Skip to content

Commit 85f4ea1

Browse files
cheenamalhotracheenamalhotra
authored
Deprecate Active Directory Password authentication method (#3671)
1 parent 58985ca commit 85f4ea1

File tree

12 files changed

+37
-2
lines changed

12 files changed

+37
-2
lines changed

‎src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ public enum SqlAuthenticationMethod
212212
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/SqlPassword/*'/>
213213
SqlPassword = 1,
214214
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/ActiveDirectoryPassword/*'/>
215+
[System.Obsolete("ActiveDirectoryPassword is deprecated, use a more secure authentication method. See https://aka.ms/SqlClientEntraIDAuthentication for more details.")]
215216
ActiveDirectoryPassword = 2,
216217
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/ActiveDirectoryIntegrated/*'/>
217218
ActiveDirectoryIntegrated = 3,

‎src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SqlInternalConnectionTds.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1363,7 +1363,9 @@ private void Login(ServerInfo server, TimeoutTimer timeout, string newPassword,
13631363
// If the workflow being used is Active Directory Authentication and server's prelogin response
13641364
// for FEDAUTHREQUIRED option indicates Federated Authentication is required, we have to insert FedAuth Feature Extension
13651365
// in Login7, indicating the intent to use Active Directory Authentication for SQL Server.
1366+
#pragma warning disable 0618 // Type or member is obsolete
13661367
if (ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryPassword
1368+
#pragma warning restore 0618 // Type or member is obsolete
13671369
|| ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryInteractive
13681370
|| ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryDeviceCodeFlow
13691371
|| ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryServicePrincipal
@@ -2579,7 +2581,9 @@ internal SqlFedAuthToken GetFedAuthToken(SqlFedAuthInfo fedAuthInfo)
25792581
_activeDirectoryAuthTimeoutRetryHelper.CachedToken = _fedAuthToken;
25802582
}
25812583
break;
2584+
#pragma warning disable 0618 // Type or member is obsolete
25822585
case SqlAuthenticationMethod.ActiveDirectoryPassword:
2586+
#pragma warning restore 0618 // Type or member is obsolete
25832587
case SqlAuthenticationMethod.ActiveDirectoryServicePrincipal:
25842588
if (_activeDirectoryAuthTimeoutRetryHelper.State == ActiveDirectoryAuthenticationTimeoutRetryState.Retrying)
25852589
{

‎src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ public enum SqlAuthenticationMethod
130130
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/SqlPassword/*'/>
131131
SqlPassword = 1,
132132
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/ActiveDirectoryPassword/*'/>
133+
[System.ObsoleteAttribute("ActiveDirectoryPassword is deprecated, use a more secure authentication method. See https://aka.ms/SqlClientEntraIDAuthentication for more details.")]
133134
ActiveDirectoryPassword = 2,
134135
/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/ActiveDirectoryIntegrated/*'/>
135136
ActiveDirectoryIntegrated = 3,

‎src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlInternalConnectionTds.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1371,7 +1371,9 @@ private void Login(ServerInfo server, TimeoutTimer timeout, string newPassword,
13711371
// If the workflow being used is Active Directory Authentication and server's prelogin response
13721372
// for FEDAUTHREQUIRED option indicates Federated Authentication is required, we have to insert FedAuth Feature Extension
13731373
// in Login7, indicating the intent to use Active Directory Authentication for SQL Server.
1374+
#pragma warning disable 0618 // Type or member is obsolete
13741375
if (ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryPassword
1376+
#pragma warning restore 0618 // Type or member is obsolete
13751377
|| ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryInteractive
13761378
|| ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryDeviceCodeFlow
13771379
|| ConnectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryServicePrincipal
@@ -1786,7 +1788,9 @@ private bool ShouldDisableTnir(SqlConnectionString connectionOptions)
17861788
Boolean isAzureEndPoint = ADP.IsAzureSqlServerEndpoint(connectionOptions.DataSource);
17871789

