-
Notifications
You must be signed in to change notification settings - Fork 305
Expose SspiAuthenticationParameters on SspiContextProvider #2454
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
base: main
Are you sure you want to change the base?
Conversation
4f6c051
to
80e90cd
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2454 +/- ##
==========================================
- Coverage 65.08% 59.50% -5.58%
==========================================
Files 298 293 -5
Lines 65535 65245 -290
==========================================
- Hits 42651 38825 -3826
- Misses 22884 26420 +3536
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
21a4311
to
120662f
Compare
86512cb
to
ff9a983
Compare
96b5fb5
to
2f6ddef
Compare
@mdaigle next step for sspi :) |
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs
Outdated
Show resolved
Hide resolved
As part of this change, the SSPIContextProvider base class now iterates through all the server names similar to what NegotiateSSPIContextProvider did.
ping @mdaigle @cheenamalhotra |
Hey @twsouthwick, I'll try to take a look at this today! |
The errors appear to also be on main and are an "Access denied" for something related to certificates. It doesn't appear to be caused by my change, but let me know if you believe it is. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this all makes sense to me. I'll take another look tomorrow and also see why the tests are failing.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NegotiateSSPIContextProvider.cs
Outdated
Show resolved
Hide resolved
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tests should be green now. We had a build agent issue that was resolved yesterday.
src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs
Outdated
Show resolved
Hide resolved
{ | ||
var auth = new SqlAuthenticationParameters.Builder( | ||
authenticationMethod: connection.ConnectionOptions.Authentication, | ||
resource: null, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm trying to think of the best way to populate this. In other usage, I see serverSpn getting set as the resource and dataSource getting set as the serverName. I think it makes sense to continue that pattern here given that serverName and server SPN may be different.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Line 2437 in e0fa87b
var authParamsBuilder = new SqlAuthenticationParameters.Builder( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm also not sure how to feel about authority. In federated auth, it's assumed that authority will be present, but here we don't set a value.
Let me chat with the team to see if we'd prefer to create a new type to better represent this set of credentials.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds good. I refactored the builder so that the same pattern can be had wherever it's used if we want to use the existing SqlAuthenticationParameters
e3f4879
to
e9c04ad
Compare
This change updates the SSPI context provider to surface information to implementers via SqlAuthenticationParameters.
This also expands #2559 to loop through all SPNs in the base SSPIContextProvider rather than just a specific implementation.
Part of #2253