Add Azure managed identity Postgres DB login support

[nbjohnson]

Add Azure managed identity Postgres DB login support

[dopey]

Hey @nbjohnson 👋 . Thanks for opening the issue!

Discussed this issue with the team today and below are our thoughts:

We don't want to introduce new inconsistencies in support for platforms. So, we would need to implement and maintain similar login support for other popular clouds. We do not want to be on the hook for maintaining managed identity support across cloud platforms.

Instead, we believe that this type of support may already be possible using the PG environment variables. We use the pgx client which should have support for respecting those environment variables. So, instead of us building in support for a new authentication method, users could hopefully leverage existing support by setting the PGPASS variable to whatever they like. Could you try this out and let us know the results?

cheers 🍻

[nbjohnson]

@dopey Thanks for taking a look at my request. Yes I did see the ability to pass creds with those environment variables which I also think would work. However, I don't think that is the limiting factor here. To use an identity means the credential is only valid for a short time, so I think code would need to be added to be able to periodically retrieve a new credential and to make sure it does that before the existing short lived cred expires

[dopey]

After discussion with the team, we're not looking to add authorization methods to smallstep/nosql, with the exception of x509 certificate based authentication. Users can already exchange Azure managed identity credentials for certificates (using the IID provisioners). The remaining part would be integrating client certificate authentication into smallstep/nosql as well as providing tooling around renewal.

Unfortunately, we don't have the resourcing to prioritize integrating certificate based authentication against the storage layer at this time. If someone from the community is interested in taking this on, let us know and we can chat about requirements.