the storage account by the first service further comprises:
authenticating the first service with the local domain using a Kerberos authentication protocol; and
accessing the storage account via a Server Message Block driver over a Server Message Block protocol connection.
16. The system of claim 13 , wherein the first service is running on a virtual machine within the local domain.
17. The system of claim 13 , wherein the second service is a cloud-native service running in a containerized environment.
18. The system of claim 13 , wherein accessing the storage account by the second service further comprises:
obtaining, by the second service, a security token from Azure directory service via an OAuth authentication; and
presenting, by the second service, the security token to access the storage account.
19. The system of claim 13 , wherein the directory service credential used by the second service is a managed identity that is not joined to the local domain; and
wherein accessing the storage account by the second service further comprises:
accessing the storage account via a container Storage Interface driver over a Hypertext Transfer Protocol Secure connection.
20. A computer program product comprising a non-transitory computer readable storage medium storing program code, which when executed by a computer processor, performs a plurality of operations comprising:
joining a storage account to a local domain;
registering the storage account with a directory service in the local domain
accessing the storage account by a first service using a domain credential for accessing the local domain; and
accessing the storage account by a second service using a directory service credential to the directory service,
wherein the first service and the second service concurrently access the storage account.