-
Notifications
You must be signed in to change notification settings - Fork 375
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support for Managed Identity for Azure resources (#875)
- Loading branch information
Showing
8 changed files
with
258 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
114 changes: 114 additions & 0 deletions
114
test/functional/pdo_sqlsrv/pdo_azure_ad_managed_identity.phpt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| --TEST-- | ||
| Test some error conditions of Azure AD Managed Identity support | ||
| --DESCRIPTION-- | ||
| This test expects certain exceptions to be thrown under some conditions. | ||
| --SKIPIF-- | ||
| <?php require('skipif.inc');?> | ||
| --FILE-- | ||
| <?php | ||
| require_once("MsCommon_mid-refactor.inc"); | ||
|
|
||
| function verifyErrorMessage($exception, $expectedError, $msg) | ||
| { | ||
| if (strpos($exception->getMessage(), $expectedError) === false) { | ||
| echo "AzureAD Managed Identity test: expected to fail with $msg\n"; | ||
|
|
||
| print_r($exception->getMessage()); | ||
| echo "\n"; | ||
| } | ||
| } | ||
|
|
||
| function connectWithInvalidOptions() | ||
| { | ||
| global $server; | ||
|
|
||
| $message = 'AzureAD Managed Identity test: expected to fail with '; | ||
| $expectedError = 'When using ActiveDirectoryMsi Authentication, PWD must be NULL. UID can be NULL, but if not, an empty string is not accepted'; | ||
|
|
||
| $uid = ''; | ||
| $connectionInfo = "Authentication = ActiveDirectoryMsi;"; | ||
| $testCase = 'empty UID provided'; | ||
| try { | ||
| $conn = new PDO("sqlsrv:server = $server; $connectionInfo", $uid); | ||
| echo $message . $testCase . PHP_EOL; | ||
| } catch(PDOException $e) { | ||
| verifyErrorMessage($e, $expectedError, $testCase); | ||
| } | ||
| unset($connectionInfo); | ||
|
|
||
| $pwd = ''; | ||
| $connectionInfo = "Authentication = ActiveDirectoryMsi;"; | ||
| $testCase = 'empty PWD provided'; | ||
| try { | ||
| $conn = new PDO("sqlsrv:server = $server; $connectionInfo", null, $pwd); | ||
| echo $message . $testCase . PHP_EOL; | ||
| } catch(PDOException $e) { | ||
| verifyErrorMessage($e, $expectedError, $testCase); | ||
| } | ||
| unset($connectionInfo); | ||
|
|
||
| $pwd = 'dummy'; | ||
| $connectionInfo = "Authentication = ActiveDirectoryMsi;"; | ||
| $testCase = 'PWD provided'; | ||
| try { | ||
| $conn = new PDO("sqlsrv:server = $server; $connectionInfo", null, $pwd); | ||
| echo $message . $testCase . PHP_EOL; | ||
| } catch(PDOException $e) { | ||
| verifyErrorMessage($e, $expectedError, $testCase); | ||
| } | ||
| unset($connectionInfo); | ||
|
|
||
| $expectedError = 'When using Azure AD Access Token, the connection string must not contain UID, PWD, or Authentication keywords.'; | ||
| $connectionInfo = "Authentication = ActiveDirectoryMsi; AccessToken = '123';"; | ||
| $testCase = 'AccessToken option'; | ||
| try { | ||
| $conn = new PDO("sqlsrv:server = $server; $connectionInfo"); | ||
| echo $message . $testCase . PHP_EOL; | ||
| } catch(PDOException $e) { | ||
| verifyErrorMessage($e, $expectedError, $testCase); | ||
| } | ||
| unset($connectionInfo); | ||
| } | ||
|
|
||
| function connectInvalidServer() | ||
| { | ||
| global $server, $driver, $uid, $pwd; | ||
|
|
||
| try { | ||
| $conn = new PDO("sqlsrv:server = $server; driver=$driver;", $uid, $pwd); | ||
|
|
||
| $msodbcsqlVer = $conn->getAttribute(PDO::ATTR_CLIENT_VERSION)["DriverVer"]; | ||
| $version = explode(".", $msodbcsqlVer); | ||
|
|
||
| if ($version[0] < 17 || $version[1] < 3) { | ||
| //skip the rest of this test, which requires ODBC driver 17.3 or above | ||
| return; | ||
| } | ||
| unset($conn); | ||
|
|
||
| // Try connecting to an invalid server, should get an exception from ODBC | ||
| $connectionInfo = "Authentication = ActiveDirectoryMsi;"; | ||
| $testCase = 'invalidServer'; | ||
| try { | ||
| $conn = new PDO("sqlsrv:server = invalidServer; $connectionInfo", null, null); | ||
| echo $message . $testCase . PHP_EOL; | ||
| } catch(PDOException $e) { | ||
