azure-postgresql-auth mutates connect_args, breaking subsequent pooled SQLAlchemy connections

[pabloacan]

Reproduction

Create an AsyncEngine using the documented integration:

engine = create_async_engine(
    database_url,
    connect_args={"credential": DefaultAzureCredential()},
)
enable_entra_authentication_async(engine)

Open a connection, dispose or otherwise force the pool to create a second physical connection, then open another connection.

Actual behavior

The first connection succeeds. The next physical connection can fail with:

CredentialValueError: credential is required and must be a TokenCredential.

enable_entra_authentication_async registers a do_connect listener that removes credential from cparams after the token is resolved. SQLAlchemy retains the connect_args dictionary used by the pool creator, so a later connection no longer has the credential. The resolved password can also remain and become stale.

Expected behavior

Every newly created physical pooled connection should receive a TokenCredential and resolve a current Entra token without callers having to re-inject the credential.

Proposed fix

Avoid mutating the persistent connection arguments. Resolve credentials from a per-connection copy, or retain the helper credential while removing only it from the arguments passed to the DBAPI connection.

Environment

• azure-postgresql-auth 1.0.2
• SQLAlchemy 2.0.44
• psycopg 3
• AsyncEngine with connection pooling

[github-actions]

Thank you for your feedback. Tagging and routing to the team member(s) best able to assist.

//cc: @alxhghs @carlovi81 @mattboentoro @nasc17 @nehrao1 @rmendiza

[github-actions]

🎯 Agentic Issue Triage

Summary: enable_entra_authentication_async mutates the shared connect_args dictionary by removing the credential key after the first connection, causing subsequent pooled connections to fail with CredentialValueError: credential is required and must be a TokenCredential.

📋 Issue Details

Package: azure-postgresql-auth 1.0.2
Affected API: enable_entra_authentication_async / do_connect event listener
Scenarios:

• First physical connection succeeds; subsequent pooled connections fail because credential was removed from cparams
• Stale password may remain from a prior token resolution

Root ask: Fix enable_entra_authentication_async to work from a per-connection copy of the connection arguments rather than mutating the shared persistent dict.

🔎 Debugging / Reproduction Notes

The do_connect listener removes credential from cparams after resolving the token. Because SQLAlchemy's connection pool reuses the same connect_args dict across all physical connections, this mutation causes every connection after the first to lack the credential.

Suggested investigation steps:

1. Confirm the listener implementation in enable_entra_authentication_async modifies cparams in-place (e.g., cparams.pop("credential", None)).
2. Fix by creating a shallow copy of cparams inside the listener before any mutation, so the pool's connect_args remains intact.
3. Ensure the resolved password (token) is also applied to the per-connection copy and not persisted back to the shared dict.
4. Add a test that creates a second physical connection after the first to assert the credential is still present and a fresh token is fetched.

🏷️ Label Confidence

• Category: Client — azure-postgresql-auth is a data-plane client library (not azure-mgmt-*)
• Service: PostgreSQL Auth — issue is specifically about the azure-postgresql-auth package
• Confidence: High — package name explicitly stated in issue title and body; no ambiguity between service or category

👥 Owner Routing

• Matched CODEOWNERS entry: # ServiceLabel: %PostgreSQL Auth (line 692) — bottom-to-top scan, first match for "PostgreSQL Auth"
• AzureSdkOwners: none listed
• ServiceOwners: @alxhghs @carlovi81 @mattboentoro @nasc17 @nehrao1 @rmendiza
• Routing action: Added "Service Attention" and "needs-team-attention"; pinged ServiceOwners via mention comment
• Scan notes: Line 365 also contains # ServiceLabel: %PostgreSQL Auth but was encountered later in the bottom-to-top scan (lower line number = further from bottom); the line 692 entry was matched first

Generated by Agentic Triage for issue #48382 · 30.1 AIC · ⌖ 9.32 AIC · ⊞ 9.6K · ◷