.NET Core - Create SqlConnection with AccessToken

Question

My understanding is that in order to implement Azure AD Managed Service Identity access to a SQL Database in Azure, I would need to create a SqlConnection with a retrieved token.

To add that token to the SqlConnection, .NET 4.6+ has an AccessToken property to do this. .NET Core 2.0 does not.

Is there any way around this?

Implementing Azure AD Managed Service Identity in a core app doesn't seem possible at this point unless I am misunderstanding.

score 3 · Answer 1 · edited May 27 '19 at 13:01

3

As of SqlClient package 4.6.0, SqlConnection now supports AccessToken for SqlClient of .NET Core 2.2.

https://www.nuget.org/packages/System.Data.SqlClient/

edited May 27 '19 at 13:01

Jan_V

4,244
1
40
64

answered Oct 23 '18 at 00:06

divega

6,320
1
31
31

2

Are there any samples available of this? I've been searching all day. Want to use it in dotnet core app hosted in Azure. I'm successfully getting a token but it keeps failing with the `System.Data.SqlClient.SqlException (0x80131904): Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.` error – Stephan Jul 22 '19 at 15:31

score 2 · Answer 2 · answered Jan 31 '18 at 16:58

2

A workaround would be to store the connection string in Azure Key Vault and then implement MSI to retrieve it from Key Vault.

answered Jan 31 '18 at 16:58

Arturo Lucatero - MSFT

291
1
9

1

Yes that is exactly what we already do. But, we don't like it. – KickinMhl Feb 01 '18 at 17:38
Note that this won't work everywhere, as not all Azure resources support MSIs - such as Azure Batch nodes – Cocowalla Oct 03 '18 at 09:26

score 0 · Answer 3 · answered Jun 22 '20 at 17:08

Its now June 2020 and .NET 5.0 preview 4 is being used. But still no support for AccessToken based connection to SqlConnection in Blazor Asp.NET Core.

Connection Strings section in Azure SQL Database says to use "User ID" in the connection string with Authentication="Active Directory Interactive" But in .NET EF Core we get error that User Id cannot be set with AD Integrated or AD Interactive. The other way is to use Azure Vault.

We prefer to use dynamic user id (from AAD displayable ID) in the connection string and AccessToken. Will this be supported before .NET 5 final release?

score 0 · Answer 4 · answered Aug 21 '21 at 23:29

To access Sql using managed identity, you need to use .NET Framework 4.6 or higher or .NET Core 2.2 or higher.

You can find full tutorial here:

For .NET 4.6 or higher Tutorial: Secure Azure SQL Database connection from App Service using a managed identity
For .Net Core 2.2 or higher Tutorial: Secure Azure SQL Database connection from App Service using a managed identity

.NET Core - Create SqlConnection with AccessToken

4 Answers4