Skip to content

Commit fc155b3

Browse files
author
Mateusz Kmiecik
committed
Merge branch 'release-oledb-2019-q1' into 18.2.1-releaseNotes
2 parents 3ec15b0 + 02a9b4e commit fc155b3

21 files changed

Lines changed: 486 additions & 217 deletions

‎docs/analysis-services/tabular-models/data-sources-supported-ssas-tabular-1400.md‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: "Data sources supported in SQL Server Analysis Services tabular 1400 models | Microsoft Docs"
3-
ms.date: 05/07/2018
3+
ms.date: 02/12/2019
44
ms.prod: sql
55
ms.technology: analysis-services
66
ms.custom: tabular-models
@@ -23,18 +23,23 @@ For Azure Analysis Services, see [Data sources supported in Azure Analysis Servi
2323

2424
## Cloud data sources
2525

26-
|Azure datasource |In-memory |DirectQuery |
26+
|Datasource |In-memory |DirectQuery |
2727
|---------|---------|---------|
2828
|Azure SQL Database | Yes | Yes |
2929
|Azure SQL Data Warehouse | Yes | Yes |
3030
|Azure Blob Storage | Yes | No |
3131
|Azure Table Storage | Yes | No |
32-
|Azure Cosmos DB | Yes | No |
33-
|Azure Data Lake Store | Yes | No |
34-
|Azure HDInsight HDFS | Yes | No |
35-
|Azure HDInsight Spark (Beta) | Yes | No |
32+
|Azure Cosmos DB | Yes | No |
33+
|Azure Data Lake Store (Gen1)<sup>[1](#gen2)</sup> | Yes | No |
34+
|Azure HDInsight HDFS | Yes | No |
35+
|Azure HDInsight Spark <sup>[2](#databricks)</sup> | Yes | No |
3636
||||
3737

38+
<a name="gen2">1</a> - ADLS Gen2 is currently not supported.
39+
<a name="databricks">2</a> - Azure Databricks using the Spark connector is currently not supported.
40+
41+
42+
3843
**Provider**
3944
In-memory and DirectQuery models connecting to Azure data sources use .NET Framework Data Provider for SQL Server.
4045

‎docs/connect/oledb/applications/using-connection-string-keywords-with-oledb-driver-for-sql-server.md‎

Lines changed: 18 additions & 7 deletions
Large diffs are not rendered by default.

‎docs/connect/oledb/features/oledb-driver-for-sql-server-features.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,10 @@ manager: craigg
2929

3030
[Performing Asynchronous Operations](../../oledb/features/performing-asynchronous-operations.md)
3131
Discusses how OLE DB Driver for SQL Server supports asynchronous operations, which is the ability to return immediately without blocking on the calling thread.
32-
32+
33+
[Using Azure Active Directory](using-azure-active-directory.md)
34+
Discusses new authentication methods introduced in OLE DB driver 18.2.1 that have more secure default settings and allow connecting to an instance of Azure SQL Database using a federated identity.
35+
3336
[Using Multiple Active Result Sets &#40;MARS&#41;](../../oledb/features/using-multiple-active-result-sets-mars.md)
3437
Discusses how OLE DB Driver for SQL Server supports multiple active result sets (MARS). MARS enables you to execute and receive multiple result sets using a single database connection
3538

‎docs/connect/oledb/features/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@
2626
href: oledb-driver-for-sql-server-support-for-localdb.md
2727
- name: Table-Valued Parameters (OLE DB Driver for SQL Server)
2828
href: table-valued-parameters-oledb-driver-for-sql-server.md
29+
- name: Using Azure Active Directory
30+
href: using-azure-active-directory.md
2931
- name: Using Database Mirroring
3032
href: using-database-mirroring.md
3133
- name: Using Encryption Without Validation