| // TODO: check the exception message here | ||
| } | ||
| } catch(PDOException $e) { | ||
| print_r($e->getMessage()); | ||
| } | ||
| } | ||
|
|
||
| require_once('MsSetup.inc'); | ||
|
|
||
| // Test some error conditions | ||
| connectWithInvalidOptions(); | ||
|
|
||
| // Make a connection to an invalid server | ||
| connectInvalidServer(); | ||
|
|
||
| echo "Done\n"; | ||
| ?> | ||
| --EXPECT-- | ||
| Done |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
88 changes: 88 additions & 0 deletions
88
test/functional/sqlsrv/sqlsrv_azure_ad_managed_identity.phpt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| --TEST-- | ||
| Test some error conditions of Azure AD Managed Identity support | ||
| --DESCRIPTION-- | ||
| This test expects certain exceptions to be thrown under some conditions. | ||
| --SKIPIF-- | ||
| <?php require('skipif.inc');?> | ||
| --FILE-- | ||
| <?php | ||
| require_once("MsCommon.inc"); | ||
|
|
||
| function verifyErrorMessage($conn, $expectedError, $msg) | ||
| { | ||
| if ($conn === false) { | ||
| if (strpos(sqlsrv_errors($conn)[0]['message'], $expectedError) === false) { | ||
| print_r(sqlsrv_errors()); | ||
| } | ||
| } else { | ||
| fatalError("AzureAD Managed Identity test: expected to fail with $msg\n"); | ||
| } | ||
| } | ||
|
|
||
| function connectWithInvalidOptions() | ||
| { | ||
| global $server; | ||
|
|
||
| $expectedError = 'When using ActiveDirectoryMsi Authentication, PWD must be NULL. UID can be NULL, but if not, an empty string is not accepted'; | ||
|
|
||
| $connectionInfo = array("UID"=>"", "Authentication" => "ActiveDirectoryMsi"); | ||
| $conn = sqlsrv_connect($server, $connectionInfo); | ||
| verifyErrorMessage($conn, $expectedError, 'empty UID provided'); | ||
| unset($connectionInfo); | ||
|
|
||
| $connectionInfo = array("PWD"=>"", "Authentication" => "ActiveDirectoryMsi"); | ||
| $conn = sqlsrv_connect($server, $connectionInfo); | ||
| verifyErrorMessage($conn, $expectedError, 'empty PWD provided'); | ||
| unset($connectionInfo); | ||
|
|
||
| $connectionInfo = array("PWD"=>"pwd", "Authentication" => "ActiveDirectoryMsi"); | ||
| $conn = sqlsrv_connect($server, $connectionInfo); | ||
| verifyErrorMessage($conn, $expectedError, 'PWD provided'); | ||
| unset($connectionInfo); | ||
|
|
||
| $expectedError = 'When using Azure AD Access Token, the connection string must not contain UID, PWD, or Authentication keywords.'; | ||
| $connectionInfo = array("Authentication"=>"ActiveDirectoryMsi", "AccessToken" => "123"); | ||
| $conn = sqlsrv_connect($server, $connectionInfo); | ||
| verifyErrorMessage($conn, $expectedError, 'AccessToken option'); | ||
| unset($connectionInfo); | ||
| } | ||
|
|
||
| function connectInvalidServer() | ||
| { | ||
| global $server, $driver, $userName, $userPassword; | ||
|
|
||
| $connectionInfo = array("UID"=>$userName, "PWD"=>$userPassword, "Driver" => $driver); | ||
| $conn = sqlsrv_connect($server, $connectionInfo); | ||
| if ($conn === false) { | ||
| fatalError("Failed to connect in connectInvalidServer."); | ||
| } | ||
|
|
||
| $msodbcsqlVer = sqlsrv_client_info($conn)['DriverVer']; | ||
| $version = explode(".", $msodbcsqlVer); | ||
|
|
||
| if ($version[0] < 17 || $version[1] < 3) { | ||
| //skip the rest of this test, which requires ODBC driver 17.3 or above | ||
| return; | ||
| } | ||
| sqlsrv_close($conn); | ||
|
|
||
| // Try connecting to an invalid server, should get an exception from ODBC | ||
| $connectionInfo = array("Authentication"=>"ActiveDirectoryMsi"); | ||
| $conn = sqlsrv_connect('invalidServer', $connectionInfo); | ||
| if ($conn) { | ||
| fatalError("AzureAD Managed Identity test: expected to fail with invalidServer\n"); | ||
| } else { | ||
| // TODO: check the exception message here, using verifyErrorMessage() | ||
| } | ||
| } | ||
|
|
||
| // Test some error conditions | ||
| connectWithInvalidOptions($server); | ||
|
|
||
| // Make a connection to an invalid server | ||
| connectInvalidServer(); | ||
|
|
||
| echo "Done\n"; | ||
| ?> | ||
| --EXPECT-- | ||
| Done |