Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Support secretless credential options (workload identity federation / certificates) for OBO authentication

Abierto
#3,641 3 comentarios 2 reacciones 1 asignado Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

auth mcp-server

Summary

DAB SQL MCP OBO currently only supports client secrets (DAB_OBO_CLIENT_SECRET + WithClientSecret(...)) for building the MSAL confidential client used in the On-Behalf-Of flow. Please add support for secretless credential options such as workload identity federation (FIC), client certificates, or client assertions.

Context

We are validating SQL MCP hosting inside a managed Connector Gateway / ADC sandbox environment. We tested DAB 2.0.1-rc over HTTP MCP and confirmed the basic OBO flow works end-to-end (describe_entities, read_records both succeed).

The current OBO flow:

  1. DAB reads the user token from Authorization: Bearer <user token>
  2. Uses MSAL.NET AcquireTokenOnBehalfOf(...) to exchange it for an Azure SQL scope token (https://database.windows.net/.default)
  3. Sets the token on SqlConnection.AccessToken

This requires three environment variables today:

  • DAB_OBO_CLIENT_ID
  • DAB_OBO_TENANT_ID
  • DAB_OBO_CLIENT_SECRET

Problem

In our managed hosting scenario, the sandbox environment is fully abstracted from the customer. Storing customer app secrets in sandbox/container configuration is problematic because:

  1. SFI (Secure Future Initiative) compliance — Using secrets for Entra Apps is blocked on most Microsoft tenants and requires multiple levels of exception processes.
  2. Security posture — Long-lived client secrets in container configuration are difficult or unacceptable for many tenants.

OBO still requires the middle-tier app to authenticate as a confidential client, but the credential ideally should not need to be a long-lived client secret.

Requested Credential Options

Support one or more of the following in addition to client secret:

  • Workload identity federation (Federated Identity Credentials / FIC)
  • Client certificate (WithCertificate(...))
  • Client assertion (WithClientAssertion(...))

References

Lenguaje dominante
C#
Estrellas
1.5k
Forks
372
Merge medio
7 d 19 h
PR fusionados (30 d)
10

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Azure/data-api-builder

Todos los issues de Azure/data-api-builder

Issues similares

Más issues de C#

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.