Add On-Behalf-Of (OBO) user-delegated authentication for SQL Se… by anushakolan · Pull Request #3151 · Azure/data-api-builder

anushakolan · 2026-02-21T02:47:23Z

Why make this change?

Data API Builder currently supports managed identity authentication to SQL Server/Azure SQL, where the DAB service itself authenticates using its own identity. However, this approach doesn't support user-level authorization scenarios where:

Row-Level Security (RLS) policies need to filter data based on the actual end user's identity
Database audit logs should reflect the actual user who performed the operation
Fine-grained permissions need to be enforced per-user at the database level
This PR introduces On-Behalf-Of (OBO) user-delegated authentication for SQL Server, enabling DAB to exchange the incoming user's access token for a downstream SQL token using the OAuth 2.0 OBO flow. This allows the actual user's identity to flow through to the database, enabling true user-level authorization.

What is this change?

Overview
Implements the OAuth 2.0 On-Behalf-Of (OBO) flow for SQL Server authentication, allowing DAB to:

Accept a user's access token from the incoming request
Exchange it for a SQL Server-scoped token using MSAL
Use that token to authenticate to SQL Server as the actual user

Configuration Schema
Added new user-delegated-auth configuration section under data-source:

{
  "data-source": {
    "database-type": "mssql",
    "connection-string": "@env('SQL_CONNECTION_STRING')",
    "user-delegated-auth": {
      "enabled": true,
      "provider": "EntraId",
      "database-audience": "https://database.windows.net"
    }
  }
}

New Components

IOboTokenProvider - Interface for OBO token exchange
OboSqlTokenProvider - Implementation that performs the OBO token exchange using MSAL
IMsalClientWrapper / MsalClientWrapper - Wrapper around MSAL's ConfidentialClientApplication for testability
Schema updates - Added user-delegated-auth to dab.draft.schema.json

Key Implementation Details

Token Caching: A custom in-memory ConcurrentDictionary cache is used to avoid repeated OBO token exchanges for the same user. Cache keys are derived from user identity claims (oid/sub + tenant ID).
Scope: Requests token for https://database.windows.net/.default scope
Connection String: When OBO is configured, the AccessToken property is set on SqlConnection with the exchanged token
Validation:
- OBO is only supported for mssql database type
- All three fields (client-id, client-secret, tenant-id) are required when OBO is configured

How was this tested?

Unit Tests (14 tests)

Added comprehensive unit tests in OboSqlTokenProviderUnitTests.cs:

GetAccessTokenAsync_ReturnsToken_WhenOboSucceeds - Happy path - successful token exchange
GetAccessTokenAsync_ThrowsException_WhenOboFails - Error handling when MSAL fails
GetAccessTokenAsync_UsesCorrectScope - Verifies SQL scope is requested
GetAccessTokenAsync_PassesUserAssertionCorrectly - Verifies user token is passed correctly
GetAccessTokenAsync_HandlesNullResult - Null result handling
GetAccessTokenAsync_HandlesEmptyAccessToken - Empty token handling

Added validation tests in ConfigValidationUnitTests.cs:

ValidateUserDelegatedAuthConfig_ValidConfig_NoErrors - Valid OBO config passes validation
ValidateUserDelegatedAuthConfig_MissingDatabaseAudience_ReturnsError - Missing database-audience fails when enabled
ValidateUserDelegatedAuthConfig_NonMsSql_ReturnsError - OBO only supported for mssql
ValidateUserDelegatedAuthConfig_NullOptions_NoErrors - No OBO config is valid
ValidateUserDelegatedAuthConfig_DisabledWithMissingFields_NoErrors - Disabled OBO doesn't require all fields

Manual End-to-End Testing (Azure)

Test Environment Setup

Deployed DAB to Azure Container Apps with OBO authentication enabled, connected to an Azure SQL Database configured with Row-Level Security (RLS). The RLS policy filters data based on the authenticated user's email address.

Test Scenarios Validated

User Identity Propagation: Verified that the actual user's identity flows through to the database. When User A calls the API, they only see their own data (1 row out of 6 total rows in the table).
Multi-User Isolation: Tested with multiple users - each user only sees rows where their email matches the UserEmail column, confirming RLS works correctly with OBO tokens.
Authentication Enforcement:
- Requests without a token receive 403 Forbidden
- Requests with invalid/expired tokens receive 401 Unauthorized
Authorization Enforcement: Users with valid tokens but no SQL database permissions receive a 500 error with login failed message (SQL Error 18456).
Token Caching: Confirmed MSAL token caching is working - initial requests take ~500ms for token exchange, while subsequent requests for the same user complete in 75-150ms.
Database Audit Trail: Verified that SQL Server audit logs show the actual user's identity (e.g., user@example.com rather than the managed identity, enabling proper audit compliance.

