Expose SSPI context provider as public #2494

twsouthwick · 2024-05-08T16:24:42Z

This change:

Adds a property to SqlConnection to allow setting a provider
Plumbs that property into the TdsParser so that it can be used if set

codecov · 2025-03-03T22:01:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.07%. Comparing base (d05100e) to head (77cab44).
⚠️ Report is 110 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (d05100e) and HEAD (77cab44). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (d05100e) HEAD (77cab44)

addons 1 0

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2494      +/-   ##
==========================================
- Coverage   77.23%   70.07%   -7.17%     
==========================================
  Files         274      266       -8     
  Lines       45671    43873    -1798     
==========================================
- Hits        35273    30742    -4531     
- Misses      10398    13131    +2733

Flag	Coverage Δ
addons	`?`
netcore	`70.09% <ø> (-7.08%)`	⬇️
netfx	`69.44% <ø> (-6.98%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs

benrr101

Overall, really like the goal and implementation. Most of my comments are style related, since I'm sure my colleagues have tackled the bigger questions.

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NativeSSPIContextProvider.cs

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SSPIContextProvider.cs

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlConnectionPoolKey.cs

paulmedynski

Made an initial pass, and came up with some questions/comments.

doc/snippets/Microsoft.Data.SqlClient/SSPIContextProvider.xml

doc/snippets/Microsoft.Data.SqlClient/SqlConnection.xml

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NegotiateSSPIContextProvider.cs

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlConnectionPoolKey.cs

paulmedynski

Factory vs instance in the netfx code, and a few questions about docs.

doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs

src/Microsoft.Data.SqlClient/netfx/src/Microsoft/Data/SqlClient/SqlInternalConnectionTds.cs

nhart12

Latest package still works for our use-case

github-actions · 2026-01-02T02:38:55Z

This pull request has been marked as stale due to inactivity for more than 30 days.

If you would like to keep this pull request open, please provide an update or respond to any comments. Otherwise, it will be closed automatically in 7 days.

0xced · 2026-01-07T07:49:35Z

@mdaigle Did the threat model review take place?

cheenamalhotra · 2026-01-07T17:42:21Z

@mdaigle Did the threat model review take place?

We are aiming to get it done in this month.

github-actions · 2026-02-12T03:00:53Z

This pull request has been marked as stale due to inactivity for more than 30 days.

If you would like to keep this pull request open, please provide an update or respond to any comments. Otherwise, it will be closed automatically in 7 days.

0xced · 2026-02-12T06:43:27Z

I understand why stale bots exist, still, I hate them.

mdaigle · 2026-02-12T19:42:29Z

Security review is complete. Waiting for builds to pass, then we'll get this final review and approval.

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlConnection.cs:807

The SspiContextProvider property setter is missing validation to prevent setting the property after a connection has been opened or is connecting. This validation is present in similar properties like Credential, AccessToken, and AccessTokenCallback which check InnerConnection.AllowSetConnectionString and throw ADP.OpenConnectionPropertySet if the connection state doesn't allow changes. Add the same check here for consistency and to prevent unexpected behavior.

        public SspiContextProvider SspiContextProvider
        {
            get { return _sspiContextProvider; }
            set
            {
                ConnectionString_Set(new SqlConnectionPoolKey(_connectionString, credential: _credential, accessToken: null, accessTokenCallback: null, sspiContextProvider: value));
                _sspiContextProvider = value;
            }
        }

Copilot · 2026-02-12T19:49:21Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs

+        public string UserId { get; set; }
+
+        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/DatabaseName'/>
+        public string DatabaseName { get; set; }
+
+        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/Password'/>
+        public string Password { get; set; }


The reference assembly is missing nullable annotations for the UserId, DatabaseName, and Password properties. These properties are declared as nullable (string?) in the implementation file (SspiAuthenticationParameters.cs) but are declared as non-nullable (string) in the reference assembly. The reference assembly should match the implementation by declaring these as string? to accurately reflect the API surface.

