Skip to content

Commit e78f6ec

Browse files
author
Andre Chan
committed
AKV Interactive information added
1 parent 211bfe0 commit e78f6ec

1 file changed

Lines changed: 10 additions & 1 deletion

File tree

docs/connect/odbc/using-always-encrypted-with-the-odbc-driver.md

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -391,13 +391,16 @@ The driver supports authenticating to Azure Key Vault using the following creden
391391

392392
- Managed Identity (17.5.2+) - either system or user-assigned; see [Managed Identities for Azure resources](/azure/active-directory/managed-identities-azure-resources/) for more information.
393393

394+
- Azure Key Vault Interactive - with this method, the credentials are authenticated through Azure Active Directory with Login ID.
395+
394396
To allow the driver to use CMKs stored in AKV for column encryption, use the following connection-string-only keywords:
395397

396398
|Credential Type|<code>KeyStoreAuthentication</code>|<code>KeyStorePrincipalId</code>|<code>KeyStoreSecret</code>|
397399
|-|-|-|-|
398400
|Username/password| `KeyVaultPassword`|User Principal Name|Password|
399401
|Client ID/secret| `KeyVaultClientSecret`|Client ID|Secret|
400402
|Managed Identity|`KeyVaultManagedIdentity`|Object ID (optional, for user-assigned only)|(not specified)|
403+
|AKV Interactive|`KeyVaultInteractive`|(not set)|(not set)|
401404

402405
#### Example Connection Strings
403406

@@ -427,6 +430,12 @@ DRIVER=ODBC Driver 17 for SQL Server;SERVER=myServer;Trusted_Connection=Yes;DATA
427430
DRIVER=ODBC Driver 17 for SQL Server;SERVER=myServer;Trusted_Connection=Yes;DATABASE=myDB;ColumnEncryption=Enabled;KeyStoreAuthentication=KeyVaultManagedIdentity;KeyStorePrincipalId=<objectID>
428431
```
429432

433+
**AKV Interactive**
434+
435+
```
436+
DRIVER=ODBC Driver 17 for SQL Server;SERVER=myServer;Trusted_Connection=Yes;DATABASE=myDB;ColumnEncryption=Enabled;KeyStoreAuthentication=KeyVaultInteractive;UID=<userID>;PWD=<password>
437+
```
438+
430439
No other ODBC application changes are required to use AKV for CMK storage.
431440

432441
> [!NOTE]
@@ -614,7 +623,7 @@ See [Migrate Sensitive Data Protected by Always Encrypted](../../relational-data
614623
|Name|Description|
615624
|----------|-----------------|
616625
|`ColumnEncryption`|Accepted values are `Enabled`/`Disabled`.<br>`Enabled` -- enables Always Encrypted functionality for the connection.<br>`Disabled` -- disable Always Encrypted functionality for the connection.<br>*type*,*data* -- (version 17.4 and later) enables Always Encrypted with secure enclave and attestation protocol *type*, and associated attestation data *data*. <br><br>The default is `Disabled`.|
617-
|`KeyStoreAuthentication` | Valid Values: `KeyVaultPassword`, `KeyVaultClientSecret` |
626+
|`KeyStoreAuthentication` | Valid Values: `KeyVaultPassword`, `KeyVaultClientSecret`, `KeyVaultInteractive` |
618627
|`KeyStorePrincipalId` | When `KeyStoreAuthentication` = `KeyVaultPassword`, set this value to a valid Azure Active Directory User Principal Name. <br>When `KeyStoreAuthetication` = `KeyVaultClientSecret` set this value to a valid Azure Active Directory Application Client ID |
619628
|`KeyStoreSecret` | When `KeyStoreAuthentication` = `KeyVaultPassword` set this value to the password for the corresponding user name. <br>When `KeyStoreAuthentication` = `KeyVaultClientSecret` set this value to the Application Secret associated with a valid Azure Active Directory Application Client ID |
620629

0 commit comments

Comments
 (0)