How Can We Handle Azure Access Token Rotation / Refresh To Be Used In JDBC Connection String?

Question

We we're able to connect in azure for postgreSQL database using access token in a password less connection. However, access token expires after 60 mins, do you have any recommendation how can we handle this token changes?

Example JDBC Connection String Used:
jdbc:postgresql://*--postgres.postgres.database.azure.com:5432/dev?sslmode=require&user=<USER>&password=<ACCESS_TOKEN>

Answer 1

Hi Jomar Lorenzo,

Azure AD access tokens used with Azure Database for PostgreSQL are valid for only up to 1 hour. When the token expires, PostgreSQL returns errors like AAD_AUTH_EXPIRED (18456/108) or AAD_AUTH_BAD_SIGNATURE (18456/112).PostgreSQL cannot refresh tokens automatically inside an existing JDBC connection. Your application must acquire a new Azure AD access token and create a new connection.

Recommended approach:

1.Programmatically fetch a fresh token (Managed Identity or Service Principal)
2.Pass the token as the JDBC password
3.Use a connection pool (e.g., HikariCP) so new connections automatically get fresh tokens

Static JDBC connection strings with a fixed token are not supported for long-running workloads.

Reference:
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/security-entra-concepts