Azure SQL Server - Active Directory Admin about farmer

[isaacabraham]

Hey @gursharan001 . Sorry for the slow response. Yes, I would definitely support adding this functionality. Happy to help in terms of API design etc.. I'm sure @ninjarobot would be happy as well to lend some advice.

[gursharan001]

Thanks @isaacabraham @ninjarobot

I thought API could be something like below

type ActiveDirectoryPrincipalType = User | Group

type ActiveDirectoryAdminSettings =
    {
         /// Active Directory name of user or group
         Login: string
         /// Active Directory object id of user or group
         Sid: string
         PrincipalType: ActiveDirectoryPrincipalType
         AdOnlyAuth: bool
    }

and then Farmers.Builders.SqlAzure.SqlAzureConfig updated as

type SqlAzureConfig =
    {
        Name: SqlAccountName
        AdministratorCredentials: {| UserName: string
                                     Password: SecureParameter |}
        /// new setting
        ActiveDirectoryAdmin: ActiveDirectoryAdminSettings option

        MinTlsVersion: TlsVersion option
        FirewallRules: {| Name: ResourceName
                          Start: IPAddress
                          End: IPAddress |} list
        ElasticPoolSettings: {| Name: ResourceName option
                                Sku: PoolSku
                                PerDbLimits: {| Min: int<DTU>; Max: int<DTU> |} option
                                Capacity: int<Mb> option |}
        Databases: SqlAzureDbConfig list
        GeoReplicaServer: GeoReplicationSettings option
        Tags: Map<string, string>
    }

for scenario when AdOnlyAuth is true, Farmers.Builders.SqlAzure.SqlServerBuilder.Run might raise an error or silently ignore the password if provided. I prefer raising an error.

What are your thoughts?

[ninjarobot]

@gursharan001 thanks for the proposal. The config structure looks good - do you know if both the SID and the login name are required or can either work?

As far as the password, it's a SecureParameter and Farmer can control whether to emit a parameter for it, so I suggest that when AdOnlyAuth is set to true, just don't emit one.

[gursharan001]

@ninjarobot yes both SID and login are required. I will submit a PR soon. Thanks!

[gursharan001]

@isaacabraham / @ninjarobot , please review the PR when you get a chance