Crate mssql_auth 

mssql-auth

Authentication strategies for SQL Server connections.

This crate provides various authentication methods, isolated from connection logic for better modularity and testing.

Supported Authentication Methods

Method	Feature Flag	Status	Description
SQL Authentication	default	✅ Implemented	Username/password
Azure AD Token	default	✅ Implemented	Pre-obtained access token
Azure Managed Identity	azure-identity	✅ Implemented	VM/container identity
Service Principal	azure-identity	✅ Implemented	App credentials
Integrated (Kerberos)	integrated-auth	✅ Implemented	GSSAPI/Kerberos (Linux/macOS)
Windows SSPI	sspi-auth	✅ Implemented	Native Windows SSPI
Certificate	cert-auth	✅ Implemented	Entra service principal w/ X.509 cert
Default chain	azure-identity	✅ Implemented	Managed identity → az/azd CLI session

CertificateAuth acquires a token from Microsoft Entra using an X.509 client certificate; mssql-client wires Credentials::Certificate through the FEDAUTH SecurityToken login. This authenticates to Entra — it is NOT TDS-level mutual TLS (SQL Server does not accept client certificates at the protocol level).

The Azure AD methods use the FEDAUTH SecurityToken workflow: the token is acquired client-side and sent in the LOGIN7 FEDAUTH feature extension (see azure_ad::build_security_token_feature_data). The interactive Entra flows (ActiveDirectoryPassword/Interactive/DeviceCodeFlow) are not built in — azure_identity ships no such credentials; acquire the token yourself and pass it as a pre-acquired access token.

Authentication Tiers

Per ARCHITECTURE.md, authentication is tiered:

Tier 1 (Core - Pure Rust, Default)

• SqlServerAuth - Username/password via Login7 ✅ Implemented
• AzureAdAuth - Pre-acquired access token ✅ Implemented

Tier 2 (Azure Native - azure-identity feature) ✅ Implemented

• ManagedIdentityAuth - Azure VM/Container identity
• ServicePrincipalAuth - Client ID + Secret
• DefaultAzureAuth - default chain (managed identity → az/azd CLI session)

Tier 3 (Enterprise - integrated-auth or sspi-auth feature) ✅ Implemented

• IntegratedAuth - Kerberos (Linux/macOS via GSSAPI)
• SspiAuth - Windows SSPI (native Windows, cross-platform via sspi-rs)

Tier 4 (Certificate - cert-auth feature) ✅ Implemented

• CertificateAuth - Entra service principal authentication with an X.509 certificate (authenticates to Entra, not TDS-level mTLS)

Secure Credential Handling

Enable the zeroize feature for secure credential handling:

mssql-auth = { version = "0.1", features = ["zeroize"] }

This enables secure credential handling that automatically zeroes sensitive data from memory when dropped.

Example

use mssql_auth::{SqlServerAuth, AzureAdAuth, AuthProvider};

// SQL Server authentication
let sql_auth = SqlServerAuth::new("sa", "Password123!");
let auth_data = sql_auth.authenticate().unwrap();

// Azure AD authentication with pre-acquired token
let azure_auth = AzureAdAuth::with_token("eyJ0eXAi...");

Re-exports

pub use credentials::Credentials;

pub use error::AuthError;

pub use provider::AsyncAuthProvider;

pub use provider::AuthData;

pub use provider::AuthMethod;

pub use provider::AuthProvider;

pub use azure_ad::AzureAdAuth;

pub use azure_ad::FedAuthLibrary;

pub use sql_auth::SqlServerAuth;

pub use credentials::SecretString;

pub use credentials::SecureCredentials;

pub use azure_identity_auth::DefaultAzureAuth;

pub use azure_identity_auth::ManagedIdentityAuth;

pub use azure_identity_auth::ServicePrincipalAuth;

pub use cert_auth::CertificateAuth;

pub use encryption::CekMetadata;

pub use encryption::ColumnEncryptionConfig;

pub use encryption::ColumnEncryptionInfo;

pub use encryption::EncryptedValue;

pub use encryption::EncryptionError;

pub use encryption::EncryptionType;

pub use encryption::KeyStoreProvider;

pub use aead::AeadEncryptor;

pub use key_store::CekCache;

pub use key_store::CekCacheKey;

pub use key_store::InMemoryKeyStore;

pub use key_unwrap::RsaKeyUnwrapper;

pub use azure_keyvault::AzureKeyVaultProvider;

Modules

aead

AEAD_AES_256_CBC_HMAC_SHA256 encryption algorithm for Always Encrypted.

azure_ad

Azure AD / Entra ID authentication implementation.

azure_identity_auth

Azure Identity authentication providers.

azure_keyvault

Azure Key Vault Column Master Key (CMK) provider for Always Encrypted.

cek_envelope

Canonical encrypted-CEK envelope codec for Always Encrypted.

cert_auth

Client certificate authentication provider.

credentials

Credential types for authentication.

encryption

Always Encrypted infrastructure for SQL Server.

error

Authentication error types.

key_store

Key store providers and CEK caching for Always Encrypted.

key_unwrap

RSA-OAEP key unwrapping for Always Encrypted.

provider

Authentication provider traits.

sql_auth

SQL Server authentication implementation.