Repository navigation
FEAT: Entra id authentication support for AQE - #870
Subrata (subrata-ms) wants to merge 3 commits into
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
PR Performance Report✅ No regression detectedNo consistent slowdowns detected across all 2 environments. 0 IMPROVEMENTS 0 SLOWDOWNS 2/2 ENVIRONMENTS Coverage: 2 of 2 environments completed. Advisory result; does not block merging. Performance diagnosticsPhase times are inclusive diagnostics and must not be added together. They identify where measured time changed, not why it changed. No affected phases or call-count changes were recorded. All database tasks and timingsUnix / SQL Server 2022
Unix / SQL Server 2025
Build and measurement detailsPR head:
A consistent change requires more than 20% median paired movement, at least 1 ms between the median runtimes, and at least 80% of pairs exceeding the relative threshold in the same direction. A slowdown without enough pair agreement is reported as inconsistent. The displayed change is the median of paired before-and-after ratios. It is not recalculated from the two displayed median runtimes. Both revisions use profiling-enabled builds on the same agent and database, with alternating order and discarded warmups. Results are diagnostic and do not represent production-wheel latency. Raw samples and logs are attached to the ADO run as |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔵 Needs a closer look
Entra authentication depends on native Rust handshake and callback behavior that could not be runtime-validated with the pinned extension and a live Entra-enabled SQL endpoint.
No open issues 🎉
What changed in this PR
Adds Microsoft Entra ID authentication to the Rust-backed async connection layer, supporting built-in Azure Identity credentials and custom synchronous token providers.
Changes:
- Adds credential caching, off-loop token acquisition, and service-principal callback setup.
- Extends async connection options and validation, documenting authentication modes and limitations.
- Adds tests for authentication flows, error handling, cancellation, credential reuse, and native integration.
| File | Description |
|---|---|
tests/AsyncTest/test_008_async_entraid_auth.py |
Adds async Entra authentication and integration coverage. |
tests/AsyncTest/test_002_async_connection.py |
Updates context validation expectations to accept Entra authentication. |
mssql_python/async_query/async_connection.py |
Adds token_provider and prepares authentication before native login. |
mssql_python/async_query/_connection_context.py |
Allows supported Entra modes through connection validation. |
mssql_python/async_query/_auth.py |
Implements credential caching, token acquisition, and service-principal setup. |
Review effort: Balanced
Subrata (subrata-ms)
changed the title
📊 Code Coverage Report
Diff CoverageDiff: main...HEAD, staged and unstaged changes
Summary
📋 Files Needing Attention📉 Files with overall lowest coverage (click to expand)mssql_python.pybind.performance_counter.hpp: 0.7%
mssql_python.pybind.logger_bridge.cpp: 57.9%
mssql_python.pybind.ddbc_bindings.h: 62.6%
mssql_python.pybind.logger_bridge.hpp: 70.8%
mssql_python.pybind.connection.connection_pool.cpp: 81.3%
mssql_python.pybind.connection.connection.cpp: 84.1%
mssql_python.logging.py: 86.2%
mssql_python.pooling.py: 90.1%
mssql_python.pybind.fetch_temporal.hpp: 92.1%
mssql_python.cursor.py: 92.5%🔗 Quick Links
|
Subrata (subrata-ms)
changed the title
There was a problem hiding this comment.
🔵 Needs a closer look
The native authentication implementation is unavailable, and existing mocks cannot establish Entra SQL handshake success, callback threading, or cancellation behavior without live validation.
No open issues 🎉
Review effort: Balanced
Work Item / Issue Reference
Summary
This pull request introduces Entra (Azure Active Directory) authentication support for asynchronous connections in the
mssql_pythonpackage. It adds a new authentication helper, updates the async connection logic to handle various Entra authentication modes and token providers, and improves validation and error handling for authentication options. The tests have also been updated to reflect the new authentication flow.Entra Authentication Support and Async Connection Updates:
mssql_python/async_query/_auth.pythat provides Entra authentication helpers, credential caching, and async token acquisition for async connections. It supports built-in Azure Identity credentials and custom token providers, with careful handling of multi-user scenarios.mssql_python/async_query/async_connection.pyto:token_providerparameter for supplying a custom token provider.prepare_async_authenticationfunction to handle authentication and token acquisition before establishing a connection.connectmethod's docstring to explain Entra authentication modes, token provider usage, and limitations. [1] [2] [3] [4]Authentication Validation Improvements:
mssql_python/async_query/_connection_context.pyto accept supported Entra authentication modes and provide clearer error messages for unsupported modes. [1] [2]Testing Updates:
tests/AsyncTest/test_002_async_connection.pyto check that Entra authentication modes are accepted in the connection context without immediately acquiring a token, reflecting the new authentication flow.