Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature | Azure Active Directory Managed Identity authentication support #730

Merged
merged 27 commits into from Oct 8, 2020

Conversation

cheenamalhotra
Copy link
Member

@cheenamalhotra cheenamalhotra commented Sep 18, 2020

Fixes #616

Introduces AAD Managed Identity support with below authentication mode keywords:

  • Active Directory Managed Identity
  • Active Directory MSI (for cross MS SQL drivers compatibility)

Connection strings applicable:

// For System Assigned Managed Identity
"Server:{serverURL}; Authentication=Active Directory MSI; Initial Catalog={db};"

// For System Assigned Managed Identity
"Server:{serverURL}; Authentication=Active Directory Managed Identity; Initial Catalog={db};"

// For User Assigned Managed Identity
"Server:{serverURL}; Authentication=Active Directory MSI; User Id={ObjectIdOfManagedIdentity}; Initial Catalog={db};"

// For User Assigned Managed Identity
"Server:{serverURL}; Authentication=Active Directory Managed Identity; User Id={ObjectIdOfManagedIdentity}; Initial Catalog={db};"

Dev Notes:
No new dependency is added to driver.
This feature is supported with direct Rest API calls to IMDS and Identity endpoints (as MSSQL JDBC driver)

Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http

@cheenamalhotra cheenamalhotra added this to In progress in SqlClient v2.1 via automation Sep 18, 2020
@cheenamalhotra cheenamalhotra added this to the 2.1.0-preview2 milestone Sep 18, 2020
@cheenamalhotra cheenamalhotra added the 🆕 Public API Use this label for new API additions to the driver. label Sep 18, 2020
Copy link
Contributor

@David-Engel David-Engel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We also need to provide an synonym "ActiveDirectoryMSI" for the authentication keyword value to align the connection string with what all our other drivers use. The other drivers will eventually add a synonym for "ActiveDirectoryManagedIdentity".

@cheenamalhotra cheenamalhotra force-pushed the azure-managed-identity branch 2 times, most recently from 3a135ab to 0b30779 Compare September 22, 2020 00:30
@ericsampson
Copy link

@cheenamalhotra I'd also love Azure.Identity support for seamless localdev.

Once this PR is in, what is the recommended way to connect in localdev using the VS/CLI token stores?

@cheenamalhotra
Copy link
Member Author

@ericsampson

You would be able to override our implementation of "Active Directory Managed Identity" authentication provider with your own class that implements "SqlAuthenticationProvider" and register it in your application by calling "SetProvider" API.

There you can simply acquire token from Azure.Identity library when implementing "AcquireTokenAsync", using "DefaultAzureCredential" as they support .NET Core and .NET Framework 4.6.1+ and their "GetToken" API does the following, as you can find documented:

The following credential types if enabled will be tried, in order:

  • EnvironmentCredential
  • ManagedIdentityCredential
  • SharedTokenCacheCredential
  • VisualStudioCredential
  • VisualStudioCodeCredential
  • AzureCliCredential
  • InteractiveBrowserCredential

Once you call SetProvider, all future connection requests for "Active Directory Managed Identity" authentication mode from driver will go through your implementation using same connection strings.

@cheenamalhotra cheenamalhotra merged commit 0d4c9bb into dotnet:master Oct 8, 2020
SqlClient v2.1 automation moved this from Reviewer approved to Done Oct 8, 2020
@ericsampson
Copy link

@cheenamalhotra thanks for the notes, that seems doable.

Is there an existing "Extensions" NuGet package that it would be possible to put something like that code in, where it would be OK to have the Identity library dependency?
I was just thinking that if so, I could make a PR so that everyone could take advantage of the functionally.

@chamikasandamal
Copy link

Is this available now with 3.x or 5.x?

@ErikEJ
Copy link
Contributor

ErikEJ commented Jun 4, 2021

There is no version 5 of this provider.

This feature is available in 3.0 preview, which will RTM quite soon, and this version work with both .nEt Core 3 and .Net 5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🆕 Public API Use this label for new API additions to the driver.
Projects
No open projects
Development

Successfully merging this pull request may close these issues.

Azure Managed Identity Support
8 participants