I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata.
Service Principals are one way to go about this. My plan is to create a single Service Principal, and grant it the
AcrPull role on the Azure Container Registry. I'd then create a time-limited password credential for each customer.
The customer flow would be something like:
- Authenticate using the Service Principal client secret, to get an Azure AD Access Token
- Hit the Azure Container Registry OAuth token endpoint, swapping the AAD Access Token for an ACR Access Token and Refresh Token
- You can now use
docker loginusing the ACR Refresh Token as the password
- You can also access the ACR HTTP API using the ACR token
These steps are not carried out manually, but by automatic scripts running on customer's servers.
After much research (Microsoft's docs here are not great), this approach seems to work as expected.
Is using a Service Principal the "idiomatic" way to approach this? Are there any benefits to creating an individual Service Principal for each customer?