Please document how to get a token with impersonation_scope to connect to an Azure SQL Database

[shueybubbles]

Feature Request

I am trying to implement the equivalent of sqlcmd -G, using the token-based access connector of the go-mssqldb driver.

The driver doesn't yet negotiate with the server to provide the tenant id and authority URLs so I know I have to use defaults for now, or have the user set them with environment variables.

Once I create a credential using azidentity.NewDefaultAzureCredential, how do I fetch a token with scope user_impersonation for the resource https://database.windows.net ?

[chlowell]

You call the credential's GetToken method. azidentity uses the Azure AD v2 endpoint, so you would request a token for the v2 scope /.default, which has the same permissions as the v1 resource:

cred, err := azidentity.NewDefaultAzureCredential(nil)
opts := policy.TokenRequestOptions{Scopes: []string{"https://database.windows.net/.default"}}
tk, err := cred.GetToken(context.Background(), opts)
log.Print(tk.Token) // tk.Token is the access token, a string

[RickWinter]

@chlowell Lets add this snippet to the identity README.md docs

[shueybubbles]

Is there a way to provide a login hint for the interactive login?

[chlowell]

Not today, but we intend to enable that. I created #15599 to track it.

[chlowell]

Closing this because the details of Azure AD scopes are out of scope for azidentity docs. Azure AD's own docs are a better source: https://learn.microsoft.com/azure/active-directory/develop/scopes-oidc