Tedious does not support Active Directory Integrated Authentication

[funkydev]

Tedious does not support Active Directory Integrated Authentication.

It supports only azure-active-directory-password type, but what about azure-active-directory-integrated method? Is there any chance to implement that feature? Or is it implemented yet and there is no documentation, or I missed something?

Here is Microsoft documentation for the authentication implemented in C#
https://docs.microsoft.com/en-us/azure/sql-database/active-directory-interactive-connect-azure-sql-db

EDIT:
#416 is about Azure Active Directory Password Authentication, but I would like to have Azure Active Directory Integrated Authentication.

[MichaelSun90]

Hi @funkydev, unfortunately, that tedious currently not support azure-active-directory-integrated authentication, but we do have the plan to work on it. This feature is definitely on the road map.

[funkydev]

I have noticed that, but I found the workaround using azure-active-directory-access-token authentication. Anyway, access tokens granted by Azure have an expiration time, and no one should use that in the production environment.

In my workaround, I have used ms-rest-azure node dependency. It provides credentials from Azure Active Directory and allows to get the token. The code looks like:

const MsRestAzure = require('ms-rest-azure');

// way for Azure Managed Identity (azure-active-directory-integrated)
let databaseCredentials = await MsRestAzure
  .loginWithAppServiceMSI({
    resource: 'https://database.windows.net/'
  });

// way for Azure Service Principal
let databaseCredentials = await MsRestAzure
  .loginWithServicePrincipalSecret(clientId, clientSecret, tenantId, {
    tokenAudience: 'https://database.windows.net/'
  });

// getting access token
let databaseAccessToken = await (new Promise((resolve, reject) => {
    databaseCredentials.getToken((err, results) => {
      if (err) return reject(err);
      resolve(results.accessToken);
    });
  }));

and now I pass tedious authentication config like:

authentication: {
  type: 'azure-active-directory-access-token',
  options: {
    token: databaseAccessToken
  }
}

Suggestion:
So, in my opinion, you should consider implementing ms-rest-azure credentials authentication, which automatically renews the access token if needed. So the main idea is to add authentication type like ms-rest-azure-credentials which accepts credentials in options (which conforms to ApplicationTokenCredentials). In this way, you can use access token authentication which you have implemented yet.

The whole config from the developer side will looks like:

authentication: {
  type: 'ms-rest-azure-credentials',
  options: {
    credentials: databaseCredentials
  }
}

I am eager to help if you need.

[MichaelSun90]

Hi @funkydev, from what you provided here, if I understand this correctly, you are trying to use ms-rest-azure to achieve MSI authentication. On our side, we are currently working a feature to naively supported MSI authentication inside tedious. The PR #896 is in the review process, so it should be out soon.

[funkydev]

You're right, I'm trying to use ms-rest-azure to achieve MSI authentication, and I want to use both authentications: azure-active-directory-integrated and using Service Principal way.

I have browsed PR #896, and I don't understand why are you trying to write whole connection from basics? Azure shares ms-rest-azure library, which supports many types of authentication, like:

• loginWithUsernamePassword()
• loginWithServicePrincipalSecret()
• loginWithAppServiceMSI()

And many more... The whole stuff has been done by the Azure Team.
So maybe you should consider using that library as sub-dependency to support Azure any authentication and provide a way for passing configuration through your wrapper.

It looks really strange if you have hardcoded IPs or clientIds in source code.