Skip to content

Updated value of anon to be False#540

Merged
kyleknap merged 11 commits intofsspec:mainfrom
anjaliratnam-msft:update-anon-default
Apr 8, 2026
Merged

Updated value of anon to be False#540
kyleknap merged 11 commits intofsspec:mainfrom
anjaliratnam-msft:update-anon-default

Conversation

@anjaliratnam-msft
Copy link
Copy Markdown
Collaborator

We are updating the default value of anon to be False which means that anonymous authentication will not be used unless anon=True is explicitly passed in when instantiating AzureBlobFileSystem. DefaultAzureCredentials will now become the default authentication method. This resolves #348.

Copy link
Copy Markdown
Collaborator

@kyleknap kyleknap left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! I just had some smaller feedback.

Copy link
Copy Markdown
Collaborator

@nateprewitt nateprewitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few thoughts/nits but this looks good overall! I think it's important we make it clearer how to get back to the old behavior since users may not be invoking adlfs directly.

Copy link
Copy Markdown
Collaborator

@kyleknap kyleknap left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking good. I just had some smaller follow up comments/suggestions.

@anjaliratnam-msft
Copy link
Copy Markdown
Collaborator Author

For the edge case of adding the SAS token to the account host, I tried it and it gives a ClientAuthenticationError, so I don't think it will be an issue.

@kyleknap
Copy link
Copy Markdown
Collaborator

kyleknap commented Apr 8, 2026

@anjaliratnam-msft I tried adding the SAS token as a query string to account_host as well. I was getting auth errors but that was because the default credentials were getting injected as well and ends up with conflicting auth. When setting it to anon=True, it made the auth work correctly and ended up using the SAS token in the URL.

Looking more into this, while it seems possible that SAS token could be provided to the account_host, I don't think it makes sense to add logic to not inject a default credential for this usage. The intention of the account_host is to provide an escape hatch if <account-name>.blob.core.windows.net is not the host you want to use; it is not intended for full account URLs that can include auth like the SDK supports. This is especially true given there is already a designated sas_token parameter.

If setting anon=True or moving the SAS token to the proper sas_token parameter does not suffice as a workaround, we can consider adding explicit support even though it would require parsing the URL's query string to attempt to detect whether there is a SAS token present, which could be brittle as well.

Copy link
Copy Markdown
Collaborator

@kyleknap kyleknap left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me! Thanks for all of the hard work here! 🚢

@kyleknap kyleknap merged commit 9da1566 into fsspec:main Apr 8, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Make DefaultAzureCredential as default credential method instead of anonymous access?

3 participants