Use DistributedSqlServerCache with an MSI in Azure SQL Db and remove credentials from Connection String

Question

question

StevenBitaxi asked Mar 15, '21 StevenBitaxi commented Mar 23, '21

Use DistributedSqlServerCache with an MSI in Azure SQL Db and remove credentials from Connection String

Good morning all, does anyone have an example implementation using MSI authentication for an Azure SQL Db used as a token cache?
I'm trying to get the credentials out of the connection string and use a token but there doesn't seem to be a place to pass it in:

         services.AddMicrosoftIdentityWebAppAuthentication(Configuration)
             .EnableTokenAcquisitionToCallDownstreamApi(new[] { "https://database.windows.net//.default" })
             .AddDistributedTokenCaches();

         services.AddDistributedSqlServerCache(options =>
         {
             options.ConnectionString = 
                 Configuration.GetConnectionString("MyDbConnection");
             options.SchemaName = "dbo";
             options.TableName = "App_Token_Cache";
             options.DefaultSlidingExpiration = TimeSpan.FromMinutes(90);
         });

Do I need to create my own Cache service to accomplish this?

azure-sql-database azure-webapps-authentication

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NavtejSaini-MSFT · Mar 17, 2021 at 05:57 PM

@StevenBitaxi We are checking this and will get back to you.

Regards
Navtej S

0 ·

MarileeTurscak-MSFT NavtejSaini-MSFT · Mar 18, 2021 at 09:46 PM

This is the documentation that I'm aware of. https://techcommunity.microsoft.com/t5/azure-database-support-blog/using-managed-service-identity-msi-to-authenticate-on-azure-sql/ba-p/1288248

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql

There is also a related thread on this topic.

0 ·

Answer 1 · 2021-03-19T13:57:41.68Z

StevenBitaxi answered Mar 19, '21 StevenBitaxi commented Mar 23, '21

Thank you very much Marilee. The AAD configuration and permissions are in place. A user of the 425Show forum advised me that I needed to use the correct connection string.

According to https://docs.microsoft.com/en-us/sql/connect/ado-net/sql/azure-active-directory-authentication?view=sql-server-ver15#using-active-directory-managed-identity-authentication the service will get the token. I don't need to handle it in the application.

 "Server=AZURESQLSERVER.database.windows.net,1433;Database=AZURE_DB;Authentication=Active Directory MSI;"

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

NavtejSaini-MSFT · Mar 20, 2021 at 02:42 AM

@StevenBitaxi Can you confirm the issue is resolved for you?

0 ·

StevenBitaxi NavtejSaini-MSFT · Mar 23, 2021 at 02:23 PM

Yes, thank you. As per the answer I posted, this issue is solved.

0 ·

question