17881790
Boolean isFedAuthEnabled = this._accessTokenInBytes != null ||
1791+
#pragma warning disable 0618 // Type or member is obsolete
17891792
connectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryPassword ||
1793+
#pragma warning restore 0618 // Type or member is obsolete
17901794
connectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryIntegrated ||
17911795
connectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryInteractive ||
17921796
connectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryServicePrincipal ||
@@ -2622,7 +2626,9 @@ internal SqlFedAuthToken GetFedAuthToken(SqlFedAuthInfo fedAuthInfo)
26222626
_activeDirectoryAuthTimeoutRetryHelper.CachedToken = _fedAuthToken;
26232627
}
26242628
break;
2629+
#pragma warning disable 0618 // Type or member is obsolete
26252630
case SqlAuthenticationMethod.ActiveDirectoryPassword:
2631+
#pragma warning restore 0618 // Type or member is obsolete
26262632
case SqlAuthenticationMethod.ActiveDirectoryServicePrincipal:
26272633
if (_activeDirectoryAuthTimeoutRetryHelper.State == ActiveDirectoryAuthenticationTimeoutRetryState.Retrying)
26282634
{

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ActiveDirectoryAuthenticationProvider.cs‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,9 @@ public static void ClearUserTokenCache()
8585
public override bool IsSupported(SqlAuthenticationMethod authentication)
8686
{
8787
return authentication == SqlAuthenticationMethod.ActiveDirectoryIntegrated
88+
#pragma warning disable 0618 // Type or member is obsolete
8889
|| authentication == SqlAuthenticationMethod.ActiveDirectoryPassword
90+
#pragma warning restore 0618 // Type or member is obsolete
8991
|| authentication == SqlAuthenticationMethod.ActiveDirectoryInteractive
9092
|| authentication == SqlAuthenticationMethod.ActiveDirectoryServicePrincipal
9193
|| authentication == SqlAuthenticationMethod.ActiveDirectoryDeviceCodeFlow
@@ -245,7 +247,9 @@ public override async Task<SqlAuthenticationToken> AcquireTokenAsync(SqlAuthenti
245247
SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token for Active Directory Integrated auth mode. Expiry Time: {0}", result?.ExpiresOn);
246248
}
247249
}
250+
#pragma warning disable 0618 // Type or member is obsolete
248251
else if (parameters.AuthenticationMethod == SqlAuthenticationMethod.ActiveDirectoryPassword)
252+
#pragma warning restore 0618 // Type or member is obsolete
249253
{
250254
string pwCacheKey = GetAccountPwCacheKey(parameters);
251255
object previousPw = s_accountPwCache.Get(pwCacheKey);
@@ -275,8 +279,7 @@ previousPw is byte[] previousPwBytes &&
275279
{
276280
entry.Value = GetHash(parameters.Password);
277281
entry.AbsoluteExpirationRelativeToNow = TimeSpan.FromHours(s_accountPwCacheTtlInHours);
278-
};
279-
282+
}
280283
SqlClientEventSource.Log.TryTraceEvent("AcquireTokenAsync | Acquired access token for Active Directory Password auth mode. Expiry Time: {0}", result?.ExpiresOn);
281284
}
282285
}

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlAuthenticationProviderManager.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ namespace Microsoft.Data.SqlClient
1414
/// </summary>
1515
internal sealed class SqlAuthenticationProviderManager
1616
{
17+
[Obsolete("ActiveDirectoryPassword is deprecated, use a more secure authentication method. See https://aka.ms/SqlClientEntraIDAuthentication for more details.")]
1718
private const string ActiveDirectoryPassword = "active directory password";
1819
private const string ActiveDirectoryIntegrated = "active directory integrated";
1920
private const string ActiveDirectoryInteractive = "active directory interactive";
@@ -58,7 +59,9 @@ private static void SetDefaultAuthProviders(SqlAuthenticationProviderManager ins
5859
{
5960
var activeDirectoryAuthProvider = new ActiveDirectoryAuthenticationProvider(instance._applicationClientId);
6061
instance.SetProvider(SqlAuthenticationMethod.ActiveDirectoryIntegrated, activeDirectoryAuthProvider);
62+
#pragma warning disable 0618 // Type or member is obsolete
6163
instance.SetProvider(SqlAuthenticationMethod.ActiveDirectoryPassword, activeDirectoryAuthProvider);
64+
#pragma warning restore 0618 // Type or member is obsolete
6265
instance.SetProvider(SqlAuthenticationMethod.ActiveDirectoryInteractive, activeDirectoryAuthProvider);
6366
instance.SetProvider(SqlAuthenticationMethod.ActiveDirectoryServicePrincipal, activeDirectoryAuthProvider);
6467
instance.SetProvider(SqlAuthenticationMethod.ActiveDirectoryDeviceCodeFlow, activeDirectoryAuthProvider);
@@ -239,8 +242,10 @@ private static SqlAuthenticationMethod AuthenticationEnumFromString(string authe
239242
{
240243
case ActiveDirectoryIntegrated:
241244
return SqlAuthenticationMethod.ActiveDirectoryIntegrated;
245+
#pragma warning disable 0618 // Type or member is obsolete
242246
case ActiveDirectoryPassword:
243247
return SqlAuthenticationMethod.ActiveDirectoryPassword;
248+
#pragma warning restore 0618 // Type or member is obsolete
244249
case ActiveDirectoryInteractive:
245250
return SqlAuthenticationMethod.ActiveDirectoryInteractive;
246251
case ActiveDirectoryServicePrincipal:

