Is there a way to get a Token for a User on Postgres Flexible Server without having to use azure-cli?

Souza Costa, Tarcisio 0

I was looking for an alternative of azure-cli, an automatic way of obtaining tokens for regular postgres flexible server users. I wonder if it is really mandatory to use azure-cli for this task, it would be very time-consuming to ask all users to install azure-cli to request their tokens every time they want to connect or when the token has expired.

I found something from the documentation, but the code examples exist for applications, not for regular DB users. In those examples a client_id is needed, which does not seem to be valid for a user.

Thanks in advance!

1 answer

Oury Ba-MSFT 19,346 Reputation points Microsoft Employee

2024-09-27T16:07:48.1033333+00:00

@Souza Costa, Tarcisio Thank you for reaching out.

If you are connecting using managed Identity, tokens do expire. The access token's validity is 5 minutes to 60 minutes. You should get the access token before initiating the sign-in to Azure Database for PostgreSQL. You can use Azure Data Studio, as per my knowledge I am not aware of any alternative for token generative.

Regards,

Oury
Please sign in to rate this answer.
Souza Costa, Tarcisio 0 Reputation points

2024-10-08T12:05:26.67+00:00

Thank you for your comment @Oury Ba-MSFT . I understand that the tokens will expire and we have to renew to login in to Postgres. However I expected that the process of obtaining the ticket would be not dependent of Azure-CLI, as this is really time consuming from the user perspective. So all users have to install either Azure CLI or Azure Data Studio, which means there is no alternative?

Oury Ba-MSFT 19,346 Reputation points Microsoft Employee

2024-10-08T22:37:58.09+00:00

Souza Costa, Tarcisio Thank you for getting back.

After few research, one option is to use Azure Managed Identity for your application, which can obtain tokens on behalf of the users. This way, your application can handle the token acquisition process, and users won't need to install Azure CLI.

To set up Azure Managed Identity for PostgreSQL Flexible Server, you can follow these steps:

https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-connect-with-managed-identity

Please let me know if you need more details examples.

Regards,

Oury

Souza Costa, Tarcisio 0 Reputation points

2024-10-14T07:13:45.4033333+00:00

Hello Oury,

thank you for the answer. I went through the steps, but I do not get what is the appId. So basically our users will log in with DBeaver or PgAdmin, these are local clients on their machines, that is why I do not understand these appIds described there. If you have some more concrete examples, it would be very helpful.

Thank you in advance.

Regards,

Tarcísio

Souza Costa, Tarcisio 0 Reputation points

2024-10-14T14:17:31.7866667+00:00

Hello Oury,

I wanted to give an update with the latest status. I managed to assign a VM with group, as instructed in the steps, I also retrieved the appId. I created the principal with the SQL command sucessfully: select * from pgaadauth_create_principal('<identity_name>', false, false);

The identity_name here was the group name of my environment. I assume now I have to create the userAssignedIdentities under this group for each user, so that they can retrieve their tokens via the API call (http://169.254.169.254/metadata/identity/oauth2/token), is that right? Or they just need to be in a group where this System assigned Identity is and then they will be able to get the tokens from this endpoint?

Regards,

Tarcísio

Souza Costa, Tarcisio 0 Reputation points

2024-10-15T11:31:27.24+00:00

Latest update: I could login with the managed Identity which has -LoggerIdentity as sufix. Now I will try to find out how the users can obtain the token.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is there a way to get a Token for a User on Postgres Flexible Server without having to use azure-cli?

1 answer

Your answer