Comparison with Managed Identity
Deployed a separate instance using managed identity (without OBO) to compare behavior:

With Managed Identity + RLS: Returns 0 rows (MI identity doesn't match any user in the table)
With Managed Identity + RLS disabled: Returns all 6 rows
With OBO + RLS: Returns only the authenticated user's row(s)

This validates that OBO correctly enables per-user data isolation at the database level.

…rver

anushakolan · 2026-02-21T02:47:32Z

/azp run

azure-pipelines · 2026-02-21T02:47:53Z

Azure Pipelines successfully started running 6 pipeline(s).

Copilot

Pull request overview

Adds On-Behalf-Of (OBO) user-delegated authentication support for MSSQL data sources so DAB can exchange an incoming user JWT for a SQL-scoped token and execute SQL as the end user (enabling RLS/auditing scenarios).

Changes:

Introduces OBO token acquisition + in-memory caching via IOboTokenProvider/OboSqlTokenProvider and an MSAL wrapper for testability.
Wires OBO into MSSQL query execution (sets SqlConnection.AccessToken, disables pooling for OBO-enabled data sources).
Adds config/schema support and validation + unit tests for OBO configuration and token-provider behavior.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
src/Service/Startup.cs	Registers OBO token provider in DI and builds MSAL confidential client.
src/Core/Resolvers/MsSqlQueryExecutor.cs	Uses OBO tokens for request-time SQL connections and disables pooling when enabled.
src/Core/Resolvers/Factories/QueryManagerFactory.cs	Plumbs optional OBO provider into MSSQL/DWSQL query executors.
src/Core/Resolvers/IOboTokenProvider.cs	Defines OBO token provider abstraction used by query execution.
src/Core/Resolvers/OboSqlTokenProvider.cs	Implements OBO token acquisition, cache keying, caching, and refresh logic.
src/Core/Resolvers/IMsalClientWrapper.cs	Adds MSAL wrapper interface for mocking MSAL in unit tests.
src/Core/Resolvers/MsalClientWrapper.cs	Implements wrapper over MSAL `IConfidentialClientApplication`.
src/Core/Configurations/RuntimeConfigValidator.cs	Adds semantic validation rules for user-delegated-auth configuration.
src/Config/ObjectModel/DataSource.cs	Extends data source model with `user-delegated-auth` options and defaults/constants.
src/Config/Converters/DataSourceConverterFactory.cs	Deserializes `user-delegated-auth` block into the data source model.
src/Config/DataApiBuilderException.cs	Adds OBO-specific error messages and a new substatus code.
schemas/dab.draft.schema.json	Extends JSON schema to allow `data-source.user-delegated-auth` configuration.
src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs	Adds unit tests for OBO-related config validation scenarios.
src/Service.Tests/Authentication/OboSqlTokenProviderUnitTests.cs	Adds unit tests for OBO token provider behavior (claims, scopes, caching, refresh).
src/Service.Tests/Authentication/Helpers/RuntimeConfigAuthHelper.cs	Adds helper for building runtime configs that include user-delegated auth in tests.

src/Service/Startup.cs

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

src/Core/Resolvers/IOboTokenProvider.cs

src/Core/Resolvers/OboSqlTokenProvider.cs

src/Config/ObjectModel/DataSource.cs

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

src/Core/Resolvers/OboSqlTokenProvider.cs

src/Core/Configurations/RuntimeConfigValidator.cs

souvikghosh04

Posting comments so far. Yet to review some remaining part.

src/Service/Startup.cs

src/Core/Resolvers/OboSqlTokenProvider.cs

src/Service/Startup.cs

src/Core/Resolvers/OboSqlTokenProvider.cs

src/Service/Startup.cs

src/Core/Resolvers/MsSqlQueryExecutor.cs

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

anushakolan · 2026-02-23T20:30:53Z

/azp run

azure-pipelines · 2026-02-23T20:31:21Z

Azure Pipelines successfully started running 6 pipeline(s).

