Merge branch 'main' into copilot/add-role-inheritance-permissions

Author: aaronburtle

schemas/dab.draft.schema.json

@@ -61,6 +61,28 @@
               "maximum": 2147483647
             }
           }
+        },
+        "user-delegated-auth": {
+          "description": "User-delegated authentication configuration for On-Behalf-Of (OBO) flow. Enables DAB to connect to the database using the calling user's identity.",
+          "type": ["object", "null"],
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "$ref": "#/$defs/boolean-or-string",
+              "description": "Enable user-delegated authentication (OBO flow).",
+              "default": false
+            },
+            "provider": {
+              "type": "string",
+              "description": "Identity provider for user-delegated authentication.",
+              "enum": ["EntraId"],
+              "default": "EntraId"
+            },
+            "database-audience": {
+              "type": "string",
+              "description": "The audience URI for the target database (e.g., https://database.windows.net for Azure SQL)."
+            }
+          }
         }
       },
       "allOf": [

src/Cli.Tests/ConfigGeneratorTests.cs

@@ -178,6 +178,7 @@ public void TestSpecialCharactersInConnectionString()
                   ""mode"": ""production""
                   }
               },
+              ""autoentities"": {},
               ""entities"": {}
             }");
 

src/Cli.Tests/ModuleInitializer.cs

@@ -23,6 +23,8 @@ public static void Init()
         VerifierSettings.IgnoreMember<DataSource>(dataSource => dataSource.IsDatasourceHealthEnabled);
         // Ignore the DatasourceThresholdMs from the output to avoid committing it.
         VerifierSettings.IgnoreMember<DataSource>(dataSource => dataSource.DatasourceThresholdMs);
+        // Ignore the IsUserDelegatedAuthEnabled from the output as it's a computed property.
+        VerifierSettings.IgnoreMember<DataSource>(dataSource => dataSource.IsUserDelegatedAuthEnabled);
         // Ignore the datasource files as that's unimportant from a test standpoint.
         VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.DataSourceFiles);
         // Ignore the CosmosDataSourceUsed as that's unimportant from a test standpoint.
@@ -105,6 +107,8 @@ public static void Init()
         VerifierSettings.IgnoreMember<GraphQLRuntimeOptions>(options => options.FeatureFlags);
         // Ignore the JSON schema path as that's unimportant from a test standpoint.
         VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.Schema);
+        // Ignore the JSON schema path as that's unimportant from a test standpoint.
+        VerifierSettings.IgnoreMember<RuntimeConfig>(config => config.Autoentities);
         // Ignore the message as that's not serialized in our config file anyway.
         VerifierSettings.IgnoreMember<DataSource>(dataSource => dataSource.DatabaseTypeNotSupportedMessage);
         // Ignore DefaultDataSourceName as that's not serialized in our config file.

src/Cli.Tests/TestHelper.cs

@@ -1302,6 +1302,7 @@ public static string GenerateConfigWithGivenDepthLimit(string? depthLimitJson =
                     }}
                 }}
             }},
+            ""autoentities"": {{}},
             ""entities"": {{}}";
 
             return $"{{{SAMPLE_SCHEMA_DATA_SOURCE},{runtimeSection}}}";

src/Config/Converters/DataSourceConverterFactory.cs

@@ -51,12 +51,16 @@ public DataSourceConverter(DeserializationVariableReplacementSettings? replaceme
                 string connectionString = string.Empty;
                 DatasourceHealthCheckConfig? health = null;
                 Dictionary<string, object?>? datasourceOptions = null;
+                UserDelegatedAuthOptions? userDelegatedAuth = null;
 
                 while (reader.Read())
                 {
                     if (reader.TokenType is JsonTokenType.EndObject)
                     {
-                        return new DataSource(databaseType, connectionString, datasourceOptions, health);
+                        return new DataSource(databaseType, connectionString, datasourceOptions, health)
+                        {
+                            UserDelegatedAuth = userDelegatedAuth
+                        };
                     }
 
                     if (reader.TokenType is JsonTokenType.PropertyName)
@@ -136,6 +140,20 @@ public DataSourceConverter(DeserializationVariableReplacementSettings? replaceme
                                     datasourceOptions = optionsDict;
                                 }
 
+                                break;
+                            case "user-delegated-auth":
+                                if (reader.TokenType != JsonTokenType.Null)
+                                {
+                                    try
+                                    {
+                                        userDelegatedAuth = JsonSerializer.Deserialize<UserDelegatedAuthOptions>(ref reader, options);
+                                    }
+                                    catch (Exception e)
+                                    {
+                                        throw new JsonException($"Error while deserializing DataSource user-delegated-auth: {e.Message}");
+                                    }
+                                }
+
                                 break;
                             default:
                                 throw new JsonException($"Unexpected property {propertyName} while deserializing DataSource.");

