PROVIDER

Synopsis

HELP:   How to reach the Azure account and who we are; can come from a parameter file
TYPE:   OBJECT
SYNTAX: PROVIDER(ACCOUNT='str',ENDPOINT='str',PORT=num,CABUNDLE='str',ACCOUNTKEY='str',SASTOKEN='str',TENANTID='str',CLIENTID='str',CLIENTSECRET='str',FEDERATEDFILE='str',CERTIFICATE='str',CERTPASSWORD='str',CERTLABEL='str')

Description

Everything that is constant for one Azure Blob Storage account.

A provider answers two questions that do not change from archive to archive: how the service is reached, and who we are to it. The storage account, the endpoint, the port and the trust anchor belong to the first, the credentials to the second. What stays outside is what varies: the CONTAINER and the PREFIX name the data, and the write buffers, OVERWRITE and TIMEOUT describe the run.

The storage account belongs in the provider and not outside it: it decides the request URL and it owns the account key. The container is what varies per archive.

TIMEOUT is deliberately not part of the provider. It says how long this particular run may make no progress, which is a property of the job and not of the service.

Reading a provider from a parameter file

The command line parser reads any object from a file, so:

store.azure(PROVIDER='/etc/flam/azprod.par' CONTAINER=archive PREFIX='hr/2026')

The file holds the parameter list without the surrounding brackets:

ACCOUNT=myaccount ACCOUNTKEY='Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6...'

The secret then never appears on a command line, which is visible in the process list and in the shell history of every user on the machine, and the file can carry its own access rights. On z/OS the file may be a data set.

Which authentication method applies

The method is chosen by which parameters are present, and the store reports its choice on the open line. Unlike the S3 provider these are genuine alternatives -- exactly one of them applies:

• ACCOUNTKEY -- the storage account key, signed with Shared Key.
• SASTOKEN -- a shared access signature. The token carries its own validity and permissions, so nothing else is needed.
• TENANTID, CLIENTID and CLIENTSECRET -- a service principal that obtains a bearer token from Entra ID with the client credentials flow.
• TENANTID, CLIENTID and CERTIFICATE -- the same, but the client proves itself with a certificate and its private key, PEM or PKCS 12, instead of a secret. CERTPASSWORD is the passphrase of that file.
• TENANTID, CLIENTID and FEDERATEDFILE -- workload identity: the client assertion comes from a file that an identity provider maintains, which Entra ID trusts. No secret is stored at all.
• Nothing at all -- the managed identity of the machine FLAM runs on. Only meaningful inside an Azure instance.

CERTLABEL is reserved: it will reference a protected key instead of a certificate file, which needs FKM5, and it is not implemented yet.

Why PORT exists next to ENDPOINT

ENDPOINT is optional. Without it the endpoint is derived from the account name, and then there is no URL text to carry a port. PORT reaches the derived host on a different port, a proxy or a gateway in front of the service. When ENDPOINT is given, PORT replaces a port already in it, because it is defined as an override.

Arguments

• STRING: ACCOUNT='str' - Azure storage account name [required; env: AZURE_STORAGE_ACCOUNT]
• STRING: ENDPOINT='str' - Custom endpoint URL [default: https://ACCOUNT.blob.core.windows.net; env: FL_AZURE_ENDPOINT]
• NUMBER: PORT=num - Port override merged into the endpoint (0 = the endpoint decides) [0; env: FL_AZURE_PORT]
• STRING: CABUNDLE='str' - Trust anchor for the TLS connection: PEM file, or SAF key ring on z/OS [env: FL_CA_BUNDLE; SAF: RST.CABUNDLE]
• STRING: ACCOUNTKEY='str' - Base64-encoded storage account key [kept secret; required unless SASTOKEN is set; env: AZURE_STORAGE_KEY]
• STRING: SASTOKEN='str' - Shared Access Signature token [kept secret; alternative to ACCOUNTKEY; env: AZURE_STORAGE_SAS_TOKEN]
• STRING: TENANTID='str' - Azure AD tenant (directory) ID for OAuth2 auth [env: AZURE_TENANT_ID]
• STRING: CLIENTID='str' - Azure AD application (client) ID for OAuth2 auth [env: AZURE_CLIENT_ID]
• STRING: CLIENTSECRET='str' - Azure AD client secret for OAuth2 auth [kept secret; env: AZURE_CLIENT_SECRET]
• STRING: FEDERATEDFILE='str' - File holding the client assertion (workload identity); replaces CLIENTSECRET [env: AZURE_FEDERATED_TOKEN_FILE]
• STRING: CERTIFICATE='str' - Certificate AND private key for the service principal, PEM or PKCS 12; replaces CLIENTSECRET [env: AZURE_CLIENT_CERTIFICATE_PATH]
• STRING: CERTPASSWORD='str' - Passphrase for CERTIFICATE [kept secret; never taken from the environment]
• STRING: CERTLABEL='str' - Label to reference a protected key instead of CERTIFICATE (FKM5 required; not implemented yet)