Enable passwordless authentication for Entra ID - Githubissues

joergjo / contosoads-containerapp

Contoso Ads Azure Container Apps demo application

MIT License

7 stars 3 forks source link

Enable passwordless authentication for Entra ID #10

Closed joergjo closed 9 months ago

joergjo commented 9 months ago

Npgsql 7.0 has added the capability to register a callback that fetches credentials such OAuth2 tokens: https://www.npgsql.org/doc/security.html?tabs=tabid-1#auth-token-rotation-and-dynamic-password. This makes it possible to use Entra ID based authentication instead of PostgreSQL's native logins and passwords.

This change will only apply to the main/.NET 8 branch, as .NET 7 will be out of support by May 2024

Switch to DbDataSource based connection creation
Implement UsePeriodicPasswordProvider using Azure Identity
Add configuration to explicitly enable Entra ID and provide the client ID of a user assigned managed identity.
Use the existing contosoads-web managed identity to access the PostgreSQL server when running on Azure.
Make sure that the database migration job also uses a managed identity.