Managed identity SQL auth problems (schema creation, new instance events) about durabletask-mssql

[andsj073]

Hold on,
I am currently investigating whether this strange behavior is due to the SQL Server/Database setup when it comes to the servers own managed identity and its assignment of role Directory Readers.
As per doc here:
Enable service principals to create Azure AD users
and here:
Managed identities in Azure AD for Azure SQL

Meanwhile, may I suggest that you add these references on your quickstarts page relating to Azure SQL Database Getting Started / Database setup / Azure SQL database

[andsj073]

@cgillum
Hello again,

RESOLUTION

I have found that (at least when using Azure SQL Database as SQL Server of the provider) if you want to use another SQL server user than the sql server admin (sa or of equivalent sql server priviliges) you need to add that user to the master database as well and add it to the role dbmanager. Otherwise the automatic schema checking and updating wont work.

This holds regardless whether the user in DurableDB is of role db_owner or dt_runtime, and regardless whether it is a Managed Identity from EXTERNAL PROVIDER or FOR a SQL server managed login.

Is this intentional?
If so, I propose such instructions are added to the quickstart/azure-sql-database page, and the multitenancy/managing-user-credentials page.

USE [DurableDB]; -- does not work, so run in this DB manually using SSMS or the like
CREATE USER [username] FOR [login]/FROM EXTERNAL PROVIDER;
ALTER ROLE db_owner/dt_runtime ADD MEMBER [username];

USE [master]; -- does not work, so run in this DB manually using SSMS or the like
CREATE USER [username] FOR [login]/FROM EXTERNAL PROVIDER;
ALTER ROLE dbmanager ADD MEMBER [username];

GO

The USE sql statements above actually doesn't work on SQL Database since it does not allow that statement.

I guess another way, that I haven't tried, would be to only run with "createDatabaseIfNotExists": true initially with a sql server admin role, and the with "createDatabaseIfNotExists": false when using dt_runtime role. It is however unlikely that you could assume sql server admin access in enterprise environments, and it also raises questions as to how schema updates would be managed.

[cgillum]

Hi @andsj073. I think what you're describing is a behavior/requirement of Azure SQL Database and isn't specific to this project. However, I think fundamentally what you're looking for is detailed instructions (or even a tool) to help with the initial setup? Is that correct?

I don't think there's a way to remove the requirement for admin credentials when creating the database or setting up the users/roles. However, we may be able to streamline the process so that a DB admin can use a simple script to do the one-time setup and allow the developer to then just use the created database. Would that address your concerns?

[andsj073]

Hi @cgillum
I merely meant that your instructions are missing the piece that the user, by which the Function App (that runs Durable Functions w Azure SQL Database as taskhub provider) authenticates with SQL Database, needs to be dbmanager as well in "master", not only db_owner or dt_runtime of "DurableDB"