Tests | Cleanup AAD Password auth from tests + code cleanup by cheenamalhotra · Pull Request #4390 · dotnet/SqlClient

cheenamalhotra · 2026-06-23T01:52:54Z

Removes live AAD Password authentication from test pipelines and uses managed-identity access tokens for Azure SQL tests.

Changes

Azure test legs consume bare connection strings from AZURE_SQL_CONN_STRING_WestUS2 and AZURE_SQL_CONN_STRING_EastUS.
Removed AAD Password connection-string config and live AAD Password tests.
Azure manual-test connections use tokens from DataTestUtility; connection-string-only paths use a test Managed Identity provider backed by the same API.
Explicit AccessToken and callback tests remove inherited authentication first.
Access tokens are cached until near expiry and pool tests reuse the same token.
Updated Azure extension tests and shared connection-string helpers.

CI migration

Supply bare Azure SQL connection strings through AZURE_SQL_CONN_STRING_WestUS2 and AZURE_SQL_CONN_STRING_EastUS, without authentication, user, or password fields. Legacy AAD_PASSWORD_CONN_STR* and AZURE_DB_*_CONN_STRING* variables are no longer consumed by these test legs.

Validation

ManualTests build: net8.0 and net9.0
Azure extension tests build: net8.0 and net9.0
Tests added or updated
No public API changes
No breaking product changes

Copilot

Pull request overview

Removes the Entra ID “password auth” connection-string configuration from the test suite (and CI templates) following the pipeline change in #4288, replacing it with a single “bare” AzureSqlConnectionString that tests extend at runtime to exercise specific authentication modes.

Changes:

Renamed AADPasswordConnectionString → AzureSqlConnectionString across test config (Config.cs/config.default.jsonc), docs, and Azure DevOps pipeline templates; updated pipeline variables accordingly.
Added shared test helpers under tests/Common/ (CommonUtils, StringExtensions) to compose auth/credential keywords onto a base connection string.
Updated ManualTests + Azure extensions tests to remove ActiveDirectoryPassword coverage and to use managed identity / token-based flows with the new helpers.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
TESTGUIDE.md	Updates documented test config property name/meaning for AAD/Azure SQL tests.
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Microsoft.Data.SqlClient.TestUtilities.csproj	References the new shared test helper project.
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/config.default.jsonc	Renames config field and clarifies Azure SQL base conn string expectation (no creds).
src/Microsoft.Data.SqlClient/tests/tools/Microsoft.Data.SqlClient.TestUtilities/Config.cs	Renames the config field to `AzureSqlConnectionString`.
src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectivityTests/AADConnectionTest.cs	Removes AAD password tests and rewrites AAD scenarios to use helpers and AzureSqlConnectionString.
src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs	Updates pooled AAD/token tests to use AzureSqlConnectionString and async token retrieval.
src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/AADFedAuthTokenRefreshTest/AADFedAuthTokenRefreshTest.cs	Switches the fed-auth refresh scenario to managed identity-based auth/provider usage.
src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/ManagedIdentityProvider.cs	Renames the custom provider class to clarify it targets user-assigned MI.
src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs	Renames config fields, adds MI-based token retrieval APIs, and removes AAD password token generation.
src/Microsoft.Data.SqlClient/tests/Common/StringExtensions.cs	Adds fluent helpers for composing auth/credential keywords and for removing auth/credential keywords.
src/Microsoft.Data.SqlClient/tests/Common/CommonUtils.cs	Adds shared random/name helpers used by updated tests.
src/Microsoft.Data.SqlClient.Extensions/Azure/test/Config.cs	Renames the Azure test config field read from config.jsonc.
src/Microsoft.Data.SqlClient.Extensions/Azure/test/AADConnectionTest.cs	Updates Azure extension tests to build auth modes from the base Azure SQL conn string.
eng/pipelines/jobs/test-azure-package-ci-job.yml	Switches pipeline config-writing to `AzureSqlConnectionString` and updates secret scoping.
eng/pipelines/dotnet-sqlclient-ci-core.yml	Switches CI template config-writing to `AzureSqlConnectionString` (WestUS2/EastUS).
eng/pipelines/common/templates/steps/update-config-file-step.yml	Renames template parameter and output property to `AzureSqlConnectionString`.
eng/pipelines/common/templates/jobs/ci-run-tests-job.yml	Renames config pass-through property to `AzureSqlConnectionString`.
.github/instructions/testing.instructions.md	Updates the test-config docs to match the renamed Azure SQL config property.

Copilot

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 6 comments.

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 5 comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

codecov · 2026-06-25T07:23:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.85%. Comparing base (44e1b72) to head (853ffb6).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4390      +/-   ##
==========================================
- Coverage   65.32%   63.85%   -1.48%     
==========================================
  Files         285      281       -4     
  Lines       43373    66638   +23265     
==========================================
+ Hits        28335    42550   +14215     
- Misses      15038    24088    +9050

Flag	Coverage Δ
CI-SqlClient	`?`
PR-SqlClient-Project	`63.85% <ø> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

benrr101

I think the scope of these changes are a bit too broad. Don't mind cleanup where sensible, but I'm concerned about the intentions behind the connection string changes being more sweeping than we really want right now.