Suggested change

public string UserId { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/DatabaseName'/>

public string DatabaseName { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/Password'/>

public string Password { get; set; }

public string? UserId { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/DatabaseName'/>

public string? DatabaseName { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/Password'/>

public string? Password { get; set; }

Copilot · 2026-02-12T19:49:21Z

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs

+        public string UserId { get; set; }
+
+        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/DatabaseName'/>
+        public string DatabaseName { get; set; }
+
+        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/Password'/>
+        public string Password { get; set; }


The reference assembly is missing nullable annotations for the UserId, DatabaseName, and Password properties. These properties are declared as nullable (string?) in the implementation file (SspiAuthenticationParameters.cs) but are declared as non-nullable (string) in the reference assembly. The reference assembly should match the implementation by declaring these as string? to accurately reflect the API surface.

Suggested change

public string UserId { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/DatabaseName'/>

public string DatabaseName { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/Password'/>

public string Password { get; set; }

public string? UserId { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/DatabaseName'/>

public string? DatabaseName { get; set; }

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiAuthenticationParameters.xml' path='docs/members[@name="SspiAuthenticationParameters"]/SspiAuthenticationParameters/Password'/>

public string? Password { get; set; }

Copilot · 2026-02-12T19:49:22Z

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SspiContextProvider.cs


        private protected TdsParserStateObject _physicalStateObj = null!;

+        /// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/*'/>


The XML documentation comment for the constructor references the wrong XPath. It should reference /ctor instead of /SspiContextProvider, which is the element for the class summary. This causes the wrong documentation to be displayed for the constructor.

Suggested change

/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/*'/>

/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/ctor/*'/>

Copilot · 2026-02-12T19:49:22Z

...SqlClient/tests/ManualTests/SQL/IntegratedAuthenticationTest/IntegratedAuthenticationTest.cs

+                Assert.Equal(sspi.AuthParams.Password, builder.Password);
+            }
+        }
+


Test coverage is missing for several important scenarios:

Setting property after connection is open: A test should verify that setting SspiContextProvider after opening the connection throws InvalidOperationException (this will be needed once the setter validation is added).

Null provider: Test that setting the provider to null works and falls back to the default platform implementation.

Connection pooling: Test that connections with different providers use separate pool groups (since provider is part of the pool key).

Multiple sequential opens with same provider: Test that the same provider instance can be reused across multiple connection open/close cycles.

Suggested change

[ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]

public static void SettingSspiContextProviderAfterOpen_ThrowsInvalidOperationException()

{

SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);

builder.IntegratedSecurity = true;

Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));

// Build the SPN for the server we are connecting to

builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";

if (!string.IsNullOrWhiteSpace(instanceName))

{

builder.ServerSPN += ":" + instanceName;

}

using SqlConnection conn = new(builder.ConnectionString);

conn.Open();

Assert.Throws<InvalidOperationException>(() => conn.SspiContextProvider = new TestSspiContextProvider());

}

[ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]

public static void NullSspiContextProvider_FallsBackToDefault()

{

SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);

builder.IntegratedSecurity = true;

Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));

// Build the SPN for the server we are connecting to

builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";

if (!string.IsNullOrWhiteSpace(instanceName))

{

builder.ServerSPN += ":" + instanceName;

}

using SqlConnection conn = new(builder.ConnectionString)

{

SspiContextProvider = null,

};

// If null correctly falls back to the default platform implementation,

// opening the connection should succeed without throwing.

conn.Open();

}

[ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]

public static void DifferentSspiContextProviders_UsedPerConnection()

{

SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);

builder.IntegratedSecurity = true;

Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));

// Build the SPN for the server we are connecting to

builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";

if (!string.IsNullOrWhiteSpace(instanceName))

{

builder.ServerSPN += ":" + instanceName;

}

using SqlConnection conn1 = new(builder.ConnectionString)

{

SspiContextProvider = new TestSspiContextProvider(),

};

using SqlConnection conn2 = new(builder.ConnectionString)

{

SspiContextProvider = new TestSspiContextProvider(),

};

// Each connection should use its own configured provider when opening.

Assert.Throws<SspiTestException>(() => conn1.Open());

Assert.Throws<SspiTestException>(() => conn2.Open());

}

[ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]

public static void MultipleSequentialOpensWithSameProvider_ReuseSupported()

{

SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);

builder.IntegratedSecurity = true;

Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));

// Build the SPN for the server we are connecting to

builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";

if (!string.IsNullOrWhiteSpace(instanceName))

{

builder.ServerSPN += ":" + instanceName;

}

using SqlConnection conn = new(builder.ConnectionString)

{

SspiContextProvider = new TestSspiContextProvider(),

};

// Reuse the same provider instance across multiple open attempts.

for (int i = 0; i < 3; i++)

{

Assert.Throws<SspiTestException>(() => conn.Open());

}

}

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

Comments suppressed due to low confidence (1)

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlConnection.cs:807

The SspiContextProvider property setter is missing critical validation that exists in other similar properties (Credential, AccessToken, AccessTokenCallback). Since this property affects the connection pool key, it must validate that the connection is not already open or opening before allowing the value to be changed.

