mssql_auth/
lib.rs

1//! # mssql-auth
2//!
3//! Authentication strategies for SQL Server connections.
4//!
5//! This crate provides various authentication methods, isolated from
6//! connection logic for better modularity and testing.
7//!
8//! ## Supported Authentication Methods
9//!
10//! | Method | Feature Flag | Status | Description |
11//! |--------|--------------|--------|-------------|
12//! | SQL Authentication | default | ✅ Implemented | Username/password |
13//! | Azure AD Token | default | ✅ Implemented | Pre-obtained access token |
14//! | Azure Managed Identity | `azure-identity` | ✅ Implemented | VM/container identity |
15//! | Service Principal | `azure-identity` | ✅ Implemented | App credentials |
16//! | Integrated (Kerberos) | `integrated-auth` | ✅ Implemented | GSSAPI/Kerberos (Linux/macOS) |
17//! | Windows SSPI | `sspi-auth` | ✅ Implemented | Native Windows SSPI |
18//! | Certificate | `cert-auth` | ✅ Implemented | Client certificate (mTLS) |
19//!
20//! ## Authentication Tiers
21//!
22//! Per ARCHITECTURE.md, authentication is tiered:
23//!
24//! ### Tier 1 (Core - Pure Rust, Default) ✅ Implemented
25//!
26//! - [`SqlServerAuth`] - Username/password via Login7
27//! - [`AzureAdAuth`] - Pre-acquired access token
28//!
29//! ### Tier 2 (Azure Native - `azure-identity` feature) ✅ Implemented
30//!
31//! - `ManagedIdentityAuth` - Azure VM/Container identity
32//! - `ServicePrincipalAuth` - Client ID + Secret
33//!
34//! ### Tier 3 (Enterprise - `integrated-auth` or `sspi-auth` feature) ✅ Implemented
35//!
36//! - `IntegratedAuth` - Kerberos (Linux/macOS via GSSAPI)
37//! - `SspiAuth` - Windows SSPI (native Windows, cross-platform via sspi-rs)
38//!
39//! ### Tier 4 (Certificate - `cert-auth` feature) ✅ Implemented
40//!
41//! - `CertificateAuth` - Client certificate authentication (mTLS)
42//!
43//! ## Secure Credential Handling
44//!
45//! Enable the `zeroize` feature for secure credential handling:
46//!
47//! ```toml
48//! mssql-auth = { version = "0.1", features = ["zeroize"] }
49//! ```
50//!
51//! This enables secure credential handling that automatically zeroes
52//! sensitive data from memory when dropped.
53//!
54//! ## Example
55//!
56//! ```rust
57//! use mssql_auth::{SqlServerAuth, AzureAdAuth, AuthProvider};
58//!
59//! // SQL Server authentication
60//! let sql_auth = SqlServerAuth::new("sa", "Password123!");
61//! let auth_data = sql_auth.authenticate().unwrap();
62//!
63//! // Azure AD authentication with pre-acquired token
64//! let azure_auth = AzureAdAuth::with_token("eyJ0eXAi...");
65//! ```
66
67#![warn(missing_docs)]
68// Unsafe code is denied globally but allowed in the Windows CNG FFI module.
69// See windows_certstore.rs for detailed SAFETY comments on each unsafe block.
70#![deny(unsafe_code)]
71
72pub mod azure_ad;
73#[cfg(feature = "azure-identity")]
74pub mod azure_identity_auth;
75#[cfg(feature = "cert-auth")]
76pub mod cert_auth;
77pub mod credentials;
78pub mod encryption;
79pub mod error;
80#[cfg(feature = "integrated-auth")]
81pub mod integrated_auth;
82#[cfg(all(windows, feature = "sspi-auth"))]
83#[allow(unsafe_code)] // Windows SSPI FFI; see SAFETY comments in each unsafe block
84pub mod native_sspi;
85#[cfg(any(feature = "integrated-auth", feature = "sspi-auth"))]
86pub mod negotiator;
87pub mod provider;
88pub mod sql_auth;
89#[cfg(feature = "sspi-auth")]
90pub mod sspi_auth;
91
92// Always Encrypted cryptography
93#[cfg(feature = "always-encrypted")]
94pub mod aead;
95#[cfg(feature = "always-encrypted")]
96pub mod key_store;
97#[cfg(feature = "always-encrypted")]
98pub mod key_unwrap;
99
100// Always Encrypted key providers
101#[cfg(feature = "azure-keyvault")]
102pub mod azure_keyvault;
103#[cfg(all(windows, feature = "windows-certstore"))]
104#[allow(unsafe_code)] // Windows CNG FFI; see SAFETY comments in each unsafe block
105pub mod windows_certstore;
106
107// Core types
108pub use credentials::Credentials;
109pub use error::AuthError;
110pub use provider::{AsyncAuthProvider, AuthData, AuthMethod, AuthProvider};
111
112// Authentication providers
113pub use azure_ad::{AzureAdAuth, FedAuthLibrary};
114pub use sql_auth::SqlServerAuth;
115
116// Secure credential types (with zeroize feature)
117#[cfg(feature = "zeroize")]
118pub use credentials::{SecretString, SecureCredentials};
119
120// Azure Identity authentication (with azure-identity feature)
121#[cfg(feature = "azure-identity")]
122pub use azure_identity_auth::{ManagedIdentityAuth, ServicePrincipalAuth};
123
124// Integrated authentication (Kerberos/GSSAPI - with integrated-auth feature)
125#[cfg(feature = "integrated-auth")]
126pub use integrated_auth::IntegratedAuth;
127
128// Certificate authentication (Azure AD with X.509 certificate - with cert-auth feature)
129#[cfg(feature = "cert-auth")]
130pub use cert_auth::CertificateAuth;
131
132// Native Windows SSPI authentication (with sspi-auth feature, Windows only)
133#[cfg(all(windows, feature = "sspi-auth"))]
134pub use native_sspi::NativeSspiAuth;
135
136// Windows SSPI authentication via sspi-rs (with sspi-auth feature)
137#[cfg(feature = "sspi-auth")]
138pub use sspi_auth::SspiAuth;
139
140// SSPI/GSSAPI negotiator trait (with integrated-auth or sspi-auth feature)
141#[cfg(any(feature = "integrated-auth", feature = "sspi-auth"))]
142pub use negotiator::SspiNegotiator;
143
144// Always Encrypted infrastructure
145pub use encryption::{
146    CekMetadata, ColumnEncryptionConfig, ColumnEncryptionInfo, EncryptedValue, EncryptionError,
147    EncryptionType, KeyStoreProvider,
148};
149
150// Always Encrypted cryptography (with always-encrypted feature)
151#[cfg(feature = "always-encrypted")]
152pub use aead::AeadEncryptor;
153#[cfg(feature = "always-encrypted")]
154pub use key_store::{CekCache, CekCacheKey, InMemoryKeyStore};
155#[cfg(feature = "always-encrypted")]
156pub use key_unwrap::RsaKeyUnwrapper;
157
158// Always Encrypted key providers
159#[cfg(feature = "azure-keyvault")]
160pub use azure_keyvault::AzureKeyVaultProvider;
161#[cfg(all(windows, feature = "windows-certstore"))]
162pub use windows_certstore::WindowsCertStoreProvider;
mssql_auth/lib.rs

mssql_auth/
lib.rs
