Azure Synapse Studio: What are synapse studio credentials and how are they used?

Question

We have a requirement to grant access to a user on one specific pipeline and 2 linked services within synapse studio. The new preview scoped roles seem to allow for this. The problem is that this user won't be able to execute the pipeline unless we define credentials and grant him access to these credentials. We can't seem to find any documentation explaining "credentials" within synapse studio and their purpose. After doing a lot of research, it turns out that credentials are used to secure linked services but we never managed to figure out how exactly does this happen. Anyone help in explaining credentials and how they are used to secure linked services is much appreciated. A screenshot of the "credentials" we are referring to is provided below:

Answer 1

Hello @GeorgeD37 ,

The main purpose of credentials is to simplify auth. settings in a linked service. We are soon going to add support for User Assigned Managed Identity in Credentials.
In future, we do plan to extend their use to solve identity confusion, by integrating them in Pipeline activities, and RunAs/BrowseAs in Notebooks/SparkJobs/Pipelines/Dataflows etc.

Synapse assumes that pipelines run as workspace system msi, and that workspace system msi has access to all linked services / credentials.
So even when a user configures a pipeline, access to credentials is assumed to happen as msi at runtime, hence the requirement is for the user to be able to impersonate the msi.
There are some "run as" feature developments happening for pipelines, where user would have choice on which identity the pipeline should run as, and that identity wouldn't have super powers like system msi.

Hope this helps.

Answer 2

Hello @GeorgeD37 ,

Welcome to the Microsoft Q&A platform.

By default Synapse uses Azure Active Directory (AAD) passthrough by default for authentication between resources. If you need to connect to a resource using other credentials, use the TokenLibrary directly. The TokenLibrary simplifies the process of retrieving SAS tokens, AAD tokens, connection strings, and secrets stored in a linked service or from an Azure Key Vault.

Credentials - helps you to hold authentication details.

Note: . Credentials more like a “shortcut” for TokenLibrary

For more details, refer Secure credentials with linked services using the TokenLibrary.

Hope this helps. Do let us know if you any further queries.

------------

Please don’t forget to Accept Answer and Up-Vote wherever the information provided helps you, this can be beneficial to other community members.