Skip to content

Conversation

@gainskills
Copy link

@gainskills gainskills commented Nov 25, 2025

Summary

We failed a security compliance check becasue current new relic implementation with password and service principle secret, this PR adds Azure Managed Identity authentication support for the nri-mssql integration, expanding the existing Azure AD Service Principal authentication capabilities.

Key Changes

  • Features Added

  • Managed Identity Support: New USE_MANAGED_IDENTITY configuration option enables authentication via Azure Managed Identity (system or user-assigned)

  • Automatic encryption: Managed Identity authentication enforces encrypted connections (encrypt=true) by default, regardless of ENABLE_SSL setting

  • Smart certificate handling: Defaults to TrustServerCertificate=true for Managed Identity to prevent SSPI channel binding errors with Azure SQL MI, unless a certificate is explicitly provided

Files Modified

  • src/args/argument_list.go: Added UseManagedIdentity boolean flag
  • src/connection/sql_connection.go:
    • Updated determineAuthMethod() to check for Managed Identity first (takes precedence)
    • Enhanced CreateAzureADConnectionURL() to support both Service Principal and Managed Identity auth methods
  • src/connection/sql_connection_test.go: Added 5 new test cases covering various Managed Identity scenarios
  • mssql-config.yml.sample: Updated documentation with clear examples for both authentication methods

Backward Compatibility

Fully backward compatible - existing Service Principal authentication remains unchanged

@gainskills gainskills requested a review from a team as a code owner November 25, 2025 05:44
@CLAassistant
Copy link

CLAassistant commented Nov 25, 2025

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants