Azure Sql 连接使用来自 Azure 的访问令牌与 nodejs 的身份

Question

I'm trying to use access tokens from @azure/identity to connect to azure sql using mssql (which uses tedious behind the scenes). The access tokens don't seem to work as is (quite similar to python - more on this later).

I have the following code:

const identity = require("@azure/identity")
function getConfig(accessToken){
    var config = {
        "authentication": {
        "type": "azure-active-directory-access-token",
        "options": {
            "token": accessToken
            }
        },
        "server": "dbserver.database.windows.net",
        "options": {
          "encrypt": true,
          "database": "dbname",
            }
         };
            
         return config;
}
            
const cred = new identity.DefaultAzureCredential();
const token = await cred.getToken("https://database.windows.net/.default")
            
const conf = getConfig(token.token)
let pool = await sql.connect(conf)

This always fails with "Login failed for user ''".

I have the following python code which does exactly the same:

  def get_token():
        creds = identity.DefaultAzureCredential()
        token = creds.get_token("https://database.windows.net/.default")
        tokenb = bytes(token.token, "UTF-8")
        exptoken = b''
    
        for i in tokenb:
            exptoken += bytes({i})
            exptoken += bytes(1)
            tokenstruct = struct.pack("=i", len(exptoken)) + exptoken
    
        return tokenstruct
    
  def execute_query():
    
        access_token = get_token()
        print(access_token)
        sql_server_name = "db-server"
        sql_server_db = "database_name"
    
        SQL_COPT_SS_ACCESS_TOKEN = 1256
        connString = f"Driver={{ODBC Driver 17 for SQL Server}};SERVER={sql_server_name}.database.windows.net;DATABASE={sql_server_db}"
        conn = pyodbc.connect(connString, attrs_before={
                              SQL_COPT_SS_ACCESS_TOKEN: access_token})
    
        cursor = conn.cursor()
        cursor.execute("SELECT * from SYSOBJECTS")
        row = cursor.fetchone()
    
        while row:
            print(row)
            row = cursor.fetchone()

This works perfectly. I've also noticed the following:

1. If I take the access token from the node version (printed by console.log) and pass it to the python code in please of access_token, I get the same error from python (Login failed for user '').
2. If I pass the access token from javascript and pass it to the python code for token.token (in get_token), then it works perfectly.

So I'm guessing the binary padding and packing thing that's working for python needs to be done for the node code to work. Is there some way of doing this? Or is there some better way to pass an access token from azure-identity to tedious?

Answer 1

Doh... I was using node-mssql which is the abandoned 0.0.1 library. Switching to mssql (v6.3.1) uses a recent version of tedious, and the access token works directly.