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlConnection.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2150,7 +2150,9 @@ private bool TryOpen(TaskCompletionSource<DbConnectionInternal> retry, SqlConnec
21502150

21512151
if (connectionOptions != null &&
21522152
(connectionOptions.Authentication == SqlAuthenticationMethod.SqlPassword ||
2153+
#pragma warning disable 0618 // Use of obsolete member 'SqlAuthenticationMethod.ActiveDirectoryPassword'
21532154
connectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryPassword ||
2155+
#pragma warning restore 0618 // Use of obsolete member 'SqlAuthenticationMethod.ActiveDirectoryPassword'
21542156
connectionOptions.Authentication == SqlAuthenticationMethod.ActiveDirectoryServicePrincipal) &&
21552157
(!connectionOptions._hasUserIdKeyword || !connectionOptions._hasPasswordKeyword) &&
21562158
_credential == null)

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/TdsEnums.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1144,6 +1144,7 @@ public enum SqlAuthenticationMethod
11441144
SqlPassword,
11451145

11461146
/// <include file='../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/ActiveDirectoryPassword/*'/>
1147+
[Obsolete("ActiveDirectoryPassword is deprecated, use a more secure authentication method. See https://aka.ms/SqlClientEntraIDAuthentication for more details.")]
11471148
ActiveDirectoryPassword,
11481149

11491150
/// <include file='../../../../../../doc/snippets/Microsoft.Data.SqlClient/SqlAuthenticationMethod.xml' path='docs/members[@name="SqlAuthenticationMethod"]/ActiveDirectoryIntegrated/*'/>

‎src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/TdsParser.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8731,7 +8731,9 @@ internal int WriteFedAuthFeatureRequest(FederatedAuthenticationFeatureExtensionD
87318731
byte workflow = 0x00;
87328732
switch (fedAuthFeatureData.authentication)
87338733
{
8734+
#pragma warning disable 0618 // Type or member is obsolete
87348735
case SqlAuthenticationMethod.ActiveDirectoryPassword:
8736+
#pragma warning restore 0618 // Type or member is obsolete
87358737
workflow = TdsEnums.MSALWORKFLOW_ACTIVEDIRECTORYPASSWORD;
87368738
break;
87378739
case SqlAuthenticationMethod.ActiveDirectoryIntegrated:

‎src/Microsoft.Data.SqlClient/tests/FunctionalTests/SqlAuthenticationProviderTest.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ public class SqlAuthenticationProviderTest
1111
{
1212
[Theory]
1313
[InlineData(SqlAuthenticationMethod.ActiveDirectoryIntegrated)]
14+
#pragma warning disable 0618 // Type or member is obsolete
1415
[InlineData(SqlAuthenticationMethod.ActiveDirectoryPassword)]
16+
#pragma warning restore 0618 // Type or member is obsolete
1517
[InlineData(SqlAuthenticationMethod.ActiveDirectoryServicePrincipal)]
1618
[InlineData(SqlAuthenticationMethod.ActiveDirectoryDeviceCodeFlow)]
1719
[InlineData(SqlAuthenticationMethod.ActiveDirectoryManagedIdentity)]

0 commit comments

Comments
 (0)