Add the following validation at the start of the setter:

if (!InnerConnection.AllowSetConnectionString)
{
    throw ADP.OpenConnectionPropertySet(nameof(SspiContextProvider), InnerConnection.State);
}

This prevents runtime errors when users attempt to change the SSPI provider on an active connection and maintains consistency with the established pattern for pool-key-affecting properties.

        public SspiContextProvider SspiContextProvider
        {
            get { return _sspiContextProvider; }
            set
            {
                ConnectionString_Set(new SqlConnectionPoolKey(_connectionString, credential: _credential, accessToken: null, accessTokenCallback: null, sspiContextProvider: value));
                _sspiContextProvider = value;
            }
        }

Copilot · 2026-02-12T23:19:43Z

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs

    }
+    /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/*'/>
+    public abstract class SspiContextProvider
+    {


The reference assembly is missing the protected constructor for SspiContextProvider. Since the implementation has a protected SspiContextProvider() constructor (line 26 in the implementation), the reference assembly should declare it as well to accurately reflect the public API surface.

Add the constructor declaration:

protected SspiContextProvider() { }

This ensures that external consumers can see that the constructor is protected and available for derived classes.

Suggested change

{

{

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/ctor'/>

protected SspiContextProvider() { }

Copilot · 2026-02-12T23:19:43Z

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs

    }
+    /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/*'/>
+    public abstract class SspiContextProvider
+    {


The reference assembly is missing the protected constructor for SspiContextProvider. Since the implementation has a protected SspiContextProvider() constructor (line 26 in the implementation), the reference assembly should declare it as well to accurately reflect the public API surface.

Add the constructor declaration:

protected SspiContextProvider() { }

This ensures that external consumers can see that the constructor is protected and available for derived classes.

Suggested change

{

{

/// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/ctor'/>

protected SspiContextProvider() { }

Copilot · 2026-02-12T23:19:43Z

doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml

+      <summary>Generates an SSPI outgoing blob given the incoming blob.</summary>
+      <param name="incomingBlob">Incoming blob</param>
+      <param name="outgoingBlobWriter">Outgoing blob</param>
+      <param name="authParams">Gets the authentication parameters associated with this connection.</param>


The XML documentation for the authParams parameter describes it as "Gets the authentication parameters" but it should describe what the parameter provides, not use "Gets".

Change to: "The authentication parameters associated with this connection."

Suggested change

<param name="authParams">Gets the authentication parameters associated with this connection.</param>

<param name="authParams">The authentication parameters associated with this connection.</param>

Copilot · 2026-02-12T23:19:43Z

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/SspiContextProvider.cs

        {
        }

+        /// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/GenerateContext'/>


The XML documentation include path is incorrect. The path should be docs/members[@name="SspiContextProvider"]/GenerateContext/* (note the trailing /* and no intermediate /SspiContextProvider/ in the path after the members attribute).

Change the include statement to:

/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/GenerateContext/*'/>

This matches the actual structure in the XML documentation file where <GenerateContext> is a direct child of <members name="SspiContextProvider">, not nested under another <SspiContextProvider> element.

Suggested change

/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/GenerateContext'/>

/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/GenerateContext/*'/>

Copilot · 2026-02-12T23:19:44Z

src/Microsoft.Data.SqlClient.sln

 		..\doc\snippets\Microsoft.Data.SqlClient\SqlRowUpdatingEventHandler.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SqlRowUpdatingEventHandler.xml
 		..\doc\snippets\Microsoft.Data.SqlClient\SqlTransaction.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SqlTransaction.xml
+		..\doc\snippets\Microsoft.Data.SqlClient\SspiAuthenticationParameters.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SspiAuthenticationParameters.xml
+		..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml


Consider adding a code sample demonstrating how to use the new SspiContextProvider API in the doc/samples/ directory. This would help developers understand how to implement a custom SSPI context provider.

