Access token

SQL Server accepts a short-lived Microsoft Entra access token instead of a database password. The token identifies a user or application and must be issued for the SQL resource accepted by that server.

For a person signing in, use Browser sign-in (OAuth) or Device-code sign-in (OAuth). This page covers application-supplied tokens and certificate-based application sign-in.

Database and operating-system support

The operating system is the client running DubUrl, not the database server. ✔ means this authentication method is supported through the listed driver route; install the required provider or driver and satisfy the prerequisites in the notes. ✘ means this documented method is unavailable for that route. Database names span their catalogued native ADO.NET, ODBC and OLE DB driver rows. Driver-specific sign-in options for other methods are separate from the shared APIs shown here.

Database	Driver route	Windows	Linux	macOS
Apache Drill	ODBC	✘	✘	✘
CockroachDB	ADO.NET	✘	✘	✘
CrateDB	ADO.NET	✘	✘	✘
DuckDB	ADO.NET	✘	✘	✘
DuckDB	ODBC	✘	✘	✘
Firebird SQL	ADO.NET	✘	✘	✘
IBM Db2	ADO.NET	✘	✘	✘
MariaDB	ADO.NET	✘	✘	✘
MariaDB	ODBC	✘	✘	✘
Microsoft Access	ODBC	✘	✘	✘
Microsoft Access	OLE DB	✘	✘	✘
Microsoft Excel	ODBC	✘	✘	✘
Microsoft Excel	OLE DB	✘	✘	✘
Microsoft SQL Server	ADO.NET	✔	✔	✔
	ODBC	✘	✘	✘
	OLE DB	✘	✘	✘
MySQL	ADO.NET	✘	✘	✘
	ODBC	✘	✘	✘
	OLE DB	✘	✘	✘
Oracle Database	ADO.NET	✘	✘	✘
Oracle Database	OLE DB	✘	✘	✘
PostgreSQL	ADO.NET	✘	✘	✘
PostgreSQL	ODBC	✘	✘	✘
QuestDB	ADO.NET	✘	✘	✘
QuestDB	ODBC	✘	✘	✘
SingleStore	ADO.NET	✘	✘	✘
Snowflake	ADO.NET	✘	✘	✘
SQLite	ADO.NET	✘	✘	✘
Teradata	ADO.NET	✘	✘	✘
Text files	ODBC	✘	✘	✘
Timescale	ADO.NET	✘	✘	✘
Timescale	ODBC	✘	✘	✘
Trino	ADO.NET	✘	✘	✘
Trino	ODBC	✘	✘	✘

OLE DB is supported only on Windows. All routes require a compatible provider or driver for the client OS and architecture.

The shared API for this method supports the native ADO.NET routes marked above. ODBC and OLE DB sign-in settings for this method must be configured through the driver separately.

Microsoft SQL Server: Entra-enabled SQL endpoint; token audience and database identity must match.

Prerequisites

Use an Entra-enabled SQL endpoint, such as Azure SQL or an appropriately configured SQL Server. Provision the Entra user/application in the database and grant its permissions. An ordinary SQL login is not an Entra identity.

For certificate-based application sign-in, register the public certificate on the Entra application and make its private key available only to the application. Configure the tenant authority and SQL resource for the relevant cloud. This is application authentication to Entra, not a TLS client-certificate handshake with SQL Server.

Library

Use DubUrl.Authentication.SqlServer:

using DubUrl.Authentication.SqlServer;

var source = new EntraCertificateTokenSource(
    clientId,
    new Uri("https://login.microsoftonline.com/" + tenantId),
    new Uri("https://database.windows.net/"),
    certificate);
var target = new ConnectionUrl("mssql://server.database.windows.net/app")
    .WithAuthentication(SqlServerAuthentication.TokenCallback(source));
await using var connection = await target.OpenAsync(cancellationToken);

For a different application token source, implement ISqlServerTokenSource. Return a SqlAuthenticationToken with the token and its real expiry for the requested authority/resource. Do not put a token, private key, or client secret in the URL.

Reuse a source/strategy for one identity. When changing an application identity or certificate, retire its old pooled connections; an already authenticated database session does not sign in again just because the certificate changes.

CLI

There is no dedicated CLI option to supply a token callback or select certificate-based application sign-in. Use the Library. The CLI’s two OAuth options are user sign-in methods.

See Microsoft’s SqlClient Entra authentication guidance.

CLI authentication · Library authentication