‎docs/connect/oledb/features/using-azure-active-directory.md‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
---
2+
title: "Using Azure Active Directory| Microsoft Docs for SQL Server"
3+
ms.custom: ""
4+
ms.date: "01/28/2019"
5+
ms.prod: sql
6+
ms.prod_service: connectivity
7+
ms.reviewer: ""
8+
ms.technology: connectivity
9+
ms.topic: reference
10+
author: bazizi
11+
ms.author: v-beaziz
12+
---
13+
# Using Azure Active Directory
14+
[!INCLUDE[appliesto-ss-asdb-asdw-pdw-md](../../../includes/appliesto-ss-asdb-asdw-pdw-md.md)]
15+
16+
[!INCLUDE[Driver_OLEDB_Download](../../../includes/driver_oledb_download.md)]
17+
18+
## Purpose
19+
20+
Starting with version 18.2.1, Microsoft OLE DB Driver for SQL Server allows OLE DB applications to connect to an instance of Azure SQL Database using a federated identity. The new authentication methods include:
21+
- Azure Active Directory login ID and password
22+
- Azure Active Directory access token
23+
- Azure Active Directory integrated authentication
24+
- SQL login ID and password
25+
26+
> [!NOTE]
27+
> When using the following Azure Active Directory options with the OLE DB driver, ensure that the [Active Directory Authentication Library for SQL Server](https://go.microsoft.com/fwlink/?LinkID=513072) has been installed:
28+
> - Azure Active Directory login ID and password
29+
> - Azure Active Directory integrated authentication
30+
>
31+
> ADAL isn't required for the other authentication methods or OLE DB operations.
32+
33+
> [!NOTE]
34+
> Using the following authentication modes with `DataTypeCompatibility` (or its corresponding property) set to `80` is **not** supported:
35+
> - Azure Active Directory authentication using login ID and password
36+
> - Azure Active Directory authentication using access token
37+
> - Azure Active Directory integrated authentication
38+
39+
## New connection string keywords and properties
40+
The following connection string keywords have been introduced to support Azure Active Directory authentication:
41+
42+
|Connection keyword|Connection property|Description|
43+
|--- |--- |--- |
44+
|Access Token|SSPROP_AUTH_ACCESS_TOKEN|Specifies an access token to authenticate to Azure Active Directory. |
45+
|Authentication|SSPROP_AUTH_MODE|Specifies authentication method to use.|
46+
47+
For more information about the new keywords/properties, see the following pages:
48+
- [Using Connection String Keywords with OLE DB Driver for SQL Server](../applications/using-connection-string-keywords-with-oledb-driver-for-sql-server.md)
49+
- [Initialization and Authorization Properties](../ole-db-data-source-objects/initialization-and-authorization-properties.md)
50+
51+
## New encryption and certificate validation behavior
52+
This section discusses the changes in encryption and certificate validation behavior. These changes are **only** effective when using the new Authentication or Access Token connection string keywords (or their corresponding properties).
53+
54+
### Encryption
55+
To improve security, when the new connection properties/keywords are used, the driver overrides the default encryption value by setting it to `yes`. Overriding happens at data source object initialization time. If encryption is set before initialization by any means, the value is respected and not overridden.
56+
57+
> [!NOTE]
58+
> In ADO applications and in applications that obtain the `IDBInitialize` interface through `IDataInitialize::GetDataSource`, the Core Component implementing the interface explicitly sets encryption to its default value of `no`. As a result, the new authentication properties/keywords respect this setting and the encryption value **isn't** overridden. Therefore, it is **recommended** that these applications explicitly set `Use Encryption for Data=true` to override the default value.
59+
60+
### Certificate validation
61+
To improve security, the new connection properties/keywords respect the `TrustServerCertificate` setting (and its corresponding connection string keywords/properties) **independently of the client encryption setting**. As a result, server certificate is validated by default.
62+
63+
> [!NOTE]
64+
> Certificate validation can also be controlled through the `Value` field of the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\SNI18.0\GeneralFlags\Flag2` registry entry. Valid values are `0` or `1`. The OLE DB driver chooses the most secure option between the registry and the connection property/keyword settings. That is, the driver will validate the server certificate as long as at least one of the registry/connection settings enables server certificate validation.
65+
66+
## GUI additions for Azure Active Directory
67+
The driver graphical user interface has been enhanced to allow Azure Active Directory authentication. For more information, see:
68+
- [SQL Server Login Dialog](../help-topics/sql-server-login-dialog.md)
69+
- [Universal Data Link (UDL) Configuration](../help-topics/data-link-pages.md)
70+
71+
## Example connection strings
72+
This section shows examples of new and existing connection string keywords to be used with `IDataInitialize::GetDataSource` and `DBPROP_INIT_PROVIDERSTRING` property.
73+
74+
### SQL authentication
75+
- Using `IDataInitialize::GetDataSource`:
76+
- New:
77+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];**Authentication=SqlPassword**;User ID=[username];Password=[password];Use Encryption for Data=true
78+
- Deprecated:
79+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];User ID=[username];Password=[password];Use Encryption for Data=true
80+
- Using `DBPROP_INIT_PROVIDERSTRING`:
81+
- New:
82+
> Server=[server];Database=[database];**Authentication=SqlPassword**;UID=[username];PWD=[password];Encrypt=yes
83+
- Deprecated:
84+
> Server=[server];Database=[database];UID=[username];PWD=[password];Encrypt=yes
85+
86+
