the motive is to integrate windows authentication for sql server using quarkus

[git4rputuval]

Our quarkus version is 2.7.2.Final and mssql version is 4.2.4 (using the vertx-mssql-client-4.2.4 jar) but there is no proper documentation for how to let a user access the sql instance using windows authentication.

We did find a way for imperative programming but since we intend to do all of this with quarkus reactive we couldn't find any appropriate solution to this.

[sberyozkin]

@tsegismont Hi Thomas, do you have some recommendations ?

[tsegismont]

Thanks for the heads-up @sberyozkin

[tsegismont]

@git4rputuval are you talking about NTLM authentication?

In this case, the Vert.x SQL Client for MSSQL does not support it yet. Feel free to file an issue, we may consider it, or I can guide you through the contribution process if you're interested.

[git4rputuval]

Yes, NTLM authentication applies for jdbc drivers only, and our entire application is built on top of Quarkus Reactive. Going back to JDBC based implementation is another 6 months project, and we have already completed UAT. Going back is not possible. Is there anyway we can get this working?

All our clients are undergoing security audits and pressing on windows authentication feature for App Server to DB connection. Sooner or later, all the projects implementing Quarkus Reactive is going to take a hit, if implementing in banking projects.

I will create an issue.

[tsegismont]

I'm sorry to hear that, but it's not supported yet, and there is no workaround for this. The only supported auth mechanism is passwords.

[git4rputuval]

We have created the issue yesterday, Windows Authentication Issue for everybody's reference.

[git4rputuval]

@git4rputuval are you talking about NTLM authentication?

In this case, the Vert.x SQL Client for MSSQL does not support it yet. Feel free to file an issue, we may consider it, or I can guide you through the contribution process if you're interested.

Is there any implementation like the credential provider (https://quarkus.io/guides/credentials-provider) that we can use to get access to the connection pool and intercept it before the pool request is sent from the application server to database?

[tsegismont]

With the credentials provider, you can implement rotating passwords, which might be acceptable by your clients for their security audits.

[git4rputuval]

This is for a secured application start up. If we implement the Windows Authentication on the Application Server/ Undertow, only the authorized user can login into the server machine and start or stop the application server.

The application server may be started by any user. But since the database connection pool could not be started with the logged in user, the application server is rendered ineffective. The reactive application will not be able to query or update the database since the connection pool could not be started because the logged in user is not a windows-authenticated SQL user whose credentials will be used to create the connection pool.

[git4rputuval]

We are attaching a demo project which demonstrates our application architecture to a small extent to reproduce the errors we're getting. This project attachment is giving a runtime error whereas in our actual application its a compilation error, we are attaching both errors as snapshots, we expect that if either of the error is fixed the other would also be solved.

Below is the demo application
persistenceUnit_Error.zip

the compilation error in our actual application is

the runtime error wrt this demo application is

this is runtime error when we disable reactive datasource using quarkus.datasource.reactive=false in our application.properties file

The solutions we used by far involved using @PersistenceUnit to attach our entity/model to a specific data source, made two different entities one to map if persistence is done using jdbc and depending on the flag value set in application.properties persistence through our data service layer would either happen from jdbc persistence side (jdbcEntity,jdbcService,jdbcRepo classes) else the usual/preffered reactive side.