Azure Blob Storage Authentication Enhancement (SAS Token AAD Support)

Details

Detail name Value
Changelog Number 28710
Type New Feature
Status Resolved
Fix Versions Exasol 2026.1.0
Resolution Date 2026-05-15

Background

Currently, Azure Blob Storage integration in Exasol supports Account Key authentication for IMPORT and EXPORT operations. While this method provides full access to storage resources, it relies on long-lived credentials, which are increasingly restricted in enterprise environments due to security concerns.

Modern cloud security practices favor:

  • Temporary, scoped access using SAS Tokens
  • Identity-based authentication using Azure Active Directory (AAD / Entra ID)

Many organizations enforce policies that:

  • discourage or disable Account Key usage
  • require integration with centralized identity systems (AAD)
  • mandate least-privilege and time-bound access

As a result, the current limitation to Account Key authentication creates:

  • barriers for enterprise adoption
  • operational workarounds (e.g., credential sharing, external data movement)
  • misalignment with Azure-native security practices

New Feature

This enhancement introduces a unified Azure authentication framework with extended capabilities across all supported data formats (Parquet, CSV, FBV).

1. Support for SAS Token Authentication

  • Enables temporary, permission-scoped access to Azure Blob Storage
  • Supports:
  • Removes dependency on long-lived Account Keys
  • SAS Token permissions are fully managed by the client and not validated by the system
  • fine-grained permissions (read/write/list/create)
  • resource-level access (container/file)
  • time-bound access via expiration

Example 

import into t2 from parquet at cloud azure blobstorage
'DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net'
user 'myaccount'
sas token 'mysastoken'
file 'container/file.parquet';

2. Support for Azure Active Directory (AAD / Entra ID) Authentication

  • Enables identity-based authentication using service principals
  • Supports:
  • Uses Azure SDKs to securely generate and manage access tokens
  • Supports enterprise RBAC (Role-Based Access Control)
  • Tenant ID
  • Client ID
  • Client Secret

Example 

import into t2 from parquet at cloud azure blobstorage
'DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net'
user 'myaccount'
identified by 'myclientsecret'
client id 'myclientid'
tenant id 'mytenantid'
file 'container/file.parquet';

3. Unified Authentication Model

  • Introduces a shared authentication mechanism across:
  • Ensures:
  • Parquet
  • CSV
  • FBV
  • consistent behavior
  • reduced duplication
  • easier extensibility for future formats

4. SQL Syntax Enhancements

  • Introduces new syntax elements:
  • Maintains compatibility with existing syntax for Account Key authentication
  • Supports flexible configuration of authentication parameters
  • sas token for SAS authentication
  • client id, tenant id, and identified by for AAD authentication

5. Connection Object Support

  • Allows authentication credentials to be defined via Connection objects
  • Supports:
  • Provides secure storage and reuse of authentication parameters
  • Inline SQL parameters can override connection object values
  • creation of connections with credentials
  • modification of existing credentials

Example 

CREATE CONNECTION azure_conn TO
'DefaultEndpointsProtocol=https;EndpointSuffix=core.windows.net'
USER 'myaccount'
IDENTIFIED BY 'myaccountkey';

IMPORT INTO t2 FROM parquet AT cloud azure blobstorage
CONNECTION azure_conn
FILE 'container/file.parquet';

6. Flexible Account Name Configuration

  • The Storage Account Name can be provided via:
  • user parameter takes precedence if both are provided
  • Internally normalized into a single representation
  • user parameter, or
  • connection string (AccountName)

Example (AccountName in connection string) 

import into t2 from parquet at cloud azure blobstorage
'DefaultEndpointsProtocol=https;AccountName=myaccount;EndpointSuffix=core.windows.net'
identified by 'myaccountkey'
file 'container/file.parquet';

7. Strong Validation and Precedence Rules

  • Ensures:
  • Enforces precedence:
  • exactly one authentication method per request
  • valid parameter combinations
  • inline SQL over Connection object
  • user over connection string

8. Security Enhancements

  • Sensitive credentials (sas token, identified by, tenant id) are:
  • Secure handling across:
  • The SAS token should not be included in the URL (connection string). Instead, it must be specified within the SQL statement using the syntax: SAS TOKEN '<SAS Token>'.
  • The account key should not be included in the URL (connection string). Instead, it must be specified in the SQL statement using the syntax: IDENTIFIED BY '<Account Key>'.
  • Aligns with secure design principles and OWASP guidelines
  • masked in logs and audit tables
  • never exposed in error messages
  • SQL execution
  • runtime processing
  • connection storage

9. Container Handling Behavior

  • Import operations require existing containers
  • Export operations:
  • Behavior depends on:
  • may create containers if permissions allow
  • authentication method
  • permission scope

10. Backward Compatibility

  • Existing Account Key authentication remains unchanged
  • No impact on:
  • New functionality is introduced as an additive enhancement
  • existing queries
  • existing workflows

11. Known Limitations

  • No pre-validation of permission scope for SAS Token and AAD Authentication
  • Behavior depends on Azure runtime responses