dotnet / dotnet/SqlClient

Federated Identity Credentials + Managed Identity support

Open
#2,556 6 comments 1 reaction 0 assignees View on GitHub
Up-for-Grabs :raised_hands:
Dominant language
C#
Stars
989
Forks
340
Avg merge
4d 19h
Merged PRs (30d)
72

Description

### Is your feature request related to a problem? Please describe.
Currently FIC is supported by using workload identity, however it's not compatible with (or is there any existing solutions?) using manage identity directly (FIC + MSI), we need to write our own `SqlAuthenticationProvider` everywhere and overrides existing authentication method.

### Describe the solution you'd like
Add a new authentication method to support FIC + MSI.
Basically we'll need a `SqlAuthenticationProvider` that get authentication results using `ClientAssertionCredential` and `ManagedIdentityCredential`:

```cs
internal class FICAuthProvider : SqlAuthenticationProvider
{
private const string DefaultScopeSuffix = "/.default";

public override async Task AcquireTokenAsync(SqlAuthenticationParameters parameters)
{
// We can reuse existing environment variables or use new ones
var msiClientId = Environment.GetEnvironmentVariable("SOME_NEW_ENV_KEY");
var aadAppClientId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID");
var resourceTenantId = Environment.GetEnvironmentVariable("AZURE_TENANT_ID");

var assertion = new ClientAssertionCredential(
resourceTenantId,
aadAppClientId,
async (token) => await GetManagedIdentityToken(msiClientId));

var scopes = new[] { parameters.Resource.EndsWith(DefaultScopeSuffix) ? parameters.Resource : parameters.Resource + DefaultScopeSuffix };

var token = await assertion.GetTokenAsync(new TokenRequestContext(scopes));
return new SqlAuthenticationToken(token.Token, token.ExpiresOn);

static async Task GetManagedIdentityToken(string msiClientId)
{
return (await new ManagedIdentityCredential(msiClientId).GetTokenAsync(new Azure.Core.TokenRequestContext([$"api://AzureADTokenExchange/.default"])).ConfigureAwait(false)).Token;
}
}

public override bool IsSupported(SqlAuthenticationMethod authenticationMethod)
{
// Add new member for SqlAuthenticationMethod
return authenticationMethod == SqlAuthenticationMethod.FederatedIdentityCredentials;
}
}
```

### Describe alternatives you've considered
N/A

### Additional context
N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.