A sample could show:

Creating a custom class that inherits from SspiContextProvider

Implementing the GenerateContext method

Setting the provider on a SqlConnection instance

Opening the connection

This is optional but would improve the developer experience for this new public API.

Suggested change

..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml

..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml

..\doc\samples\SspiContextProvider_CustomProvider.cs = ..\doc\samples\SspiContextProvider_CustomProvider.cs

twsouthwick mentioned this pull request May 8, 2024

Add hook for custom SSPI context for SqlConnection instances #2253

Open

10 tasks

twsouthwick changed the title ~~Expose SSPI context provider as public~~ Expose SSPI context provider as public May 8, 2024

twsouthwick force-pushed the public branch from 2657817 to fbfc339 Compare February 1, 2025 01:10

twsouthwick force-pushed the public branch 3 times, most recently from e16f2c8 to cfcf164 Compare March 3, 2025 19:42

nhart12 reviewed Mar 11, 2025

View reviewed changes

src/Microsoft.Data.SqlClient/netfx/ref/Microsoft.Data.SqlClient.cs Outdated Show resolved Hide resolved

nhart12 reviewed Mar 11, 2025

View reviewed changes

src/Microsoft.Data.SqlClient/netcore/ref/Microsoft.Data.SqlClient.cs Outdated Show resolved Hide resolved

benrr101 requested changes Apr 2, 2025

View reviewed changes

paulmedynski requested changes Apr 2, 2025

View reviewed changes

paulmedynski self-assigned this Apr 2, 2025

twsouthwick force-pushed the public branch 6 times, most recently from 380e896 to 2039bd9 Compare May 1, 2025 19:37

twsouthwick force-pushed the public branch from 804e5ba to 9a5fd7c Compare May 13, 2025 00:36

paulmedynski requested changes May 13, 2025

View reviewed changes

twsouthwick force-pushed the public branch 4 times, most recently from 5bb128f to 8937cb7 Compare May 13, 2025 14:58

twsouthwick marked this pull request as ready for review May 13, 2025 18:40

twsouthwick requested review from David-Engel, benrr101, nhart12 and paulmedynski May 13, 2025 18:40

nhart12 approved these changes May 13, 2025

View reviewed changes

paulmedynski previously approved these changes Nov 6, 2025

View reviewed changes

mdaigle modified the milestones: 7.0.0-preview3, 7.0.0-preview4 Dec 2, 2025

github-actions bot added the Stale The Issue or PR has become stale and will be automatically closed shortly if no activity occurs. label Jan 2, 2026

cheenamalhotra removed the Stale The Issue or PR has become stale and will be automatically closed shortly if no activity occurs. label Jan 7, 2026

cheenamalhotra modified the milestones: 7.0.0-preview4, 7.0.0-preview5 Jan 7, 2026

cheenamalhotra added the Public API 🆕 Issues/PRs that introduce new APIs to the driver. label Jan 13, 2026

github-actions bot added the Stale The Issue or PR has become stale and will be automatically closed shortly if no activity occurs. label Feb 12, 2026

Merge branch 'main' of github.com:dotnet/SqlClient into sspi-public

a680e21

Copilot AI review requested due to automatic review settings February 12, 2026 19:41

Copilot started reviewing on behalf of mdaigle February 12, 2026 19:42 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

paulmedynski modified the milestones: 7.0.0-preview5, 7.0.0-preview4 Feb 12, 2026

Add simulated server test to cover login flow.

fca0d0b

mdaigle dismissed paulmedynski’s stale review via fca0d0b February 12, 2026 22:55

mdaigle previously approved these changes Feb 12, 2026

View reviewed changes

Minor doc update. Add test cases.

