influxdata / influxdata/telegraf
SQL Server Input plugin - support for Azure Service Principals
- Dominant language
- Go
- Stars
- 17.8k
- Forks
- 5.8k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 161
Description
## Feature Request
Add support for Azure Service Principal logins to sqlserver input plugin.
### Proposal:
Add the possibility to use Azure Service Principals as authentication method for Azure SQL databases.
### Current behavior:
Currently DB internal logins and users and Azure Managed Identities are supported. The documentation does not say anything about support for Service Principals. The login with a Service Principal fails.
The Go library used for access (https://github.com/denisenkom/go-mssqldb#azure-active-directory-authentication) says SPs are supported but the required fedauth parameter seems to be not understood or ignored by Telegraf.
### Desired behavior:
Login for Azure Service Principals should be supported.
### Use case:
Telegraf is not running in Azure but shall monitor a Azure SQL database where database internal logins are not allowed. In this case the use of a Service Principal is the only choice.
Another use case would be Telegraf running in a Kubernetes Cluster where each VM would require the/a Managed Identity. For each of those machines a separate user would need to be created in the database (according to the docs) which is quite inconvenient.
Contributor guide
Research direction
Inspect the SQL Server input plugin's authentication path and compare its handling of the fedauth parameter with the go-mssqldb Azure Active Directory authentication documentation. Reproduce a login using an Azure Service Principal and verify that the plugin can connect to an Azure SQL database with this authentication method.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- authentication, cloud, database
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100