Azure Managed Identity support - first version

src/DurableTask.SqlServer.AzureFunctions/ManagedIdentityOptions.cs

@@ -0,0 +1,20 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See LICENSE in the project root for license information.
+
+namespace DurableTask.SqlServer.AzureFunctions
+{
+    using System;
+    using Newtonsoft.Json;
+
+    class ManagedIdentityOptions
+    {
+        [JsonProperty("authorityHost")]
+        public Uri? AuthorityHost { get; set; }
+
+        [JsonProperty("tenantId")]
+        public string? TenantId { get; set; }
+
+        [JsonProperty("useAzureManagedIdentity")]
+        public bool UseAzureManagedIdentity { get; set; }
+    }
+}

src/DurableTask.SqlServer.AzureFunctions/SqlDurabilityOptions.cs

@@ -24,6 +24,8 @@ class SqlDurabilityOptions
         [JsonProperty("taskEventBatchSize")]
         public int TaskEventBatchSize { get; set; } = 10;
 
+        public ManagedIdentityOptions? ManagedIdentityOptions { get; set; }
+
         internal ILoggerFactory LoggerFactory { get; set; } = NullLoggerFactory.Instance;
 
         internal SqlOrchestrationServiceSettings GetOrchestrationServiceSettings(
@@ -69,6 +71,16 @@ internal SqlOrchestrationServiceSettings GetOrchestrationServiceSettings(
                 settings.MaxActiveOrchestrations = extensionOptions.MaxConcurrentOrchestratorFunctions.Value;
             }
 
+            if (this.ManagedIdentityOptions != null)
+            {
+                settings.ManagedIdentitySettings = new ManagedIdentitySettings
+                {
+                    UseAzureManagedIdentity = this.ManagedIdentityOptions.UseAzureManagedIdentity,
+                    AuthorityHost = this.ManagedIdentityOptions.AuthorityHost,
+                    TenantId = this.ManagedIdentityOptions.TenantId
+                };
+            }
+
             return settings;
         }
     }

src/DurableTask.SqlServer/DurableTask.SqlServer.csproj

@@ -21,6 +21,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="Azure.Identity" Version="1.4.0" />
     <PackageReference Include="Microsoft.Azure.DurableTask.Core" Version="2.5.1" />
     <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="3.1.*" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="3.1.*" />

src/DurableTask.SqlServer/ManagedIdentitySettings.cs

@@ -0,0 +1,45 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See LICENSE in the project root for license information.
+
+using System;
+using Newtonsoft.Json;
+
+namespace DurableTask.SqlServer
+{
+    /// <summary>
+    /// Configuration options for Managed Identity.
+    /// </summary>
+    public class ManagedIdentitySettings
+    {
+        public const string Resource = "https://database.windows.net/";
+
+        /// <summary>
+        /// Initializes a new instance of the <see cref="ManagedIdentitySettings"/> class.
+        /// </summary>
+        /// <param name="authorityHost">The host of the Azure Active Directory authority.</param>
+        /// <param name="tenantId">The tenant id of the user to authenticate.</param>
+        public ManagedIdentitySettings(Uri? authorityHost = null, string? tenantId = null)
+        {
+            this.AuthorityHost = authorityHost;
+            this.TenantId = tenantId;
+        }
+
+        /// <summary>
+        /// The host of the Azure Active Directory authority. The default is https://login.microsoftonline.com/.
+        /// </summary>
+        [JsonProperty("authorityHost")]
+        public Uri? AuthorityHost { get; set; }
+
+        /// <summary>
+        /// The tenant id of the user to authenticate.
+        /// </summary>
+        [JsonProperty("tenantId")]
+        public string? TenantId { get; set; }
+
+        /// <summary>
+        /// Use Azure Managed Identity to connect to SQL Server
+        /// </summary>
+        [JsonProperty("useAzureManagedIdentity")]
+        public bool UseAzureManagedIdentity { get; set; }
+    }
+}

src/DurableTask.SqlServer/SqlConnectionFactory.cs

@@ -0,0 +1,47 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See LICENSE in the project root for license information.
+
+using System.Threading.Tasks;
+
+using Azure.Core;
+using Azure.Identity;
+
+using Microsoft.Data.SqlClient;
+
+namespace DurableTask.SqlServer
+{
+    internal class SqlConnectionFactory
+    {
+        readonly string connectionString;
+        readonly ManagedIdentitySettings? managedIdentitySettings;
+
+        public SqlConnectionFactory(string connectionString, ManagedIdentitySettings? managedIdentitySettings = null)
+        {
+            this.connectionString = connectionString;
+            this.managedIdentitySettings = managedIdentitySettings;
+        }
+
+        public async Task<SqlConnection> CreateConnection()
+        {
+            var connection = new SqlConnection(this.connectionString);
+            if (this.managedIdentitySettings != null && this.managedIdentitySettings.UseAzureManagedIdentity)
+            {
+                var azureCredentialOptions = new DefaultAzureCredentialOptions();
+                if (this.managedIdentitySettings.AuthorityHost != null)
+                {
+                    azureCredentialOptions.AuthorityHost = this.managedIdentitySettings.AuthorityHost;
+                }
+                if (!string.IsNullOrEmpty(this.managedIdentitySettings.TenantId))
+                {
+                    azureCredentialOptions.InteractiveBrowserTenantId = this.managedIdentitySettings.TenantId;
+                }
+                var azureCredential = new DefaultAzureCredential(azureCredentialOptions);
+                var requestContext = new TokenRequestContext(new string[] { ManagedIdentitySettings.Resource });
+                var accessToken = await azureCredential.GetTokenAsync(requestContext);
+                connection.AccessToken = accessToken.Token;
+            }
+
+            return connection;
+        }
+    }
+}

