-
Notifications
You must be signed in to change notification settings - Fork 300
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Expose SqlAuthenticationParameters on SSPIContextProvider #2454
base: main
Are you sure you want to change the base?
Conversation
4f6c051
to
80e90cd
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2454 +/- ##
==========================================
- Coverage 72.58% 66.09% -6.49%
==========================================
Files 289 282 -7
Lines 59503 59309 -194
==========================================
- Hits 43188 39199 -3989
- Misses 16315 20110 +3795
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
21a4311
to
120662f
Compare
86512cb
to
ff9a983
Compare
96b5fb5
to
2f6ddef
Compare
@mdaigle next step for sspi :) |
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs
Show resolved
Hide resolved
As part of this change, the SSPIContextProvider base class now iterates through all the server names similar to what NegotiateSSPIContextProvider did.
ping @mdaigle @cheenamalhotra |
Hey @twsouthwick, I'll try to take a look at this today! |
The errors appear to also be on main and are an "Access denied" for something related to certificates. It doesn't appear to be caused by my change, but let me know if you believe it is. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this all makes sense to me. I'll take another look tomorrow and also see why the tests are failing.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NegotiateSSPIContextProvider.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tests should be green now. We had a build agent issue that was resolved yesterday.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs
Outdated
Show resolved
Hide resolved
{ | ||
var auth = new SqlAuthenticationParameters.Builder( | ||
authenticationMethod: connection.ConnectionOptions.Authentication, | ||
resource: null, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm trying to think of the best way to populate this. In other usage, I see serverSpn getting set as the resource and dataSource getting set as the serverName. I think it makes sense to continue that pattern here given that serverName and server SPN may be different.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Line 2437 in e0fa87b
var authParamsBuilder = new SqlAuthenticationParameters.Builder( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm also not sure how to feel about authority. In federated auth, it's assumed that authority will be present, but here we don't set a value.
Let me chat with the team to see if we'd prefer to create a new type to better represent this set of credentials.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds good. I refactored the builder so that the same pattern can be had wherever it's used if we want to use the existing SqlAuthenticationParameters
e3f4879
to
e9c04ad
Compare
This change updates the SSPI context provider to surface information to implementers via SqlAuthenticationParameters.
This also expands #2559 to loop through all SPNs in the base SSPIContextProvider rather than just a specific implementation.
Part of #2253