Summary

Fix NullPointerException when performing server-side blob copy operations using Managed Identity with the azureblob-sdk provider. See also issue #939.

Problem

When AzureBlobStore is configured with Managed Identity, the copyBlob method fails with:

java.lang.NullPointerException: The argument must not be null or an empty string. Argument name: storageSharedKeyCredentials.
    at com.azure.storage.common.implementation.StorageImplUtils.assertNotNull(StorageImplUtils.java:174)
    at com.azure.storage.blob.implementation.util.BlobSasImplUtil.generateSas(BlobSasImplUtil.java:167)
    at com.azure.storage.blob.specialized.BlobClientBase.generateSas(BlobClientBase.java:2454)
    at org.gaul.s3proxy.azureblob.AzureBlobStore.copyBlob(AzureBlobStore.java:461)

The root cause is that BlobClientBase.generateSas() requires StorageSharedKeyCredential internally. When the BlobServiceClient is constructed with DefaultAzureCredential (for Managed Identity), no shared key is available, causing the NullPointerException.

Solution

The Azure SDK provides an alternative for OAuth-based authentication: User Delegation SAS. This approach:

1. Obtains a UserDelegationKey from BlobServiceClient.getUserDelegationKey()
2. Uses BlobClientBase.generateUserDelegationSas() instead of generateSas()

The fix detects whether shared key credentials are available:

• If yes → use existing generateSas() (unchanged behavior)
• If no (Managed Identity) → use generateUserDelegationSas() with a user delegation key

Requirements

When using Managed Identity, the identity must have the RBAC permission:

• Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

This permission is included in built-in roles:

• Storage Blob Data Contributor
• Storage Blob Data Owner
• Storage Blob Delegator

Validation

@hermandavid could you validate the change? e.g. by building a custom image. I can support you with that. Would be cool if we can validate this before merging it to master.