### Integrated Windows authentication using Security Support Provider Interface (SSPI)
87+
88+
- Using `IDataInitialize::GetDataSource`:
89+
- New:
90+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];**Authentication=ActiveDirectoryIntegrated**;Use Encryption for Data=true
91+
- Deprecated:
92+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];**Integrated Security=SSPI**;Use Encryption for Data=true
93+
- Using `DBPROP_INIT_PROVIDERSTRING`:
94+
- New:
95+
> Server=[server];Database=[database];**Authentication=ActiveDirectoryIntegrated**;Encrypt=yes
96+
- Deprecated:
97+
> Server=[server];Database=[database];**Trusted_Connection=yes**;Encrypt=yes
98+
99+
### AAD username and password authentication using ADAL
100+
101+
- Using `IDataInitialize::GetDataSource`:
102+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];**Authentication=ActiveDirectoryPassword**;User ID=[username];Password=[password];Use Encryption for Data=true
103+
- Using `DBPROP_INIT_PROVIDERSTRING`:
104+
> Server=[server];Database=[database];**Authentication=ActiveDirectoryPassword**;UID=[username];PWD=[password];Encrypt=yes
105+
106+
### Integrated Azure Active Directory authentication using ADAL
107+
108+
- Using `IDataInitialize::GetDataSource`:
109+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];**Authentication=ActiveDirectoryIntegrated**;Use Encryption for Data=true
110+
- Using `DBPROP_INIT_PROVIDERSTRING`:
111+
> Server=[server];Database=[database];**Authentication=ActiveDirectoryIntegrated**;Encrypt=yes
112+
113+
### Azure Active Directory authentication using an access token
114+
115+
- Using `IDataInitialize::GetDataSource`:
116+
> Provider=MSOLEDBSQL;Data Source=[server];Initial Catalog=[database];**Access Token=[access token]**;Use Encryption for Data=true
117+
- Using `DBPROP_INIT_PROVIDERSTRING`:
118+
> Providing access token through `DBPROP_INIT_PROVIDERSTRING` isn't supported
119+
120+
## Azure Active Directory authentication code samples
121+
122+
The following samples show the code required to connect to Azure Active Directory with connection keywords.
123+
124+
### Access Token
125+
```cpp
126+
#include <string>
127+
#include <iostream>
128+
#include <msdasc.h>
129+
130+
int main()
131+
{
132+
wchar_t azureServer[] = L"server";
133+
wchar_t azureDatabase[] = L"mydatabase";
134+
wchar_t accessToken[] = L"eyJ0eXAiOi...";
135+
IDBInitialize *pIDBInitialize = nullptr;
136+
IDataInitialize* pIDataInitialize = nullptr;
137+
HRESULT hr = S_OK;
138+
139+
CoInitialize(nullptr);
140+
141+
// Construct the connection string.
142+
std::wstring connString = L"Provider=MSOLEDBSQL;Data Source=" + std::wstring(azureServer) + L";Initial Catalog=" +
143+
std::wstring(azureDatabase) + L";Access Token=" + accessToken + L";Use Encryption for Data=true;";
144+
hr = CoCreateInstance(CLSID_MSDAINITIALIZE, nullptr, CLSCTX_INPROC_SERVER,
145+
IID_IDataInitialize, reinterpret_cast<LPVOID*>(&pIDataInitialize));
146+
if (FAILED(hr))
147+
{
148+
std::cout << "Failed to create an IDataInitialize instance." << std::endl;
149+
goto Cleanup;
150+
}
151+
hr = pIDataInitialize->GetDataSource(nullptr, CLSCTX_INPROC_SERVER, connString.c_str(),
152+
IID_IDBInitialize, reinterpret_cast<IUnknown**>(&pIDBInitialize));
153+
if (FAILED(hr))
154+
{
155+
std::cout << "Failed to get data source object." << std::endl;
156+
goto Cleanup;
157+
}
158+
hr = pIDBInitialize->Initialize();
159+
if (FAILED(hr))
160+
{
161+
std::cout << "Failed to establish connection." << std::endl;
162+
goto Cleanup;
163+
}
164+
165+
Cleanup:
166+
if (pIDBInitialize)
167+
{
168+
pIDBInitialize->Uninitialize();
169+
pIDBInitialize->Release();
170+
}
171+
if (pIDataInitialize)
172+
{
173+
pIDataInitialize->Release();
174+
}
175+
176+
CoUninitialize();
177+
}
178+
```
179+
### Active Directory Integrated
180+
```cpp
181+
#include <string>
182+
#include <iostream>
183+
#include <msdasc.h>
184+
185+
int main()
186+
{
187+
wchar_t azureServer[] = L"server";
188+
wchar_t azureDatabase[] = L"mydatabase";
189+
IDBInitialize *pIDBInitialize = nullptr;
190+
IDataInitialize* pIDataInitialize = nullptr;
191+
HRESULT hr = S_OK;
192+
193+
CoInitialize(nullptr);
194+
195+
// Construct the connection string.
196+
std::wstring connString = L"Provider=MSOLEDBSQL;Data Source=" + std::wstring(azureServer) + L";Initial Catalog=" +
197+
std::wstring(azureDatabase) + L";Authentication=ActiveDirectoryIntegrated;Use Encryption for Data=true;";
198+
199+
hr = CoCreateInstance(CLSID_MSDAINITIALIZE, nullptr, CLSCTX_INPROC_SERVER,
200+
IID_IDataInitialize, reinterpret_cast<LPVOID*>(&pIDataInitialize));
201+
if (FAILED(hr))
202+
{
203+
std::cout << "Failed to create an IDataInitialize instance." << std::endl;
204+
goto Cleanup;
205+
}
206+
hr = pIDataInitialize->GetDataSource(nullptr, CLSCTX_INPROC_SERVER, connString.c_str(),
207+
IID_IDBInitialize, reinterpret_cast<IUnknown**>(&pIDBInitialize));
208+
if (FAILED(hr))
209+
{
210+
std::cout << "Failed to get data source object." << std::endl;
211+
goto Cleanup;
212+
}
213+
hr = pIDBInitialize->Initialize();
214+
if (FAILED(hr))
215+
{
216+
std::cout << "Failed to establish connection." << std::endl;
217+
goto Cleanup;
218+
}
219+
220+
Cleanup:
221+
if (pIDBInitialize)
222+
{
223+
pIDBInitialize->Uninitialize();
224+
pIDBInitialize->Release();
225+
}
226+
if (pIDataInitialize)
227+
{
228+
pIDataInitialize->Release();
229+
}
230+
231+
CoUninitialize();
232+
}
233+
```
234+
235+
## See Also
236+
[Authorize access to Azure Active Directory web applications using the OAuth 2.0 code grant flow](https://go.microsoft.com/fwlink/?linkid=2072672)
237+
238+
[Token-based authentication support for Azure SQL DB using Azure AD auth](https://go.microsoft.com/fwlink/?linkid=2068937)
239+
240+
[Using Connection String Keywords with OLE DB Driver for SQL Server](../applications/using-connection-string-keywords-with-oledb-driver-for-sql-server.md)