src/DurableTask.SqlServer/SqlDbManager.cs

@@ -19,12 +19,12 @@ namespace DurableTask.SqlServer
 
     class SqlDbManager
     {
-        readonly SqlOrchestrationServiceSettings settings;
+        readonly SqlConnectionFactory connectionFactory;
         readonly LogHelper traceHelper;
 
-        public SqlDbManager(SqlOrchestrationServiceSettings settings, LogHelper traceHelper)
+        public SqlDbManager(SqlConnectionFactory connectionFactory, LogHelper traceHelper)
         {
-            this.settings = settings ?? throw new ArgumentNullException(nameof(settings));
+            this.connectionFactory = connectionFactory ?? throw new ArgumentNullException(nameof(connectionFactory));
             this.traceHelper = traceHelper ?? throw new ArgumentNullException(nameof(traceHelper));
         }
 
@@ -133,7 +133,7 @@ public async Task DeleteSchemaAsync()
 
         async Task<DatabaseLock> AcquireDatabaseLockAsync()
         {
-            SqlConnection connection = this.settings.CreateConnection();
+            SqlConnection connection = await this.connectionFactory.CreateConnection();
             await connection.OpenAsync();
 
             // It's possible that more than one worker may attempt to execute this creation logic at the same
@@ -187,7 +187,7 @@ async Task ExecuteSqlScriptAsync(string scriptName, DatabaseLock dbLock)
             string schemaCommands = await GetScriptTextAsync(scriptName);
 
             // Reference: https://stackoverflow.com/questions/650098/how-to-execute-an-sql-script-file-using-c-sharp
-            using SqlConnection scriptRunnerConnection = this.settings.CreateConnection();
+            using SqlConnection scriptRunnerConnection = await this.connectionFactory.CreateConnection();
             var serverConnection = new ServerConnection(scriptRunnerConnection);
 
             Stopwatch latencyStopwatch = Stopwatch.StartNew();

src/DurableTask.SqlServer/SqlOrchestrationService.cs

@@ -30,6 +30,7 @@ public class SqlOrchestrationService : OrchestrationServiceBase
             minimumInterval: TimeSpan.FromMilliseconds(50),
             maximumInterval: TimeSpan.FromSeconds(3)); // TODO: Configurable
 
+        readonly SqlConnectionFactory connectionFactory;
         readonly SqlOrchestrationServiceSettings settings;
         readonly LogHelper traceHelper;
         readonly SqlDbManager dbManager;
@@ -40,7 +41,9 @@ public SqlOrchestrationService(SqlOrchestrationServiceSettings? settings)
         {
             this.settings = ValidateSettings(settings) ?? throw new ArgumentNullException(nameof(settings));
             this.traceHelper = new LogHelper(this.settings.LoggerFactory.CreateLogger("DurableTask.SqlServer"));
-            this.dbManager = new SqlDbManager(this.settings, this.traceHelper);
+            this.connectionFactory = new SqlConnectionFactory(
+                this.settings.TaskHubConnectionString, this.settings.ManagedIdentitySettings);
+            this.dbManager = new SqlDbManager(this.connectionFactory, this.traceHelper);
             this.lockedByValue = $"{this.settings.AppName}|{Process.GetCurrentProcess().Id}";
             this.userId = new SqlConnectionStringBuilder(this.settings.TaskHubConnectionString).UserID ?? string.Empty;
         }
@@ -79,7 +82,7 @@ async Task<SqlConnection> GetAndOpenConnectionAsync(CancellationToken cancelToke
                 cancelToken = this.ShutdownToken;
             }
 
-            SqlConnection connection = this.settings.CreateConnection();
+            SqlConnection connection = await this.connectionFactory.CreateConnection();
             await connection.OpenAsync(cancelToken);
             return connection;
         }

src/DurableTask.SqlServer/SqlOrchestrationServiceSettings.cs

@@ -91,9 +91,10 @@ public SqlOrchestrationServiceSettings(string connectionString, string? taskHubN
         [JsonIgnore]
         public ILoggerFactory LoggerFactory { get; set; } = NullLoggerFactory.Instance;
 
-        internal SqlConnection CreateConnection()
-        {
-            return new SqlConnection(this.TaskHubConnectionString);
-        }
+        /// <summary>
+        /// Gets or sets managed identity settings used to connect to a database.
+        /// </summary>
+        [JsonProperty("managedIdentitySettings")]
+        public ManagedIdentitySettings? ManagedIdentitySettings { get; set; }
     }
 }