Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Active Directory MSI Authentication support #838

Merged
merged 27 commits into from
Dec 25, 2018
Merged
Show file tree
Hide file tree
Changes from 25 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
538468a
Feature: Active Directory MSI Authentication Support
cheenamalhotra Oct 18, 2018
b5b3934
Remove Debug Logs
cheenamalhotra Oct 18, 2018
d01293d
Add support for User Assigned Managed Identity
cheenamalhotra Oct 19, 2018
af076a5
Merge branch 'ms-dev' into msi-support
cheenamalhotra Oct 19, 2018
bd5d7f9
Add Resource Description
cheenamalhotra Oct 19, 2018
39605ae
Add checks for exception cases.
cheenamalhotra Oct 19, 2018
810c8a8
Remove HostNameInCertificate fix for separate tracking
cheenamalhotra Oct 19, 2018
8ae6eb0
Fetch and store Expiry time with tokens
Oct 23, 2018
f84542a
Merge branch 'ms-dev' into msi-support
Oct 29, 2018
bc021b6
Changes to add back Refresh Token logic (with improvements)
Oct 31, 2018
9ba3643
Add support for Azure App Service and Functions
cheenamalhotra Nov 20, 2018
3b8cb9b
Merge branch 'ms-dev' into msi-support
cheenamalhotra Nov 20, 2018
5841982
Minor Fix in PooledConnection
cheenamalhotra Nov 22, 2018
ec2309b
Merge branch 'ms-dev' into msi-support
cheenamalhotra Nov 22, 2018
5c04311
Fix PooledConnection refresh token logic
cheenamalhotra Nov 23, 2018
eb8b54a
Revert to original design
cheenamalhotra Nov 26, 2018
86721e9
Merge branch 'ms-dev' into msi-support
cheenamalhotra Dec 11, 2018
459ced8
Fix PooledConnection
cheenamalhotra Dec 12, 2018
7297bde
Change MSI Object ID to Client ID
cheenamalhotra Dec 17, 2018
4371e88
Use Internal needsReconnect()
cheenamalhotra Dec 18, 2018
053ca0d
Remove unwanted code
cheenamalhotra Dec 18, 2018
ec379ff
Update APIs to MSIClientId
cheenamalhotra Dec 18, 2018
7bbf6f0
Fix numerous trimming calls
cheenamalhotra Dec 18, 2018
50f17e9
Add Retry logic for MSI Rest API call on VM
cheenamalhotra Dec 18, 2018
7887831
Reflect comments
cheenamalhotra Dec 21, 2018
47844c6
Updated Error Messages
cheenamalhotra Dec 22, 2018
0271ea2
Error message updates
cheenamalhotra Dec 24, 2018
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,6 @@ static boolean isDllLoaded() {
enabled = true;
} catch (UnsatisfiedLinkError e) {
temp = e;
authLogger.warning("Failed to load the sqljdbc_auth.dll cause : " + e.getMessage());
// This is not re-thrown on purpose - the constructor will terminate the properly with the appropriate error
// string
} finally {
Expand Down
1 change: 1 addition & 0 deletions src/main/java/com/microsoft/sqlserver/jdbc/IOBuffer.java
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ final class TDS {
static final int TDS_FEDAUTH_LIBRARY_RESERVED = 0x7F;
static final byte ADALWORKFLOW_ACTIVEDIRECTORYPASSWORD = 0x01;
static final byte ADALWORKFLOW_ACTIVEDIRECTORYINTEGRATED = 0x02;
static final byte ADALWORKFLOW_ACTIVEDIRECTORYMSI = 0x03;
static final byte FEDAUTH_INFO_ID_STSURL = 0x01; // FedAuthInfoData is token endpoint URL from which to acquire fed
// auth token
static final byte FEDAUTH_INFO_ID_SPN = 0x02; // FedAuthInfoData is the SPN to use for acquiring fed auth token
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -805,4 +805,19 @@ public interface ISQLServerDataSource extends javax.sql.CommonDataSource {
* indicates whether Bulk Copy API should be used for Batch Insert operations.
*/
public void setUseBulkCopyForBatchInsert(boolean useBulkCopyForBatchInsert);

/**
* Sets the client id to be used to retrieve access token from MSI EndPoint.
*
* @param msiClientId
* Client ID of User Assigned Managed Identity
*/
public void setMSIClientId(String msiClientId);