13b763c

mdaigle dismissed their stale review via 13b763c February 12, 2026 23:12

Copilot AI review requested due to automatic review settings February 12, 2026 23:12

Copilot started reviewing on behalf of mdaigle February 12, 2026 23:13 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

github-actions bot removed the Stale The Issue or PR has become stale and will be automatically closed shortly if no activity occurs. label Feb 13, 2026


		private protected TdsParserStateObject _physicalStateObj = null!;

		/// <include file='../../../../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/*'/>

+        [ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]
+        public static void SettingSspiContextProviderAfterOpen_ThrowsInvalidOperationException()
+        {
+            SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);
+            builder.IntegratedSecurity = true;
+            Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));
+            // Build the SPN for the server we are connecting to
+            builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";
+            if (!string.IsNullOrWhiteSpace(instanceName))
+            {
+                builder.ServerSPN += ":" + instanceName;
+            }
+            using SqlConnection conn = new(builder.ConnectionString);
+            conn.Open();
+            Assert.Throws<InvalidOperationException>(() => conn.SspiContextProvider = new TestSspiContextProvider());
+        }
+        [ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]
+        public static void NullSspiContextProvider_FallsBackToDefault()
+        {
+            SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);
+            builder.IntegratedSecurity = true;
+            Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));
+            // Build the SPN for the server we are connecting to
+            builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";
+            if (!string.IsNullOrWhiteSpace(instanceName))
+            {
+                builder.ServerSPN += ":" + instanceName;
+            }
+            using SqlConnection conn = new(builder.ConnectionString)
+            {
+                SspiContextProvider = null,
+            };
+            // If null correctly falls back to the default platform implementation,
+            // opening the connection should succeed without throwing.
+            conn.Open();
+        }
+        [ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]
+        public static void DifferentSspiContextProviders_UsedPerConnection()
+        {
+            SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);
+            builder.IntegratedSecurity = true;
+            Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));
+            // Build the SPN for the server we are connecting to
+            builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";
+            if (!string.IsNullOrWhiteSpace(instanceName))
+            {
+                builder.ServerSPN += ":" + instanceName;
+            }
+            using SqlConnection conn1 = new(builder.ConnectionString)
+            {
+                SspiContextProvider = new TestSspiContextProvider(),
+            };
+            using SqlConnection conn2 = new(builder.ConnectionString)
+            {
+                SspiContextProvider = new TestSspiContextProvider(),
+            };
+            // Each connection should use its own configured provider when opening.
+            Assert.Throws<SspiTestException>(() => conn1.Open());
+            Assert.Throws<SspiTestException>(() => conn2.Open());
+        }
+        [ConditionalFact(nameof(IsIntegratedSecurityEnvironmentSet), nameof(AreConnectionStringsSetup))]
+        public static void MultipleSequentialOpensWithSameProvider_ReuseSupported()
+        {
+            SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);
+            builder.IntegratedSecurity = true;
+            Assert.True(DataTestUtility.ParseDataSource(builder.DataSource, out string hostname, out int port, out string instanceName));
+            // Build the SPN for the server we are connecting to
+            builder.ServerSPN = $"MSSQLSvc/{DataTestUtility.GetMachineFQDN(hostname)}";
+            if (!string.IsNullOrWhiteSpace(instanceName))
+            {
+                builder.ServerSPN += ":" + instanceName;
+            }
+            using SqlConnection conn = new(builder.ConnectionString)
+            {
+                SspiContextProvider = new TestSspiContextProvider(),
+            };
+            // Reuse the same provider instance across multiple open attempts.
+            for (int i = 0; i < 3; i++)
+            {
+                Assert.Throws<SspiTestException>(() => conn.Open());
+            }
+        }

-    {
+    {
+        /// <include file='../../../../doc/snippets/Microsoft.Data.SqlClient/SspiContextProvider.xml' path='docs/members[@name="SspiContextProvider"]/SspiContextProvider/ctor'/>
+        protected SspiContextProvider() { }

	<param name="authParams">Gets the authentication parameters associated with this connection.</param>
	<param name="authParams">The authentication parameters associated with this connection.</param>

	..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml
	..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml = ..\doc\snippets\Microsoft.Data.SqlClient\SspiContextProvider.xml
	..\doc\samples\SspiContextProvider_CustomProvider.cs = ..\doc\samples\SspiContextProvider_CustomProvider.cs

Expose SSPI context provider as public #2494

Are you sure you want to change the base?

Expose SSPI context provider as public #2494

Conversation

twsouthwick commented May 8, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

benrr101 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulmedynski left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulmedynski left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nhart12 left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 2, 2026

Uh oh!

0xced commented Jan 7, 2026

Uh oh!

cheenamalhotra commented Jan 7, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

0xced commented Feb 12, 2026

Uh oh!

mdaigle commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

twsouthwick commented May 8, 2024 •

edited

Loading

codecov bot commented Mar 3, 2025 •

edited

Loading