Federated Identity Credentials + Managed Identity support
- Dominant language
- C#
- Stars
- 989
- Forks
- 340
- Avg merge
- 4d 19h
- Merged PRs (30d)
- 72
Description
### Is your feature request related to a problem? Please describe.
Currently FIC is supported by using workload identity, however it's not compatible with (or is there any existing solutions?) using manage identity directly (FIC + MSI), we need to write our own `SqlAuthenticationProvider` everywhere and overrides existing authentication method.
### Describe the solution you'd like
Add a new authentication method to support FIC + MSI.
Basically we'll need a `SqlAuthenticationProvider` that get authentication results using `ClientAssertionCredential` and `ManagedIdentityCredential`:
```cs
internal class FICAuthProvider : SqlAuthenticationProvider
{
private const string DefaultScopeSuffix = "/.default";
public override async Task AcquireTokenAsync(SqlAuthenticationParameters parameters)
{
// We can reuse existing environment variables or use new ones
var msiClientId = Environment.GetEnvironmentVariable("SOME_NEW_ENV_KEY");
var aadAppClientId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID");
var resourceTenantId = Environment.GetEnvironmentVariable("AZURE_TENANT_ID");
var assertion = new ClientAssertionCredential(
resourceTenantId,
aadAppClientId,
async (token) => await GetManagedIdentityToken(msiClientId));
var scopes = new[] { parameters.Resource.EndsWith(DefaultScopeSuffix) ? parameters.Resource : parameters.Resource + DefaultScopeSuffix };
var token = await assertion.GetTokenAsync(new TokenRequestContext(scopes));
return new SqlAuthenticationToken(token.Token, token.ExpiresOn);
static async Task GetManagedIdentityToken(string msiClientId)
{
return (await new ManagedIdentityCredential(msiClientId).GetTokenAsync(new Azure.Core.TokenRequestContext([$"api://AzureADTokenExchange/.default"])).ConfigureAwait(false)).Token;
}
}
public override bool IsSupported(SqlAuthenticationMethod authenticationMethod)
{
// Add new member for SqlAuthenticationMethod
return authenticationMethod == SqlAuthenticationMethod.FederatedIdentityCredentials;
}
}
```
### Describe alternatives you've considered
N/A
### Additional context
N/A
Contributor guide
Assessment
This issue has not been assessed yet.