‎docs/connect/oledb/help-topics/data-link-pages.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ The Connection tab is provider-specific and displays only the connection propert
2626
|Option|Description|
2727
|--- |--- |
2828
|Select or enter a server name|Select a server name from the drop-down list, or type the location of the server where the database you want to access is located. Selecting the database on the server is a separate action. Update the list by clicking "Refresh".
29-
|Enter information to sign in to the server|You can select the following authentication options from this drop-down list: <ul><li>`Windows Authentication:` Authentication to SQL Server using the currently logged-in user's account</li><li>`SQL Server Authentication:` Authentication to SQL Server using login ID and password</li><li>`Active Directory - Integrated:` Integrated authentication using the currently logged-in user's account</li><li>`Active Directory - Password:` Active Directory authentication using login ID and password</li></ul>|
29+
|Enter information to sign in to the server|You can select the following authentication options from this drop-down list: <ul><li>`Windows Authentication:` Authentication to SQL Server using the currently logged-in user's Windows account credentials.</li><li>`SQL Server Authentication:` Authentication to SQL Server using login ID and password.</li><li>`Active Directory - Integrated:` Integrated authentication using the currently logged-in user's Windows account credentials.</li><li>`Active Directory - Password:` Active Directory authentication using login ID and password.</li></ul>|
3030
|Server SPN|If you use a trusted connection, you can specify a service principal name (SPN) for the server.|
3131
|User name|Type the User ID to use for authentication when you sign in to the data source.|
3232
|Password|Type the password to use for authentication when you sign in to the data source.|

