Skip to content

[QUESTION] AKS workload identity integration - how to put access token #2058

@gennadiy-dubina

Description

@gennadiy-dubina

Question

We are switching to using managed identity to access SQL.
Our service is spring boot 3 app and it's hosted in AKS.
So we have configured workload identity and user managed identity in azure. Managed idenityt is added as sql user according to tutorial.
But in our setup we don't want to use any sidecar container to handle ActiveDirectoryMSI.

I have extended HikariDataSource and overrid getPassword to retrive access token via ManagedIdentityCredential
Now i can get token but we don't know how to put it to driver correctly
By default hikari puts it as password to driver properties and it does not work.
I have changed this behaviour and put token as accessToken to driver properties. Also it requires to remove Authentication=ActiveDirectoryMSI from jdbc url to avoid driver embeded handler

@Override
public Connection getConnection(final String username, final String password) throws SQLException {
	final var cloned = (Properties) driverProperties.clone();
	cloned.put("accessToken", password);
	return driver.connect(jdbcUrl, cloned);
}

but i'm not sure it will work correctly. Could you advise?
now i'm getting errro Login failed for user '<token-identified principal>'. Incorrect or invalid token.
Also what scope should i use to retrive access token? now i use https://database.windows.net/.default

P.S. looks like you have already extended driver to provide token but i can not find any release with these changes - #1940

Thanks,

Metadata

Metadata

Assignees

No one assigned

    Labels

    EnhancementAn enhancement to the driver. Lower priority than bugs.QuestionUsed when a question is asked, as opposed to an issue being raised

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions