Fix Session Context Key set as Read_Only & maintain original roles from the JWT token #2344

M4Al · 2024-08-20T20:43:28Z

Why make this change?

Fixes [Bug]: MSSQL (and related) - EXEC sp_set_session_context is executed with @read_only = 1 #2341
- The session context in SQL server is read_only = 1 which prevents users from doing multiple requests on the same connection.
- The row level security is not accurately implemented when using a JWT token.

What is this change?

Changes the session context from read_only = 1 to read_only = 0 to allow multiple requests to be done in the same connection,
Creates a copy of the original 'roles' from the JWT token to use it on the SQL Filter Predicate to accurately implement row level security.

How was this tested?

Integration Tests
Unit Tests

Updated AuthorizationResolver tests to ensure the original roles copy is working properly.

Sample Request(s)

Sample of a JWT token (only the relevant part)

{
  "aud": "api://ddcf6b31-5d01-407d-97cf-8efefc455d32",
  "iss": "https://sts.windows.net/9215c785-95c3-49b0-bdba-2062df5aedb5/",
  "roles": [
    "user",
    "Allow_Customer_OPS025235",
    "Allow_Customer_OPS004095"
  ],
  "ver": "1.0"
}

X-MS-API-ROLE: user

before my change the extra 'roles' that do not match the X-MS-API-ROLE header would never reach the database context.
With my change you can do things like this in SQL Predicates to filter out only subsets of the data:

CREATE FUNCTION dbo.ops_fact_order_Predicate(@CustomerNo varchar(max))
RETURNS TABLE
WITH SCHEMABINDING
AS RETURN SELECT 1 AS fn_securitypredicate_result
WHERE @CustomerNo in (
		select trim(replace(replace(replace([value], '"', ''), ']', ''), 'Allow_Customer_', '')) 
		from STRING_SPLIT ( 
			CAST(SESSION_CONTEXT(N'original_roles') as varchar(max)) 
			, ',' 
			, 0) 
			where trim(replace(replace([value], '"', ''), ']', '')) like 'Allow_Customer%'
		)

CREATE SECURITY POLICY dbo.ops_fact_order_Policy
ADD FILTER PREDICATE dbo.ops_fact_order_Predicate(CustomerNo)
ON [gold_ops].[ops_fact_order];

src/Core/Resolvers/MsSqlQueryExecutor.cs

Aniruddh25

Thanks for this smart change to provide the original roles for additional filtering. Left a few nit comments and some questions, looks good to merge otherwise!

Aniruddh25 · 2024-08-30T00:32:14Z

/azp run

src/Core/Parsers/RequestParser.cs

Aniruddh25

The original PR contained fewer changes, please restrict the changes to the purpose of the PR and lets not add additional changes in the same PR. Waiting for removing the unnecessary changes

src/Core/Resolvers/SqlResponseHelpers.cs

src/Directory.Packages.props

Dockerfile

abhishekkumams · 2024-12-03T05:24:11Z

@M4Al , let us know if you would be able to address the comments...

JerryNixon · 2025-03-26T20:41:02Z

@Aniruddh25 is this something we could wrap?

Aniruddh25 · 2025-03-28T23:18:09Z

@Aniruddh25 is this something we could wrap?

The original PR was useful. It now contains additional changes which are not really necessary like $top, DwSQL builder changes. We need to clean those up before merging this in.
@RubenCerna2079, could you please take this task up?

Aniruddh25 · 2025-03-28T23:21:33Z

@M4Al, we will take this PR forward and merge from here.

Added a new constant `ORIGINAL_ROLE_CLAIM_TYPE` in `AuthenticationOptions.cs` to store the original roles claim type. Modified `AuthorizationResolver` to preserve the original 'roles' claim by adding it to the `resolvedClaims` dictionary under the new key. Changed `MsSqlQueryExecutor` to set session context parameters with `@read_only = 0` to allow modifications.

This reverts commit 08f741c.

remove trailing space Co-authored-by: Aniruddh Munde <[email protected]>

Aniruddh25 · 2025-07-04T00:00:50Z

/azp run

azure-pipelines · 2025-07-04T00:01:17Z

Azure Pipelines successfully started running 6 pipeline(s).

RubenCerna2079 · 2025-08-11T17:11:40Z

/azp run

azure-pipelines · 2025-08-11T17:12:05Z

Azure Pipelines successfully started running 6 pipeline(s).

RubenCerna2079 · 2025-08-12T23:20:16Z

/azp run

azure-pipelines · 2025-08-12T23:20:40Z

Azure Pipelines successfully started running 6 pipeline(s).

Aniruddh25

LGTM, thank you for fixing this!

Aniruddh25 · 2025-08-15T23:48:33Z

/azp run

azure-pipelines · 2025-08-15T23:48:57Z

Azure Pipelines successfully started running 6 pipeline(s).

RubenCerna2079

LGTM

souvikghosh04

LGTM

souvikghosh04 · 2025-08-19T03:03:41Z

/azp run

azure-pipelines · 2025-08-19T03:04:05Z

Azure Pipelines successfully started running 6 pipeline(s).

Aniruddh25 · 2025-08-19T17:05:35Z

/azp run

azure-pipelines · 2025-08-19T17:06:02Z

Azure Pipelines successfully started running 6 pipeline(s).

…om the JWT token (#2344) ## Why make this change? - Fixes #2341 - The session context in SQL server is `read_only = 1` which prevents users from doing multiple requests on the same connection. - The row level security is not accurately implemented when using a JWT token. ## What is this change? Changes the session context from `read_only = 1` to `read_only = 0` to allow multiple requests to be done in the same connection, Creates a copy of the original 'roles' from the JWT token to use it on the SQL Filter Predicate to accurately implement row level security. ## How was this tested? - [ ] Integration Tests - [x] Unit Tests Updated `AuthorizationResolver` tests to ensure the original roles copy is working properly. ## Sample Request(s) Sample of a JWT token (only the relevant part) ``` { "aud": "api://ddcf6b31-5d01-407d-97cf-8efefc455d32", "iss": "https://sts.windows.net/9215c785-95c3-49b0-bdba-2062df5aedb5/", "roles": [ "user", "Allow_Customer_OPS025235", "Allow_Customer_OPS004095" ], "ver": "1.0" } ``` X-MS-API-ROLE: user before my change the extra 'roles' that do not match the X-MS-API-ROLE header would never reach the database context. With my change you can do things like this in SQL Predicates to filter out only subsets of the data: ``` CREATE FUNCTION dbo.ops_fact_order_Predicate(@CustomerNo varchar(max)) RETURNS TABLE WITH SCHEMABINDING AS RETURN SELECT 1 AS fn_securitypredicate_result WHERE @CustomerNo in ( select trim(replace(replace(replace([value], '"', ''), ']', ''), 'Allow_Customer_', '')) from STRING_SPLIT ( CAST(SESSION_CONTEXT(N'original_roles') as varchar(max)) , ',' , 0) where trim(replace(replace([value], '"', ''), ']', '')) like 'Allow_Customer%' ) CREATE SECURITY POLICY dbo.ops_fact_order_Policy ADD FILTER PREDICATE dbo.ops_fact_order_Predicate(CustomerNo) ON [gold_ops].[ops_fact_order]; ``` --------- Co-authored-by: KobeLenjou <[email protected]> Co-authored-by: Aniruddh Munde <[email protected]> Co-authored-by: Ruben Cerna <[email protected]> Co-authored-by: RubenCerna2079 <[email protected]>

## Why make this change? - The 1.6 release is missing the implementation for the File Sink feature, as well as the bug fixes to fix the session context and fix implementation of row-level security when users use a JWT token. ## What is this change? Cherry-picked PRs: - File Sink: - #2752 - #2825 - #2818 - Bug Fix: - #2344 ## How was this tested? - [ ] Integration Tests - [X] Unit Tests --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: M4Al <[email protected]> Co-authored-by: KobeLenjou <[email protected]> Co-authored-by: Aniruddh Munde <[email protected]>

M4Al requested review from Aniruddh25, seantleonard, aaronburtle, abhishekkumams, RubenCerna2079, ravishetye, rohkhann, neeraj-sharma2592 and sourabh1007 as code owners August 20, 2024 20:43

Aniruddh25 reviewed Aug 30, 2024

View reviewed changes

src/Core/Resolvers/MsSqlQueryExecutor.cs Outdated Show resolved Hide resolved

Aniruddh25 reviewed Aug 30, 2024

View reviewed changes

src/Core/Resolvers/MsSqlQueryExecutor.cs Show resolved Hide resolved

Aniruddh25 approved these changes Aug 30, 2024

View reviewed changes

Aniruddh25 reviewed Sep 6, 2024

View reviewed changes

src/Core/Parsers/RequestParser.cs Outdated Show resolved Hide resolved

Aniruddh25 requested changes Sep 6, 2024

View reviewed changes

src/Core/Resolvers/SqlResponseHelpers.cs Outdated Show resolved Hide resolved

src/Directory.Packages.props Outdated Show resolved Hide resolved

Aniruddh25 reviewed Sep 9, 2024

View reviewed changes

Dockerfile Outdated Show resolved Hide resolved

JerryNixon mentioned this pull request Nov 25, 2024

[Enhancement]: Provide $top as a synonym for $first in REST #2474

Open

JerryNixon requested a review from Aniruddh25 March 26, 2025 20:43

Aniruddh25 assigned RubenCerna2079 Mar 28, 2025

Mu4all and others added 7 commits May 21, 2025 17:44

pp

60dd852

Revert "pp"

bc468ed

This reverts commit 08f741c.

Adjust the relevant tests

ab4fe75

Add recordcount

93a27dc

Update src/Core/Resolvers/MsSqlQueryExecutor.cs

ec0365b

remove trailing space Co-authored-by: Aniruddh Munde <[email protected]>

Update dockerfile to .net8

2cecda7

Aniruddh25 added this to the 1.6 milestone Jul 8, 2025

Aniruddh25 linked an issue Jul 9, 2025 that may be closed by this pull request

[Enhancement]: Add Support for Record Count in GraphQL Responses #2754

Closed

Merge branch 'main' into fix_context_sql

d40e1a5

RubenCerna2079 added the 1.6-rc2 label Aug 11, 2025

Delete record count

db82352

RubenCerna2079 changed the title ~~Fix Session Context Key set as Read_Only~~ Fix Session Context Key set as Read_Only & Maintain original roles from the JWT token Aug 13, 2025

RubenCerna2079 changed the title ~~Fix Session Context Key set as Read_Only & Maintain original roles from the JWT token~~ Fix Session Context Key set as Read_Only & maintain original roles from the JWT token Aug 13, 2025

Merge branch 'main' into fix_context_sql

5c51483

Aniruddh25 approved these changes Aug 15, 2025

View reviewed changes

RubenCerna2079 approved these changes Aug 16, 2025

View reviewed changes

RubenCerna2079 enabled auto-merge (squash) August 16, 2025 00:07

souvikghosh04 approved these changes Aug 19, 2025

View reviewed changes

Merge branch 'main' into fix_context_sql

252f1e4

RubenCerna2079 merged commit 5e3e5e2 into Azure:main Aug 19, 2025
11 checks passed

RubenCerna2079 mentioned this pull request Aug 22, 2025

Cherry-Pick File Sink & Bug Fixes for 1.6 Release #2852

Merged

2 tasks

Fix Session Context Key set as Read_Only & maintain original roles from the JWT token #2344

Fix Session Context Key set as Read_Only & maintain original roles from the JWT token #2344

Uh oh!

Conversation

M4Al commented Aug 20, 2024 • edited by RubenCerna2079 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why make this change?

What is this change?

How was this tested?

Sample Request(s)

Uh oh!

Uh oh!

Uh oh!

Aniruddh25 left a comment

Choose a reason for hiding this comment

Uh oh!

Aniruddh25 commented Aug 30, 2024

Uh oh!

Uh oh!

Aniruddh25 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

abhishekkumams commented Dec 3, 2024

Uh oh!

JerryNixon commented Mar 26, 2025

Uh oh!

Aniruddh25 commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Aniruddh25 commented Mar 28, 2025

Uh oh!

Aniruddh25 commented Jul 4, 2025

Uh oh!

azure-pipelines bot commented Jul 4, 2025

Uh oh!

RubenCerna2079 commented Aug 11, 2025

Uh oh!

azure-pipelines bot commented Aug 11, 2025

Uh oh!

RubenCerna2079 commented Aug 12, 2025

Uh oh!

azure-pipelines bot commented Aug 12, 2025

Uh oh!

Aniruddh25 left a comment

Choose a reason for hiding this comment

Uh oh!

Aniruddh25 commented Aug 15, 2025

Uh oh!

azure-pipelines bot commented Aug 15, 2025

Uh oh!

RubenCerna2079 left a comment

Choose a reason for hiding this comment

Uh oh!

souvikghosh04 left a comment

Choose a reason for hiding this comment

Uh oh!

souvikghosh04 commented Aug 19, 2025

Uh oh!

azure-pipelines bot commented Aug 19, 2025

Uh oh!

Aniruddh25 commented Aug 19, 2025

Uh oh!

azure-pipelines bot commented Aug 19, 2025

Uh oh!

Uh oh!

Uh oh!

M4Al commented Aug 20, 2024 •

edited by RubenCerna2079

Loading

Aniruddh25 commented Mar 28, 2025 •

edited

Loading