‎docs/connect/oledb/help-topics/sql-server-login-dialog.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ When you attempt to connect without specifying enough information, the OLE DB dr
2828
|Option|Description|
2929
|--- |--- |
3030
|Server|The name of an instance of SQL Server on your network. Select a server\instance name from the list, or type the server\instance name in the **Server** box. Optionally, you can create a server alias on the client computer using **SQL Server Configuration Manager**, and type that name in the **Server** box. <br/><br/>You can enter "(local)" when you are using the same computer as SQL Server. You can then connect to a local instance of SQL Server, even when running a non-networked version of SQL Server.<br/><br/>For more information about server names for different types of networks, see [SQL Server Installation](https://go.microsoft.com/fwlink/?linkid=2067541).|
31-
|Authentication Mode|You can select the following authentication options from the drop-down list:<br/><ul><li>`Windows Authentication:` Authentication to SQL Server using the currently logged-in user's Windows account credentials</li><li>`SQL Server Authentication:` Authentication to SQL Server using login ID and password</li><li>`Active Directory - Integrated:` Integrated authentication using the currently logged-in user's Windows account credentials</li><li>`Active Directory - Password:` Active Directory authentication using login ID and password</li></ul>|
31+
|Authentication Mode|You can select the following authentication options from the drop-down list:<br/><ul><li>`Windows Authentication:` Authentication to SQL Server using the currently logged-in user's Windows account credentials.</li><li>`SQL Server Authentication:` Authentication to SQL Server using login ID and password.</li><li>`Active Directory - Integrated:` Integrated authentication using the currently logged-in user's Windows account credentials.</li><li>`Active Directory - Password:` Active Directory authentication using login ID and password.</li></ul>|
3232
|Server SPN|If you use a trusted connection, you can specify a service principal name (SPN) for the server.|
3333
|Login ID|Specifies the login ID to use for the connection. The Login ID text box is only enabled if `Authentication Mode` is set to `SQL Server Authentication` or `Active Directory - Password`.|
3434
|Password|Specifies the password used for the connection. The password text box is only enabled if `Authentication Mode` is set to `SQL Server Authentication` or `Active Directory - Password`.|
@@ -47,3 +47,6 @@ When you attempt to connect without specifying enough information, the OLE DB dr
4747

4848
> [!NOTE]
4949
> When using `Windows Authentication` or `SQL Server Authentication` modes, **Trust server certificate** is considered only when the **Use strong encryption for data** option is enabled.
50+
51+
## See Also
52+
[Using Azure Active Directory](../features/using-azure-active-directory.md)

0 commit comments

Comments
 (0)