FEAT: Add "credential= " parameter for custom Azure Identity credential support#603
Open
jahnvi480 wants to merge 4 commits into
Open
FEAT: Add "credential= " parameter for custom Azure Identity credential support#603jahnvi480 wants to merge 4 commits into
jahnvi480 wants to merge 4 commits into
Conversation
Add a new 'credential' parameter to connect() that accepts any object following the Azure TokenCredential protocol (.get_token() method). This allows users to authenticate with any azure-identity credential class without being limited to the driver's hardcoded credential map. Changes: - auth.py: Add _get_token_from_credential() shared helper, acquire_token_from_credential(), acquire_raw_token_from_credential() - db_connection.py: Add credential=None parameter to connect() - connection.py: Validate credential, acquire token, store for bulk copy token refresh. Mutually exclusive with Authentication= - cursor.py: Check _custom_credential before _auth_type in bulk copy - constants.py: Unify _KEY_* constants with _ALLOWED_CONNECTION_STRING_PARAMS to use single source of truth (_CONNECTION_STRING_*_KEY pattern) - test_008_auth.py: Add 12 new tests for custom credential flow
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new credential= parameter to the public connection API to support custom Azure Identity (Entra ID) credential objects for token acquisition, and wires that credential through to bulk copy so fresh tokens can be acquired when needed.
Changes:
- Added
credentialparameter toconnect()/Connectionto accept objects implementing.get_token(scope). - Implemented credential-based token acquisition helpers in
auth.pyand integrated credential token usage intoCursor.bulkcopy(). - Refactored connection-string key constants and added test coverage for the new credential flows.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
tests/test_008_auth.py |
Adds unit tests for the new credential token helpers and connect(..., credential=...) behaviors. |
mssql_python/db_connection.py |
Extends the connect() API to accept and forward the new credential parameter. |
mssql_python/cursor.py |
Updates bulk copy to acquire a fresh token from a user-supplied custom credential when present. |
mssql_python/constants.py |
Refactors connection-string key constants/aliases used by auth/connection code. |
mssql_python/connection.py |
Implements the new credential parameter behavior (validation, token acquisition, mutual exclusivity with Authentication=). |
mssql_python/auth.py |
Adds centralized helpers for acquiring raw tokens / ODBC token structs from custom credentials. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Strip UID/PWD/Trusted_Connection from connection_str when credential= is used (same as Authentication= path) to avoid leaking unused secrets - Add credential= parameter to Connection.__init__ and connect() in mssql_python.pyi type stubs
The _make_cursor helper uses MagicMock for the connection, which auto-creates truthy attributes. Without explicitly setting _custom_credential = None, the bulk copy code takes the custom credential path instead of the expected _auth_type path.
📊 Code Coverage Report
Diff CoverageDiff: main...HEAD, staged and unstaged changes
Summary
📋 Files Needing Attention📉 Files with overall lowest coverage (click to expand)mssql_python.pybind.logger_bridge.cpp: 59.2%
mssql_python.pybind.ddbc_bindings.h: 59.7%
mssql_python.pybind.logger_bridge.hpp: 70.8%
mssql_python.pybind.ddbc_bindings.cpp: 76.1%
mssql_python.row.py: 76.9%
mssql_python.__init__.py: 77.3%
mssql_python.pybind.connection.connection.cpp: 77.3%
mssql_python.ddbc_bindings.py: 79.6%
mssql_python.logging.py: 85.5%
mssql_python.cursor.py: 87.2%🔗 Quick Links
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Work Item / Issue Reference
Summary
This pull request adds support for supplying a custom Azure credential object for Entra ID (Azure AD) authentication via a new
credentialparameter in the connection API. This allows users to directly pass any object with a.get_token(scope)method (such as Azure Identity credentials), providing more flexibility and control over authentication. The implementation ensures this parameter is mutually exclusive with the existingAuthentication=connection string option, and includes robust error handling and comprehensive tests for the new feature.The most important changes are:
Custom Credential Support for Entra ID Authentication:
credentialparameter to theconnect()API andConnectionconstructor, allowing users to pass a custom credential object for authentication. This parameter is mutually exclusive with theAuthentication=connection string option, and appropriate errors are raised if both are provided.acquire_token_from_credentialandacquire_raw_token_from_credentialto centralize token acquisition and error handling from custom credential objects.Integration with Bulk Copy and Connection Logic:
Constants and Codebase Cleanup:
Testing Enhancements:
credentialparameter, including happy paths, error cases (e.g., missing or invalid.get_token), and integration with other connection options. Also added tests for the new token acquisition helpers.These changes provide a more flexible and robust authentication mechanism for users who need explicit control over Azure credential selection.