microsoft / go-sqlcmd

The new sqlcmd, CLI for SQL Server and Azure SQL (winget install sqlcmd / sqlcmd create mssql / sqlcmd open ads)
https://learn.microsoft.com/sql/tools/sqlcmd/go-sqlcmd-utility
MIT License
334 stars 58 forks source link

Require --password-encryption for add-user #293

Closed stuartpa closed 1 year ago

stuartpa commented 1 year ago

Require user supply --password-encryption none | dpapi | etc. flag when doing sqlcmd config add-user (which could be used for a remote endpoint), and optionally supply it for sqlcmd create (in this case it is always local, so in the same trust boundary)

This is a breaking change if any user of go-sqlcmd has previously used boolean --encrypt-password flag (which has been removed in this PR), and set it to true (but I am not aware of any usage of this flag so far). If any user does hit this breaking change, the fix is simple: Change the line in your sqlconfig password-encrypted: true to password-encryption: dpapi

(the error the user will get in ADS (when running sqlcmd open ads) if this happens is: The value's length for key 'Password' exceeds its limit of '128'.

I have manually tested that this change works where a sqlconfig file was created with an old go-sqlcmd, for the normal case, where the user has just run sqlcmd create mssql, in this case there is temporary code to cope with the missing "password-encryption: none".

e.g.

sqlcmd config add-user --username sa --password-encryption none

or

sqlcmd config add-user --username sa --password-encryption dpapi sqlcmd config add-user --username sa --password-encryption keychain etc.

Change the sqlconfig file from:

users:

to:

users:

or

users:

etc.

shueybubbles commented 1 year ago

the content of this Pr doesn't match the description

stuartpa commented 1 year ago

the content of this Pr doesn't match the description

I'm working on it! :-) (It's still in "draft" state, but thanks for the feedback so far)