/**
* Returns the value for the connection property 'msiClientId'.
*
* @return msiClientId property value
*/
public String getMSIClientId();
}
Original file line number Diff line number Diff line change
Expand Up @@ -37,25 +37,26 @@ static SqlFedAuthToken getSqlFedAuthToken(SqlFedAuthInfo fedAuthInfo, String use
ActiveDirectoryAuthentication.JDBC_FEDAUTH_CLIENT_ID, user, password, null);

AuthenticationResult authenticationResult = future.get();
SqlFedAuthToken fedAuthToken = new SqlFedAuthToken(authenticationResult.getAccessToken(),
authenticationResult.getExpiresOnDate());

return fedAuthToken;
return new SqlFedAuthToken(authenticationResult.getAccessToken(), authenticationResult.getExpiresOnDate());
} catch (MalformedURLException | InterruptedException e) {
throw new SQLServerException(e.getMessage(), e);
} catch (ExecutionException e) {
MessageFormat form = new MessageFormat(SQLServerException.getErrString("R_ADALExecution"));
Object[] msgArgs = {user, authenticationString};

// the cause error message uses \\n\\r which does not give correct format
// change it to \r\n to provide correct format
/*
* the cause error message uses \\n\\r which does not give correct format change it to \r\n to provide
* correct format
*/
String correctedErrorMessage = e.getCause().getMessage().replaceAll("\\\\r\\\\n", "\r\n");
AuthenticationException correctedAuthenticationException = new AuthenticationException(
correctedErrorMessage);

// SQLServerException is caused by ExecutionException, which is caused by
// AuthenticationException
// to match the exception tree before error message correction
/*
* SQLServerException is caused by ExecutionException, which is caused by AuthenticationException to match
* the exception tree before error message correction
*/
ExecutionException correctedExecutionException = new ExecutionException(correctedAuthenticationException);

throw new SQLServerException(form.format(msgArgs), null, 0, correctedExecutionException);
Expand All @@ -69,8 +70,10 @@ static SqlFedAuthToken getSqlFedAuthTokenIntegrated(SqlFedAuthInfo fedAuthInfo,
ExecutorService executorService = Executors.newFixedThreadPool(1);

try {
// principal name does not matter, what matters is the realm name
// it gets the username in principal_name@realm_name format
/*
* principal name does not matter, what matters is the realm name it gets the username in
* principal_name@realm_name format
*/
KerberosPrincipal kerberosPrincipal = new KerberosPrincipal("username");
String username = kerberosPrincipal.getName();

Expand All @@ -83,10 +86,8 @@ static SqlFedAuthToken getSqlFedAuthTokenIntegrated(SqlFedAuthInfo fedAuthInfo,
ActiveDirectoryAuthentication.JDBC_FEDAUTH_CLIENT_ID, username, null, null);

AuthenticationResult authenticationResult = future.get();
SqlFedAuthToken fedAuthToken = new SqlFedAuthToken(authenticationResult.getAccessToken(),
authenticationResult.getExpiresOnDate());

return fedAuthToken;
return new SqlFedAuthToken(authenticationResult.getAccessToken(), authenticationResult.getExpiresOnDate());
} catch (InterruptedException | IOException e) {
throw new SQLServerException(e.getMessage(), e);
} catch (ExecutionException e) {
Expand All @@ -97,15 +98,18 @@ static SqlFedAuthToken getSqlFedAuthTokenIntegrated(SqlFedAuthInfo fedAuthInfo,
// the case when Future's outcome has no AuthenticationResult but exception
throw new SQLServerException(form.format(msgArgs), null);
} else {
// the cause error message uses \\n\\r which does not give correct format
// change it to \r\n to provide correct format
/*
* the cause error message uses \\n\\r which does not give correct format change it to \r\n to provide
* correct format
*/
String correctedErrorMessage = e.getCause().getMessage().replaceAll("\\\\r\\\\n", "\r\n");
AuthenticationException correctedAuthenticationException = new AuthenticationException(
correctedErrorMessage);

// SQLServerException is caused by ExecutionException, which is caused by
// AuthenticationException
// to match the exception tree before error message correction
/*
* SQLServerException is caused by ExecutionException, which is caused by AuthenticationException to
* match the exception tree before error message correction
*/
ExecutionException correctedExecutionException = new ExecutionException(
correctedAuthenticationException);

Expand Down
Loading