src/Config/Converters/RuntimeAutoentitiesConverter.cs

@@ -29,7 +29,7 @@ class RuntimeAutoentitiesConverter : JsonConverter<RuntimeAutoentities>
     public override void Write(Utf8JsonWriter writer, RuntimeAutoentities value, JsonSerializerOptions options)
     {
         writer.WriteStartObject();
-        foreach ((string key, Autoentity autoEntity) in value.AutoEntities)
+        foreach ((string key, Autoentity autoEntity) in value.Autoentities)
         {
             writer.WritePropertyName(key);
             JsonSerializer.Serialize(writer, autoEntity, options);

src/Config/DataApiBuilderException.cs

@@ -20,6 +20,11 @@ public class DataApiBuilderException : Exception
     public const string GRAPHQL_MUTATION_FIELD_AUTHZ_FAILURE = "Unauthorized due to one or more fields in this mutation.";
     public const string GRAPHQL_GROUPBY_FIELD_AUTHZ_FAILURE = "Access forbidden to field '{0}' referenced in the groupBy argument.";
     public const string GRAPHQL_AGGREGATION_FIELD_AUTHZ_FAILURE = "Access forbidden to field '{0}' referenced in the aggregation function '{1}'.";
+    public const string OBO_IDENTITY_CLAIMS_MISSING = "User-delegated authentication failed: Neither 'oid' nor 'sub' claim found in the access token.";
+    public const string OBO_TENANT_CLAIM_MISSING = "User-delegated authentication failed: 'tid' (tenant id) claim not found in the access token.";
+    public const string OBO_TOKEN_ACQUISITION_FAILED = "User-delegated authentication failed: Unable to acquire database access token on behalf of the user.";
+    public const string OBO_MISSING_USER_CONTEXT = "User-delegated authentication failed: Missing or invalid 'Authorization: Bearer <token>' header. OBO requires a valid user token to exchange for database access.";
+    public const string OBO_MISSING_DATABASE_AUDIENCE = "User-delegated authentication failed: 'database-audience' is not configured in the data source's user-delegated-auth settings.";
 
     public enum SubStatusCodes
     {
@@ -127,7 +132,11 @@ public enum SubStatusCodes
         /// <summary>
         /// Error due to client input validation failure.
         /// </summary>
-        DatabaseInputError
+        DatabaseInputError,
+        /// <summary>
+        /// User-delegated (OBO) authentication failed due to missing identity claims.
+        /// </summary>
+        OboAuthenticationFailure
     }
 
     public HttpStatusCode StatusCode { get; }

src/Config/DatabasePrimitives/DatabaseObject.cs

@@ -43,13 +43,15 @@ public override bool Equals(object? other)
     public bool Equals(DatabaseObject? other)
     {
         return other is not null &&
-               SchemaName.Equals(other.SchemaName) &&
-               Name.Equals(other.Name);
+               string.Equals(SchemaName, other.SchemaName, StringComparison.OrdinalIgnoreCase) &&
+               string.Equals(Name, other.Name, StringComparison.OrdinalIgnoreCase);
     }
 
     public override int GetHashCode()
     {
-        return HashCode.Combine(SchemaName, Name);
+        return HashCode.Combine(
+            SchemaName is null ? 0 : StringComparer.OrdinalIgnoreCase.GetHashCode(SchemaName),
+            Name is null ? 0 : StringComparer.OrdinalIgnoreCase.GetHashCode(Name));
     }
 
