databricks / databricks-sql-nodejs

Databricks SQL Connector for Node.js
Apache License 2.0
24 stars 34 forks source link

Does this library support Azure Managed Service Identities for authentication? #165

Closed mccolljr closed 7 months ago

mccolljr commented 1 year ago

My team is attempting to use this library to implement a service providing aggregated views of time series data out of Databricks. We want to associate each instance of this application with a single tenant via a service account with limited permissions, so our initial inclination is to use Azure Managed Service Identities.

The official documentation here (https://learn.microsoft.com/en-us/azure/databricks/dev-tools/nodejs-sql-driver#requirements) seems to indicate that the only supported authentication mechanism is Databricks Personal Access Tokens, but some issues and PRs here seem to indicate otherwise.

So, my question is, does the latest public release support authentication using Azure Managed Service Identities? If not, is there a way to work around this?

kravets-levko commented 1 year ago

Hi @mccolljr! Sorry for delay, I needed to talk to my collegues first to be able to answer your question. Currently library supports only Databricks PAT auth method and OAuth user-to-machine (this one is currently being added to docs). So I think the answer to your question is probably - no, we currently don't support Managed Identities. As a workaround I can only suggest to implement your own auth provider and supply it to client.connect like this:

client.connect({
  host,
  path,
  authType: 'custom',
  provider: yourCustomAuthProvider,
})

If you end up implementing custom auth provider - use built-in providers as an example. Also, if you think that it may be useful for others - feel free to submit a pull request

mccolljr commented 1 year ago

@kravets-levko thank you for the detailed reply, this is exactly the information I was hoping to get. I took a look at the linked code, and it seems like it would be relatively straightforward for my team to create a custom authentication mechanism wrapping the MSAL library to enable use of Azure Active Directory tokens. If we are able to get this working in a way that meets our needs I will definitely share that code via a PR!

kravets-levko commented 1 year ago

Thank you @mccolljr! I'll keep this issue open for now - if any questions feel free to ask here