… SQL The ConnectionPoolConnectionStringProvider classes now add Authentication=ActiveDirectoryDefault when running against Azure SQL, so pool tests authenticate via managed identity instead of failing with 'Login failed for user ''' after auth properties are stripped. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…oryDefault Convert ConnectionPoolTest and TransactionPoolTest to async, using DataTestUtility.GetAccessTokenAsync() to set connection.AccessToken before opening connections targeting Azure SQL. This ensures pool tests authenticate via managed identity without embedding auth in the connection string (which would conflict with tests that set AccessToken or AccessTokenCallback directly). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Suppressed comments (1)

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs:850

This setup probe checks system-assigned identity first, while GetAccessTokenAsync() selects user-assigned identity first. If system identity works but the configured user identity does not, this returns true, then the test receives a null token from GetAccessTokenAsync() and fails instead of being disabled. Probe the same token-selection path used by the tests.

        public static async Task<bool> IsAccessTokenAsyncSetup() => 
            !string.IsNullOrEmpty(await GetSystemIdentityAccessTokenAsync()) 
            || !string.IsNullOrEmpty(await GetUserIdentityAccessTokenAsync());

- Add IsUserManagedIdentitySupported condition to TestCustomProviderAuthentication and FedAuthTokenRefreshTest - Update RemoveAuthAndCredsProperties doc to list all 7 removed keys - Remove orphaned TcpConnectionString property from Azure.Test Config.cs - Update Azure.Test AADConnectionTest.cs to use Config.TCPConnectionString Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 556e4cc8-f9fd-46f1-aafa-1459e8659f99

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated no new comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Suppressed comments (2)

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs:305

Removing authentication and credentials from the shared TCPConnectionString breaks the general Azure SQL manual-test matrix, not just the AAD tests. The Azure jobs pass this value to hundreds of tests that open it directly (for example, TracingTests/EventSourceTest.cs:17-20), and those callers neither add an authentication mode nor set an access token, so a bare Azure SQL connection string cannot log in. Keep the authenticated TCPConnectionString for the general suite and introduce/use a separate bare Azure SQL connection string for the AAD tests, as described by the PR.

            if(IsAzureSqlConnectionString(TCPConnectionString))
            {
                // Remove legacy authentication/credential properties from the connection string.
                // Tests should add their own auth method (e.g., AccessToken, Authentication keyword).
                TCPConnectionString = TCPConnectionString.RemoveAuthAndCredsProperties();

src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs:850

The setup probe and the token getter choose identities in opposite orders: this method can return true after obtaining a system-assigned token, while GetAccessTokenAsync then prefers a configured user-assigned identity and may return null. The conditional test consequently runs and fails even though its probe succeeded. Probe through the same getter and let that getter fall back to the system identity when user-assigned acquisition fails.

        public static async Task<bool> IsAccessTokenAsyncSetup() => 
            !string.IsNullOrEmpty(await GetSystemIdentityAccessTokenAsync()) 
            || !string.IsNullOrEmpty(await GetUserIdentityAccessTokenAsync());

Route Azure SQL manual-test connections through DataTestUtility so managed identity access tokens are applied without AAD Password authentication. Remove the unused username/password provider. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 556e4cc8-f9fd-46f1-aafa-1459e8659f99

Copilot

Pull request overview

Copilot reviewed 75 out of 76 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Suppressed comments (2)

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs:139

This condition only verifies that the endpoint is Azure SQL, but the body unconditionally assigns the result of GetAccessTokenAsync. When neither managed identity is available, that result is null and the test runs only to fail authentication. Gate this test with the same synchronous access-token availability predicate used by ConnectivityTests/AADConnectionTest.cs.
src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs:305
The Azure credential stripping is applied globally before all manual tests consume TCPConnectionString, but the migration to CreateConnection is incomplete. Azure-eligible tests such as BulkCopy/SqlGraphTables.cs (lines 19–30, 48–59, and 74–85) and ProviderAgnostic/ReaderTest/ReaderTest.cs (lines 18–31) still open this now-bare string directly, so the Azure legs will attempt SQL authentication without credentials and fail. Convert every Azure-eligible direct connection/factory call to an access-token-aware path before stripping the shared string.

            if(IsAzureSqlConnectionString(TCPConnectionString))
            {
                // Remove legacy authentication/credential properties from the connection string.
                // Tests should add their own auth method (e.g., AccessToken, Authentication keyword).
                TCPConnectionString = TCPConnectionString.RemoveAuthAndCredsProperties();

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 556e4cc8-f9fd-46f1-aafa-1459e8659f99

Copilot

Pull request overview

Copilot reviewed 75 out of 76 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Suppressed comments (2)

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs:27

This unconditionally removes the configured authentication from the pool-test connection string. Local configurations commonly use Integrated Security=true (including config.default.jsonc:4), so these tests then open an unauthenticated connection because OpenWithAccessTokenAsync only supplies credentials for Azure SQL. Preserve the original authentication for non-Azure targets and strip it only when an Azure access token will be assigned.
src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs:58
This second class-data provider has the same local-test regression: stripping Integrated Security/SQL credentials leaves no authentication because access tokens are added only for Azure SQL. Keep the configured credentials for non-Azure connection strings.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 556e4cc8-f9fd-46f1-aafa-1459e8659f99

Copilot

Pull request overview

Copilot reviewed 75 out of 76 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

src/Microsoft.Data.SqlClient/src/Resources/Strings.Designer.cs: Generated file

Suppressed comments (1)

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs:58

This second provider has the same non-Azure regression: removing all auth fields leaves local SQL-auth and integrated-auth configurations unable to connect, because access tokens are added only for Azure. Keep the original configured string outside the Azure path.