     /// <summary>

src/Config/ObjectModel/DataSource.cs

@@ -40,6 +40,20 @@ public int DatasourceThresholdMs
         }
     }
 
+    /// <summary>
+    /// Configuration for user-delegated authentication (OBO) against the
+    /// configured database.
+    /// </summary>
+    [JsonPropertyName("user-delegated-auth")]
+    public UserDelegatedAuthOptions? UserDelegatedAuth { get; init; }
+
+    /// <summary>
+    /// Indicates whether user-delegated authentication is enabled for this data source.
+    /// </summary>
+    [JsonIgnore]
+    public bool IsUserDelegatedAuthEnabled =>
+        UserDelegatedAuth is not null && UserDelegatedAuth.Enabled;
+
     /// <summary>
     /// Converts the <c>Options</c> dictionary into a typed options object.
     /// May return null if the dictionary is null.
@@ -111,3 +125,67 @@ public record CosmosDbNoSQLDataSourceOptions(string? Database, string? Container
 /// Options for MsSql database.
 /// </summary>
 public record MsSqlOptions(bool SetSessionContext = true) : IDataSourceOptions;
+
+/// <summary>
+/// Options for user-delegated authentication (OBO) for a data source.
+/// 
+/// When OBO is NOT enabled (default): DAB connects to the database using a single application principal,
+/// either via Managed Identity or credentials supplied in the connection string. All requests execute
+/// under the same database identity regardless of which user made the API call.
+/// 
+/// When OBO IS enabled: DAB exchanges the calling user's JWT for a database access token using the
+/// On-Behalf-Of flow. This allows DAB to connect to the database as the actual user, enabling
+/// Row-Level Security (RLS) filtering based on user identity.
+/// 
+/// OBO requires an Azure AD App Registration (separate from the DAB service's Managed Identity).
+/// The operator deploying DAB must set the following environment variables for the OBO App Registration,
+/// which DAB reads at startup via Environment.GetEnvironmentVariable():
+/// - DAB_OBO_CLIENT_ID: The Application (client) ID of the OBO App Registration
+/// - DAB_OBO_TENANT_ID: The Directory (tenant) ID where the OBO App Registration is registered
+/// - DAB_OBO_CLIENT_SECRET: The client secret of the OBO App Registration (not a user secret)
+/// 
+/// These credentials belong to the OBO App Registration, which acts as a confidential client to exchange
+/// the incoming user JWT for a database access token. The user provides only their JWT; DAB uses the
+/// App Registration credentials to perform the OBO token exchange on their behalf.
+/// 
+/// These can be set in the hosting environment (e.g., Azure Container Apps secrets, Kubernetes secrets,
+/// Docker environment variables, or local shell environment).
+/// 
+/// Note: DAB-specific prefixes (DAB_OBO_*) are used instead of AZURE_* to avoid conflict with
+/// DefaultAzureCredential, which interprets AZURE_CLIENT_ID as a User-Assigned Managed Identity ID.
+/// At startup (when no user context is available), DAB falls back to Managed Identity for metadata operations.
+/// </summary>
+/// <param name="Enabled">Whether user-delegated authentication is enabled.</param>
+/// <param name="Provider">The authentication provider (currently only EntraId is supported).</param>
+/// <param name="DatabaseAudience">Audience used when acquiring database tokens on behalf of the user.</param>
+public record UserDelegatedAuthOptions(
+    [property: JsonPropertyName("enabled")] bool Enabled = false,
+    [property: JsonPropertyName("provider")] string? Provider = null,
+    [property: JsonPropertyName("database-audience")] string? DatabaseAudience = null)
+{
+    /// <summary>
+    /// Default duration, in minutes, to cache tokens for a given delegated identity.
+    /// With a 5-minute early refresh buffer, tokens are refreshed at the 40-minute mark.
+    /// </summary>
+    public const int DEFAULT_TOKEN_CACHE_DURATION_MINUTES = 45;
+
+    /// <summary>
+    /// Environment variable name for OBO App Registration client ID.
+    /// Uses DAB-specific prefix to avoid conflict with AZURE_CLIENT_ID which is
+    /// interpreted by DefaultAzureCredential/ManagedIdentityCredential as a
+    /// User-Assigned Managed Identity ID.
+    /// </summary>
+    public const string DAB_OBO_CLIENT_ID_ENV_VAR = "DAB_OBO_CLIENT_ID";
+
+    /// <summary>
+    /// Environment variable name for OBO App Registration client secret.
+    /// Used for On-Behalf-Of token exchange.
+    /// </summary>
+    public const string DAB_OBO_CLIENT_SECRET_ENV_VAR = "DAB_OBO_CLIENT_SECRET";
+
+    /// <summary>
+    /// Environment variable name for OBO tenant ID.
+    /// Uses DAB-specific prefix for consistency with OBO client ID.
+    /// </summary>
+    public const string DAB_OBO_TENANT_ID_ENV_VAR = "DAB_OBO_TENANT_ID";
+}

src/Config/ObjectModel/RuntimeAutoentities.cs

@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
+using System.Collections;
 using System.Text.Json.Serialization;
 using Azure.DataApiBuilder.Config.Converters;
 
@@ -10,19 +11,29 @@ namespace Azure.DataApiBuilder.Config.ObjectModel;
 /// Represents a collection of <see cref="Autoentity"/> available from the RuntimeConfig.
 /// </summary>
 [JsonConverter(typeof(RuntimeAutoentitiesConverter))]
-public record RuntimeAutoentities
+public record RuntimeAutoentities : IEnumerable<KeyValuePair<string, Autoentity>>
 {
     /// <summary>
     /// The collection of <see cref="Autoentity"/> available from the RuntimeConfig.
     /// </summary>
-    public IReadOnlyDictionary<string, Autoentity> AutoEntities { get; init; }
+    public IReadOnlyDictionary<string, Autoentity> Autoentities { get; init; }
 
     /// <summary>
     /// Creates a new instance of the <see cref="RuntimeAutoentities"/> class using a collection of entities.
     /// </summary>
-    /// <param name="autoEntities">The collection of auto-entities to map to RuntimeAutoentities.</param>
-    public RuntimeAutoentities(IReadOnlyDictionary<string, Autoentity> autoEntities)
+    /// <param name="autoentities">The collection of auto-entities to map to RuntimeAutoentities.</param>
+    public RuntimeAutoentities(IReadOnlyDictionary<string, Autoentity> autoentities)
     {
-        AutoEntities = autoEntities;
+        Autoentities = autoentities;
+    }
+
+    public IEnumerator<KeyValuePair<string, Autoentity>> GetEnumerator()
+    {
+        return Autoentities.GetEnumerator();
+    }
+
+    IEnumerator IEnumerable.GetEnumerator()
+    {
+        return GetEnumerator();
     }
 }