dotnet / dotnet/SqlClient

Error authenticating to Azure SQL with second User-Assigned Managed Identity

Open
#2,155 5 comments 1 reaction 0 assignees View on GitHub
Area\Azure Connectivity Repro Available :heavy_check_mark:
Dominant language
C#
Stars
989
Forks
340
Avg merge
4d 18h
Merged PRs (30d)
69

Description

Filing this issue here for @squarerigger so that it doesn't get lost. Originally filed at https://github.com/MicrosoftDocs/sql-docs/issues/9303.

### Describe the bug
Starting from the code sample at [Connect to Azure SQL with Azure AD authentication and SqlClient - ADO.NET Provider for SQL Server](https://learn.microsoft.com/en-us/sql/connect/ado-net/sql/azure-active-directory-authentication?view=sql-server-ver16):

The article is almost right (Using Active Directory Managed Identity authentication). However, using the recommended code 'as is' in an environment slightly different than the author's and using two AD entities instead of one in an Azure function app (one for the first step involving a Service Bus, another for more restrictive Azure SQL database access) leads to an inner error and task cancellation when trying to perform the second step (Azure SQL authentication). I have tried six close alternatives using Microsoft docs, with the same inner error exception.

The recommended code fails (each a small variation)
conn = new SqlConnection("Server=.database.windows.net; Database=; Authentication=Active Directory Default; Encrypt=True; User Id=");
conn = new SqlConnection("Server=.database.windows.net,1433; Database=; Authentication=Active Directory Default; Encrypt=True; User Id=");
conn = new SqlConnection("Server=tcp:.database.windows.net; Database=; Authentication=Active Directory Default; Encrypt=True; User Id=");
conn = new SqlConnection("Server=tcp:.database.windows.net,1433; Database=; Authentication=Active Directory Default; Encrypt=True; User Id=");
conn = new SqlConnection("Server=tcp:.database.windows.net,1433; Database=; Authentication=Active Directory Default; Encrypt=True; User Id=; TrustServerCertificate=True");

Bottom line --- the Azure Default credential is failing to switch over to the new Client ID that is provided in the connection string. Perhaps the ID of the first AD user has been cached and is being used instead of the newly provided id.

### Expected behavior
No error. Successful connection.

### Further technical details
My environment: a non-domain-connected network (a standalone workstation) using Visual Studio with one Active Directory account logged in, using an Azure function app, succeeding in accessing the Service Bus with the initial AD account, then trying to open Azure SQL database using a different, User-Assigned managed identity. (Both AD accounts have the required setup in Azure - as evidenced by success when I forced the AD ClientID to be used in the code that follows.)
Azure.Identity 1.9.0
Microsoft.Data.SqlClient 5.1.1
Azure.Core 1.32.0
Microsoft.Identity.Client 4.49.1
Microsoft.Identity.Client.Extensions.Msai 2.25.3
Microsoft.IdentityModel.Abstractions 6.24.0
Microsoft.IdentityModel.Protocols 6.24.0
Microsoft.IdentityModel.Protocols.Openidconnect 6.24.0
Microsoft.IdentityModel.Tokens 6.24.0
System.IdentityModel.Tokens.Jwt 6.24.0

This article provided code that works: https://techcommunity.microsoft.com/t5/apps-on-azure-blog/connect-app-service-with-azure-sql-database-with-managed/ba-p/3288300

```
string userAssignedClientId = ""; //Give Client ID of User Managed Identity
var conn = new SqlConnection(connectionString);
var credential = new Azure.Identity.DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId });
var token = credential.GetToken(new Azure.Core.TokenRequestContext(new[] { "https://database.windows.net/.default"}));
conn.AccessToken = token.Token;
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.