Open kkloss-od opened 1 year ago
My only hypothesis for this behavior is that calling Impersonate
on the identity object is entering impersonation within .NET Framework (or another AppDomain or something), because it's being done from PowerShell, but sqlpackage is retrieving its identity from .NET Core (or another AppDomain or something).
Applying your hypothesis, if you run the .NET Framework SqlPackage (from the DacFx msi), does it leverage the identity impersonation you're applying from powershell?
One example of installing the msi during a pipeline run: https://learn.microsoft.com/sql/tools/sqlpackage/sqlpackage-pipelines?view=sql-server-ver16#azure-pipelines-2
wget -O DacFramework.msi "https://aka.ms/dacfx-msi"
msiexec.exe /i "DacFramework.msi" /qn
sqlpackage is installed to: C:\Program Files\Microsoft SQL Server\160\DAC\bin\
We try not to install versioned tools like SqlPackage directly on the deploy agents, but I did check the opposite case and reproduced the same behavior running it within WindowsIdentity.RunImpersonated
in PowerShell Core 7.
I have a scenario where a CD pipeline needs to launch PowerShell as a service user, impersonate another service user which has privileges on a remote SQL Server, and use sqlpackage to publish a DACPAC to that server. sqlpackage doesn't appear to actually use the impersonated user when establishing the connection.
Steps to Reproduce:
advapi32
functionsLogonUser
andDuplicateToken
to create a login token with the Delegation impersonation levelSystem.Security.Principal.WindowsIdentity
object with the impersonation tokenSystem.Security.Principal.WindowsIdentity::GetCurrent()
from PowerShell shows the user being impersonatedIntegrated Security=true;TrustServerCertificate=true;Trusted_Connection=yes
in the connection stringExpected: sqlpackage connects using the impersonated user, because it uses the identity from
GetCurrent()
Actual: sqlpackage connects as the original user running PowerShell:Did this occur in prior versions? If not - which version(s) did it work in? I don't believe this is a regression
(SqlPackage)