[Synapse Serverless] SqlPackage Extract is not adding the database scoped credential secret to the generated deployment script
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 460
- Forks
- 29
- Avg merge
- 4d 9h
- Merged PRs (30d)
- 7
Description
- SqlPackage or DacFx Version: 161.8089.0
- .NET Framework (Windows-only) or .NET Core: .NET Framework
- Environment (local platform and source/target platforms): Synapse SQL Serverless
**Steps to Reproduce:**
1. Make sure you have a database scoped credential **using Shared Access Signature identity and a secret** in your Synapse Serverles SQL pool. In case you don't, you can create this as a sample credential:
CREATE DATABASE SCOPED CREDENTIAL [mycred]
WITH IDENTITY = N'SHARED ACCESS SIGNATURE', SECRET = N'$238746ewfhgsdjkfhsdkjfh';
2. From the command line, make sure you run the SqlPackage using v161.8089.0, as this is the version that added support for serverless SQL pools in Extract and Publish operations.
3. run the SqlPackage using the EXTRACT action, selecting your Synapse SQL Serverless endpoint and sql pool (used in the 1st step) .
4. Once the extract is finished, unpack the generated dacpac file to a local folder
5. From that folder, open the sql model file and then search for "SCOPED CREDENTIAL"
6. You will see that the CREATE DATABASE SCOPED CREDENTIAL statement is not including the SECRET argument. When deployed to the target database, all objects that depend on this credential will fail to authenticate against the external location.
This screenshot below is an example of a sql model that was generated without the secret information

**Did this occur in prior versions? If not - which version(s) did it work in?**
(DacFx/SqlPackage)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the SqlPackage EXTRACT action for a Synapse SQL Serverless endpoint and inspect how the generated dacpac SQL model represents database scoped credentials. Reproduce the issue with a Shared Access Signature credential, then verify that the generated CREATE DATABASE SCOPED CREDENTIAL statement includes the SECRET argument and that dependent external objects can authenticate after deployment.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, sql
- Domain
- cloud, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100