Failed to connect to Azure SQL Database using ODBC Driver 17 with ActiveDirectoryMsi: Required metadata header not specified or not correct

Question

Hi,

I was trying to connect the Azure Container Instance to my Azure SQL Database using Azure Active DIrectory User Managed Identity. But I can't establish a connection using ODBC Driver 17.

Error Message:

[S1T00][unixODBC][Microsoft][ODBC Driver 17 for SQL Server]Login timeout expired

[FA004][unixODBC][Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Failed to authenticate the user '' in Active Directory (Authentication option is 'ActiveDirectoryMSI').
Error code 0xA190; state 41360
Required metadata header not specified or not correct
Required metadata header not specified or not correct
Required metadata header not specified or not correct
Required metadata header not specified or not correct

[CE275][unixODBC][Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Error requesting access token, HTTP status 400, expected 200

[08001][unixODBC][Microsoft][ODBC Driver 17 for SQL Server]TCP Provider: Timeout error [258]. 

[08001][unixODBC][Microsoft][ODBC Driver 17 for SQL Server]Unable to complete login process due to delay in login response

Configuration Details:

• The ODBC driver used in the docker image has a version of 17.10.5.1-1,
• The identity has been assigned to the container instance and is set as an external user of the database in table [sys.database_principals]
• The identity is set as a contributor to the database.
• Network connectivity from the Azure Container Instance to the SQL Server has been checked and confirmed.
• The DNS configuration according to Using Azure Active Directory with the ODBC Driver

[dns-name]
Driver=ODBC Driver 17 for SQL Server
Server=<server-name>
Database=<database-name>
UID=<object id of the assigned identity>
Authentication=ActiveDirectoryMsi
Encrypt=yes

Could anyone help identify the cause of these errors or suggest troubleshooting steps? Any insights or suggestions would be greatly appreciated.

Answer 1

The problem is how the SQL Server uses or recognizes Active Directory Managed Service Identity (MSI).

Make sure that your authentication method (ActiveDirectoryMsi) is correctly set up in both the Azure Container Instance and the SQL Server configurations.

Also you need the Managed Identity has the necessary permissions on the SQL Server. It should have the correct roles and permissions assigned to access the database.

Here are some threads :

https://stackoverflow.com/questions/46681021/can-not-connect-to-azure-sql-server-using-active-directory-integrated-authentica

https://learn.microsoft.com/en-us/answers/questions/1383555/managed-identity-authentication-from-synapse-noteb