…ptions and add provider field Co-authored-by: anushakolan <45540936+anushakolan@users.noreply.github.com>

anushakolan · 2026-02-23T21:35:25Z

/azp run

azure-pipelines · 2026-02-23T21:35:46Z

Azure Pipelines successfully started running 6 pipeline(s).

souvikghosh04

added additional review comments which needs some changes and discussion. also, the PR description can be shortened. we don't have to mention all tests and functions, instead just categorize or summarize them.

src/Core/Resolvers/OboSqlTokenProvider.cs

src/Config/ObjectModel/DataSource.cs

src/Service.Tests/Authentication/OboSqlTokenProviderUnitTests.cs

Aniruddh25

Leaving comments so far

src/Config/ObjectModel/DataSource.cs

src/Config/DataApiBuilderException.cs

src/Core/Configurations/RuntimeConfigValidator.cs

anushakolan · 2026-02-25T00:30:47Z

/azp run

azure-pipelines · 2026-02-25T00:31:08Z

Azure Pipelines successfully started running 6 pipeline(s).

Aniruddh25

Consider if we can use Fusion InMemory Cache.

Aniruddh25 · 2026-02-25T04:28:51Z

src/Core/Resolvers/MsSqlQueryExecutor.cs

                _dataSourceAccessTokenUsage[dataSourceName] = ShouldManagedIdentityAccessBeAttempted(builder);
+
+                // Track user-delegated authentication settings
+                if (dataSource.IsUserDelegatedAuthEnabled && dataSource.UserDelegatedAuth is not null)


why is the second check needed? dataSource.UserDelegatedAuth is not null - this is already covered in the first condition, no?

Aniruddh25 · 2026-02-25T04:31:09Z

src/Core/Resolvers/MsSqlQueryExecutor.cs

+                if (isInRequestContext)
+                {
+                    // Validate database-audience is configured before attempting OBO
+                    if (string.IsNullOrWhiteSpace(userDelegatedAuth.DatabaseAudience))


this validation should be done at startup, no need to check again. this is the core execution logic, need to keep it simple as possible - so that its quick.

Aniruddh25 · 2026-02-25T04:34:56Z

src/Core/Resolvers/MsSqlQueryExecutor.cs

+                        subStatusCode: DataApiBuilderException.SubStatusCodes.OboAuthenticationFailure);
+                }
+
+                // At startup/metadata phase (no HTTP context) - fall through to use Managed Identity


do this comment is incorrect, we don't necessarily always fall back to Managed identity. We fallback to use the connection string from the config - which could be Managed Identity or whatever DAB is configured with - could be SQL user/password too.
We do recommend managed identity but thats not what this code will fall through to always.

Aniruddh25 · 2026-02-25T04:52:01Z

src/Core/Resolvers/OboSqlTokenProvider.cs

+
+        // Check cache for valid token
+        // Refresh if: token older than cache duration OR token expires within early refresh buffer
+        if (_tokenCache.TryGetValue(cacheKey, out CachedToken? cached) && !ShouldRefresh(cached))


Although Redis Cache is not needed, we could use the Fusion InMemory Cache - we already use that for storing results of query. It handles the refresh and expiry logic in a better way.

Aniruddh25 · 2026-02-25T04:54:57Z

src/Core/Resolvers/OboSqlTokenProvider.cs

+            _tokenCache[cacheKey] = newCachedToken;
+
+            // Periodically clean up expired tokens to prevent unbounded memory growth
+            CleanupExpiredTokensIfNeeded();


If we use Fusion Cache, this periodic cleanup is automatically taken care of for us, because when we add the cachedToken in the in-memory cache, we set the expiration time.

Aniruddh25 · 2026-02-25T05:18:49Z

src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs

            EventHandler handler = null;
            Mock<MsSqlQueryExecutor> queryExecutor
-                = new(provider, dbExceptionParser, queryExecutorLogger.Object, httpContextAccessor.Object, handler);
+                = new(provider, dbExceptionParser, queryExecutorLogger.Object, httpContextAccessor.Object, handler, null);


nit: name the argument which is passed here as null, at all constructors in this file.

Aniruddh25 · 2026-02-25T05:23:23Z

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

+        [DataTestMethod]
+        [DataRow("", DisplayName = "Empty string audience should fail")]
+        [DataRow("   ", DisplayName = "Whitespace audience should fail")]
+        public void ValidateUserDelegatedAuth_EmptyDatabaseAudience_ThrowsError(string audience)


Arent empty and missing database audience similar tests?

Aniruddh25 · 2026-02-25T05:24:05Z

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

+        /// Test to validate that user-delegated-auth with caching enabled throws an error.
+        /// </summary>
+        [TestMethod]
+        public void ValidateUserDelegatedAuth_CachingEnabled_ThrowsError()


There was already a test above to ensure Caching is Disabled.

Aniruddh25 · 2026-02-25T05:25:13Z

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

+        [DataRow(null, "test-tenant", "test-secret", DisplayName = "Missing DAB_OBO_CLIENT_ID")]
+        [DataRow("test-client", null, "test-secret", DisplayName = "Missing DAB_OBO_TENANT_ID")]
+        [DataRow("test-client", "test-tenant", null, DisplayName = "Missing DAB_OBO_CLIENT_SECRET")]
+        [DataRow("", "test-tenant", "test-secret", DisplayName = "Empty DAB_OBO_CLIENT_ID")]


Please inform @JerryNixon about the need for these env variables and get an ACK. This affects how the users will be using this feature. So, we need to ensure we are on same page.

Aniruddh25 · 2026-02-25T05:29:49Z

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs

+        [TestMethod]
+        public void ValidateUserDelegatedAuth_AzureEnvironment_PassesValidation()
+        {
+            // Arrange - Simulate Azure environment (IDENTITY_ENDPOINT is set in Azure Container Apps/App Service)


How is this test different than above apart from setting the IDENTITY_ENDPOINT? It is testing the same codepath, how is setting IDENTITY_ENDPOINT affecting validation?

[MCP] Add On-Behalf-Of (OBO) user-delegated authentication for SQL Se…

d817358

…rver

Copilot AI review requested due to automatic review settings February 21, 2026 02:47

anushakolan requested review from Alekhya-Polavarapu, Aniruddh25, JerryNixon, RubenCerna2079, aaronburtle, rusamant, sourabh1007, souvikghosh04, stuartpa and vadeveka as code owners February 21, 2026 02:47

Copilot started reviewing on behalf of anushakolan February 21, 2026 02:47 View session

Copilot AI reviewed Feb 21, 2026

View reviewed changes

souvikghosh04 self-assigned this Feb 23, 2026

souvikghosh04 requested changes Feb 23, 2026

View reviewed changes

src/Service/Startup.cs Outdated Show resolved Hide resolved

src/Core/Resolvers/OboSqlTokenProvider.cs Show resolved Hide resolved

src/Service/Startup.cs Outdated Show resolved Hide resolved

src/Core/Resolvers/OboSqlTokenProvider.cs Show resolved Hide resolved

JerryNixon added the 2.0 label Feb 23, 2026

JerryNixon approved these changes Feb 23, 2026

View reviewed changes

src/Service/Startup.cs Outdated Show resolved Hide resolved

src/Core/Resolvers/MsSqlQueryExecutor.cs Show resolved Hide resolved

src/Service.Tests/UnitTests/ConfigValidationUnitTests.cs Show resolved Hide resolved

JerryNixon and others added 2 commits February 23, 2026 13:00

Merge branch 'main' into dev/anushakolan/obo-delegated-identity

f8c8006

Addressed comments

54f3319

anushakolan mentioned this pull request Feb 23, 2026

[OBO] Add CLI support for user-delegated authentication configuration #3128

Open

2 tasks

Copilot AI added a commit that referenced this pull request Feb 23, 2026

Align CLI implementation with PR #3151 - rename to UserDelegatedAuthO…

b0f98fe

…ptions and add provider field Co-authored-by: anushakolan <45540936+anushakolan@users.noreply.github.com>

Fixed failing tests

f95cb64

anushakolan changed the title ~~[MCP] Add On-Behalf-Of (OBO) user-delegated authentication for SQL Se…~~ Add On-Behalf-Of (OBO) user-delegated authentication for SQL Se… Feb 24, 2026

souvikghosh04 requested changes Feb 24, 2026

View reviewed changes

Aniruddh25 requested changes Feb 24, 2026

View reviewed changes

Addressed comments

e4b4d27

Aniruddh25 reviewed Feb 25, 2026

View reviewed changes

Comments

Conversation

anushakolan commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why make this change?

What is this change?

How was this tested?

Unit Tests (14 tests)

Manual End-to-End Testing (Azure)

Uh oh!

anushakolan commented Feb 21, 2026

Uh oh!

azure-pipelines bot commented Feb 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

souvikghosh04 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anushakolan commented Feb 23, 2026

Uh oh!

azure-pipelines bot commented Feb 23, 2026

Uh oh!

anushakolan commented Feb 23, 2026

Uh oh!

azure-pipelines bot commented Feb 23, 2026

Uh oh!

souvikghosh04 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aniruddh25 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

anushakolan commented Feb 25, 2026

Uh oh!

azure-pipelines bot commented Feb 25, 2026

Uh oh!

Aniruddh25 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

anushakolan commented Feb 21, 2026 •

edited

Loading