search

microsoft / azuredatastudio

Azure Data Studio is a data management and development tool with connectivity to popular cloud and on-premises databases. Azure Data Studio supports Windows, macOS, and Linux, with immediate capability to connect to Azure SQL and SQL Server. Browse the extension library for more database support options including MySQL, PostgreSQL, and MongoDB.
https://learn.microsoft.com/sql/azure-data-studio
MIT License
7.59k stars 908 forks source link

Privileged identity management (PIM) and ADS do not play well #25640

Open shahiddev opened 6 months ago

shahiddev commented 6 months ago

Type: Bug

Hi, We use Entra Privileged Identity Management (PIM) to allow our team to be added to groups that have elevated privs on our SQL DBs in a JIT manner.

When a user is granted access via PIM their new permissions are not reflected in ADS unless they first clear the token cache, restart ADS and then re-sync their account.

Up until version 1.43 all we had to do was to remove and re-add the Azure account in ADS. All versions since 1.43 this process has not longer worked and needs the explicitly token cache clearing and restarting ADS which is not ideal This issue is related to one I reported a long time ago that was closed

This is an issue with the way the token's are being cached - I'm unclear as to what changed since 1.43 that has broken the previous behaviour - potentially the switch related MSAL ?

Azure Data Studio version: azuredatastudio 1.48.0 (4970733324ef8254b7c22a5dc55af7f8a1dea93f, 2024-02-27T00:05:08.293Z) OS version: Windows_NT x64 10.0.22621 Restricted Mode: No Preview Features: Enabled Modes:

rgrace-puck commented 4 months ago

Experiencing this too. The query editor in the Azure Portal sees updated privileges but Azure Data Studio still hangs onto old credentials somewhere.