+                return string.Empty;
+            }
+
+            return new SqlConnectionStringBuilder(DataTestUtility.TCPConnectionString.RemoveAuthAndCredsProperties())


Copilot AI balanced review requested due to automatic review settings June 23, 2026 01:52

github-project-automation Bot added this to SqlClient Board Jun 23, 2026

github-project-automation Bot moved this to To triage in SqlClient Board Jun 23, 2026

cheenamalhotra added the Area\Tests Issues that are targeted to tests or test projects label Jun 23, 2026

Copilot started reviewing on behalf of cheenamalhotra June 23, 2026 01:53 View session

cheenamalhotra added this to the 7.1.0-preview2 milestone Jun 23, 2026

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 23, 2026 06:56

Copilot started reviewing on behalf of cheenamalhotra June 23, 2026 06:56 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 23, 2026 08:11

Copilot started reviewing on behalf of cheenamalhotra June 23, 2026 08:11 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings June 24, 2026 02:42

Copilot started reviewing on behalf of cheenamalhotra June 24, 2026 02:42 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient/tests/Common/CommonUtils.cs Outdated

Comment thread src/Microsoft.Data.SqlClient/tests/Common/StringExtensions.cs Outdated

Comment thread src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs

Copilot AI review requested due to automatic review settings June 24, 2026 20:22

Copilot started reviewing on behalf of cheenamalhotra June 24, 2026 20:22 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

cheenamalhotra marked this pull request as ready for review June 25, 2026 00:50

cheenamalhotra requested review from a team and Copilot June 25, 2026 00:50

github-actions Bot assigned mdaigle and paulmedynski Jun 25, 2026

cheenamalhotra moved this from To triage to In review in SqlClient Board Jun 25, 2026

Copilot started reviewing on behalf of cheenamalhotra June 25, 2026 00:51 View session

cheenamalhotra assigned benrr101 Jun 25, 2026

Copilot AI reviewed Jun 25, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient/tests/Common/StringExtensions.cs

Comment thread src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs Outdated

Comment thread TESTGUIDE.md Outdated

benrr101 requested changes Jun 25, 2026

View reviewed changes

cheenamalhotra and others added 8 commits August 27, 2026 12:15

Remove unused AADAuthorityURL config as well

d881081

Changes from feedback

d35d78a

Update Azure config, cleanup

eb21856

CI changes

993fd25

Minor changes

8a929de

Touch-ups

7f62059

cheenamalhotra modified the milestones: 8.0.0-preview1, 7.1.0 Aug 27, 2026

Copilot AI review requested due to automatic review settings August 27, 2026 19:18

cheenamalhotra force-pushed the dev/cheena/aad-test-improvements branch from 857b56e to 7f62059 Compare August 27, 2026 19:18

Copilot started reviewing on behalf of cheenamalhotra August 27, 2026 19:18 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 27, 2026 19:30

Copilot started reviewing on behalf of cheenamalhotra August 27, 2026 19:31 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 28, 2026 02:57

Copilot started reviewing on behalf of cheenamalhotra August 28, 2026 02:58 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient.Extensions/Azure/test/AADConnectionTest.cs Outdated

Comment thread eng/pipelines/dotnet-sqlclient-ci-core.yml Outdated

Comment thread src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs Outdated

Fix Azure SQL test authentication

d5088a4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 556e4cc8-f9fd-46f1-aafa-1459e8659f99

Copilot AI review requested due to automatic review settings August 28, 2026 03:31

Copilot started reviewing on behalf of cheenamalhotra August 28, 2026 03:32 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient/tests/ManualTests/DataCommon/DataTestUtility.cs Outdated

Fall back to system managed identity

3a160c9

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 556e4cc8-f9fd-46f1-aafa-1459e8659f99

Copilot AI review requested due to automatic review settings August 28, 2026 04:20

Copilot started reviewing on behalf of cheenamalhotra August 28, 2026 04:20 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/ConnectionPoolTest/ConnectionPoolTest.cs

return string.Empty;

}

return new SqlConnectionStringBuilder(DataTestUtility.TCPConnectionString.RemoveAuthAndCredsProperties())

Uh oh!

Conversation

cheenamalhotra commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

CI migration

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented Jun 25, 2026

Codecov Report

Uh oh!

benrr101 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cheenamalhotra commented Jun 23, 2026 •

edited

Loading