Skip to content

Conversation

@funkydev
Copy link
Contributor

This change allows to use azure-active-directory-access-token authentication method when token value would be passed in the options object.

It is required to implement authenticating to the MSSQL database using Access Token.

Here is a link to the Microsoft Documentation about AD Access Token:
https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell#azure-ad-token

@funkydev
Copy link
Contributor Author

@dhensby Could you review this PR? 🙈

Copy link
Collaborator

@dhensby dhensby left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this @funkydev.

Please can we add tests for this, one to make sure the config is correctly constructed when passing a config object? It looks like we don't actually test this anywhere at the moment, which is a bit worrying...

Does msnodesqlv8 support AD access tokens? If so, the config there needs to be updated too.

I note that this doesn't seem to be possible to pass in via a connection string (https://docs.microsoft.com/en-us/sql/connect/jdbc/connecting-using-azure-active-directory-authentication?view=sql-server-ver15). Is that your understanding too?

@dhensby
Copy link
Collaborator

dhensby commented Mar 19, 2021

It appears that msnodesqlv8 does not support AD access tokens (TimelordUK/node-sqlserver-v8#83)

@funkydev
Copy link
Contributor Author

funkydev commented Mar 19, 2021

I note that this doesn't seem to be possible to pass in via a connection string (https://docs.microsoft.com/en-us/sql/connect/jdbc/connecting-using-azure-active-directory-authentication?view=sql-server-ver15). Is that your understanding too?

Exactly. Connection String does not contains any info about the access token. It's because should be generated dynamically, before the connection init, and passed as a separate parameter.

Here is a link to the interface of tedious connection config:
https://github.com/tediousjs/tedious/blob/master/src/connection.ts#L237

Please can we add tests for this, one to make sure the config is correctly constructed when passing a config object? It looks like we don't actually test this anywhere at the moment, which is a bit worrying...

I'll try to implement some unit tests for passing configurations.

@funkydev
Copy link
Contributor Author

@dhensby I cannot create unit tests for that. cfg constant is defined in _poolCreate scope, and there is no public access to that. I'm worried that only kind of integration tests could help, and there is no configuration for AD.

      const cfg = {
        server: this.config.server,
        options: Object.assign({
          encrypt: typeof this.config.encrypt === 'boolean' ? this.config.encrypt : true,
          trustServerCertificate: typeof this.config.trustServerCertificate === 'boolean' ? this.config.trustServerCertificate : false
        }, this.config.options),
        authentication: Object.assign({
          type: (
            (this.config.token !== undefined && 'azure-active-directory-access-token') ||
            (this.config.domain !== undefined && 'ntlm') ||
            'default'
          ),
          options: {
            userName: this.config.user,
            password: this.config.password,
            domain: this.config.domain,
            token: this.config.token
          }
        }, this.config.authentication)
      }

Anyway, I can see that the library accepts authentication parameter in the config model, so I guess that this PR isn't necessary to implement different authentication types for tedious. As I understood it correctly, it would be fine to pass something like this as the connection options:

const connectionPool = new ConnectionPoool({
  // ... other settings
  authentication: {
    type: 'azure-active-directory-access-token',
    options: {
      token: 'automatically-generated-token'
    }
  }
})

@dhensby
Copy link
Collaborator

dhensby commented Mar 19, 2021

@funkydev - that's right, you can pass your own authentication object; so maybe we don't need this? But perhaps an update to the docs as an example of adding "custom auth" would be good?

@funkydev
Copy link
Contributor Author

@dhensby So I'm closing current PR, and creating new one: #1209 for documentation update.

@funkydev funkydev closed this Mar 19, 2021
@funkydev funkydev deleted the feature/azure-active-directory-access-token-support branch March 19, 2021 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants