auth

var ConfigOptions = []fs.Option{{
	Name: "account",
	Help: `Azure Storage Account Name.

Set this to the Azure Storage Account Name in use.

Leave blank to use SAS URL or Emulator, otherwise it needs to be set.

If this is blank and if env_auth is set it will be read from the
environment variable ` + "`AZURE_STORAGE_ACCOUNT_NAME`" + ` if possible.
`,
	Sensitive: true,
}, {
	Name: "env_auth",
	Help: `Read credentials from runtime (environment variables, CLI or MSI).

See the [authentication docs](/azureblob#authentication) for full info.`,
	Default: false,
}, {
	Name: "key",
	Help: `Storage Account Shared Key.

Leave blank to use SAS URL or Emulator.`,
	Sensitive: true,
}, {
	Name: "sas_url",
	Help: `SAS URL for container level access only.

Leave blank if using account/key or Emulator.`,
	Sensitive: true,
}, {
	Name: "connection_string",
	Help: `Storage Connection String.

Connection string for the storage. Leave blank if using other auth methods.
`,
	Sensitive: true,
}, {
	Name: "tenant",
	Help: `ID of the service principal's tenant. Also called its directory ID.

Set this if using
- Service principal with client secret
- Service principal with certificate
- User with username and password
`,
	Sensitive: true,
}, {
	Name: "client_id",
	Help: `The ID of the client in use.

Set this if using
- Service principal with client secret
- Service principal with certificate
- User with username and password
`,
	Sensitive: true,
}, {
	Name: "client_secret",
	Help: `One of the service principal's client secrets

Set this if using
- Service principal with client secret
`,
	Sensitive: true,
}, {
	Name: "client_certificate_path",
	Help: `Path to a PEM or PKCS12 certificate file including the private key.

Set this if using
- Service principal with certificate
`,
}, {
	Name: "client_certificate_password",
	Help: `Password for the certificate file (optional).

Optionally set this if using
- Service principal with certificate

And the certificate has a password.
`,
	IsPassword: true,
}, {
	Name: "client_send_certificate_chain",
	Help: `Send the certificate chain when using certificate auth.

Specifies whether an authentication request will include an x5c header
to support subject name / issuer based authentication. When set to
true, authentication requests include the x5c header.

Optionally set this if using
- Service principal with certificate
`,
	Default:  false,
	Advanced: true,
}, {
	Name: "username",
	Help: `User name (usually an email address)

Set this if using
- User with username and password
`,
	Advanced:  true,
	Sensitive: true,
}, {
	Name: "password",
	Help: `The user's password

Set this if using
- User with username and password
`,
	IsPassword: true,
	Advanced:   true,
}, {
	Name: "service_principal_file",
	Help: `Path to file containing credentials for use with a service principal.

Leave blank normally. Needed only if you want to use a service principal instead of interactive login.

    $ az ad sp create-for-rbac --name "<name>" \
      --role "Storage Blob Data Owner" \
      --scopes "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/blobServices/default/containers/<container>" \
      > azure-principal.json

See ["Create an Azure service principal"](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) and ["Assign an Azure role for access to blob data"](https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli) pages for more details.

It may be more convenient to put the credentials directly into the
rclone config file under the ` + "`client_id`, `tenant` and `client_secret`" + `
keys instead of setting ` + "`service_principal_file`" + `.
`,
	Advanced: true,
}, {
	Name: "disable_instance_discovery",
	Help: `Skip requesting Microsoft Entra instance metadata

This should be set true only by applications authenticating in
disconnected clouds, or private clouds such as Azure Stack.

It determines whether rclone requests Microsoft Entra instance
metadata from ` + "`https://login.microsoft.com/`" + ` before
authenticating.

Setting this to true will skip this request, making you responsible
for ensuring the configured authority is valid and trustworthy.
`,
	Default:  false,
	Advanced: true,
}, {
	Name: "use_msi",
	Help: `Use a managed service identity to authenticate (only works in Azure).

When true, use a [managed service identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/)
to authenticate to Azure Storage instead of a SAS token or account key.

If the VM(SS) on which this program is running has a system-assigned identity, it will
be used by default. If the resource has no system-assigned but exactly one user-assigned identity,
the user-assigned identity will be used by default. If the resource has multiple user-assigned
identities, the identity to use must be explicitly specified using exactly one of the msi_object_id,
msi_client_id, or msi_mi_res_id parameters.`,
	Default:  false,
	Advanced: true,
}, {
	Name:      "msi_object_id",
	Help:      "Object ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_client_id or msi_mi_res_id specified.",
	Advanced:  true,
	Sensitive: true,
}, {
	Name:      "msi_client_id",
	Help:      "Object ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_object_id or msi_mi_res_id specified.",
	Advanced:  true,
	Sensitive: true,
}, {
	Name:      "msi_mi_res_id",
	Help:      "Azure resource ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_client_id or msi_object_id specified.",
	Advanced:  true,
	Sensitive: true,
}, {
	Name:     "use_emulator",
	Help:     "Uses local storage emulator if provided as 'true'.\n\nLeave blank if using real azure storage endpoint.",
	Default:  false,
	Advanced: true,
}, {
	Name: "use_az",
	Help: `Use Azure CLI tool az for authentication

Set to use the [Azure CLI tool az](https://learn.microsoft.com/en-us/cli/azure/)
as the sole means of authentication.

Setting this can be useful if you wish to use the az CLI on a host with
a System Managed Identity that you do not want to use.

Don't set env_auth at the same time.
`,
	Default:  false,
	Advanced: true,
}, {
	Name:     "endpoint",
	Help:     "Endpoint for the service.\n\nLeave blank normally.",
	Advanced: true,
}}