I'm using Azure Container Registry for private Docker images. I want to let around 500 customers pull images and use the Docker V2 HTTP API to read metadata.
Service Principals are one way to go about this. My plan is to create a single Service Principal, and grant it the AcrPull
role on the Azure Container Registry. I'd then create a time-limited password credential for each customer.
The customer flow would be something like:
Authenticate using the Service Principal client secret, to get an Azure AD Access Token
Hit the Azure Container Registry OAuth token endpoint, swapping the AAD Access Token for an ACR Access Token and Refresh Token
You can now use docker login
using the ACR Refresh Token as the password
You can also access the ACR HTTP API using the ACR token
These steps are not carried out manually, but by automatic scripts running on customer's servers.
After much research (Microsoft's docs here are not great), this approach seems to work as expected.
Is using a Service Principal the "idiomatic" way to approach this? Are there any benefits to creating an individual Service Principal for each customer?