AspNetCore.HealthChecks.NpgSql (Postgres) health check and Managed Identity on Azure

[steingran]

The current health check for Postgres (AspNetCore.HealthChecks.NpgSql, version 6.0.2) does not support Azure Managed Identity tokens as far as I can see.

Are there any workarounds for this, or any plans on adding support for Managed Identity tokens?

Using Managed Identity tokens is increasingly normal to use, so supporting this scenario would be great.

[sungam3r]

What kind of support are you talking about? Could you provide example?

[steingran]

It is basically this scenario: https://learn.microsoft.com/en-us/azure/app-service/tutorial-connect-msi-azure-database?tabs=sqldatabase%2Csystemassigned%2Cnetfx%2Cwindowsclient

So we are using PostgreSQL on Azure, and do not want to use username/password as authentication, but rather Azure Managed Identity.

[rob-baldwin]

Hi @steingran, what failures are you getting? As far as I can see, the healtcheck supports a connection string, and the managed identity is just a way of creating the credentials for the connectionstring without the need for storing the credentials, e.g.

var credential = new DefaultAzureCredential();

var token = credential.GetToken(new Azure.Core.TokenRequestContext(new[] { "https://ossrdbms-aad.database.windows.net/.default" }));

string postgresqlUser;
if (String.IsNullOrEmpty(Environment.GetEnvironmentVariable("IDENTITY_ENDPOINT")))
    postgresqlUser = "<aad-user-name>@<server-name>";
else postgresqlUser = "<postgresql-user-name>@<server-name>";

var connectionString = "Server=<server-name>.postgres.database.azure.com;" + 
    "Port=5432;" + 
    "Database=<database-name>;" + 
    "User Id=" + postgresqlUser + ";" +
    "Password="+ token.Token;

services.AddHealthChecks().AddNpgSql(connectionString);

(Majority of the code was copied from the tutorial you linked)

[michaelmairegger]

The issue with this is that the token has an expiration time. After that the connectionString is not valid anymore

[michaelmairegger]

I have some working code for this issue. I will provide a PR for that issue. There shouln't be any breaking changes for existings code