Allow Entra authentication when connecting to Redis by pharring · Pull Request #3047 · Azure/data-api-builder

pharring · 2026-01-10T01:45:28Z

Why make this change?

So you can use an Azure Managed Redis or Azure Cache for Redis instance with Entra authentication as a level 2 cache.

What is this change?

If the Redis connection string does not include a password and you are NOT connecting to localhost, then we assume you are connecting to an instance that requires Entra authentication. In that case, we use the DefaultAzureCredential (managed identity) to connect.

How was this tested?

Tested manually and ran unit tests.

Sample Request(s)

N/A

Copilot

Pull request overview

This PR adds support for Azure Entra authentication when connecting to Azure Managed Redis or Azure Cache for Redis instances. The implementation automatically detects when Entra authentication should be used based on whether a password is present in the connection string and whether the endpoint is localhost.

Changes:

Added new CreateConnectionMultiplexerAsync method that handles both traditional password-based and Entra-based Redis authentication
Added Microsoft.Azure.StackExchangeRedis package to enable Azure-specific Redis features
Updated Azure.Identity and Microsoft.Extensions.Configuration.Binder package versions

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/Service/Startup.cs	Added CreateConnectionMultiplexerAsync method with Entra authentication support and localhost detection logic
src/Service/Azure.DataApiBuilder.Service.csproj	Added Microsoft.Azure.StackExchangeRedis package reference
src/Directory.Packages.props	Updated Azure.Identity to 1.17.1, Microsoft.Extensions.Configuration.Binder to 8.0.2, and added Microsoft.Azure.StackExchangeRedis 3.3.1

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/Service/Startup.cs

Copilot · 2026-01-21T21:51:13Z

src/Service/Startup.cs

+                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
+            }
+
+            return await ConnectionMultiplexer.ConnectAsync(options);


The CreateConnectionMultiplexerAsync method lacks error handling for Azure credential failures or Redis connection failures. When DefaultAzureCredential fails to authenticate (e.g., no managed identity is available, or credentials are misconfigured), or when ConfigureForAzureWithTokenCredentialAsync fails, the method will throw an unhandled exception. Consider adding try-catch blocks with more descriptive error messages to help users troubleshoot authentication or connection issues.

Suggested change

options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());

}

return await ConnectionMultiplexer.ConnectAsync(options);

try

{

options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());

}

catch (CredentialUnavailableException ex)

{

throw new InvalidOperationException(

"Failed to acquire Azure credentials for Redis. " +

"Ensure that a managed identity or other Azure credentials are correctly configured " +

"for this environment before enabling Entra authentication for Redis.",

ex);

}

catch (AuthenticationFailedException ex)

{

throw new InvalidOperationException(

"Azure authentication for Redis failed while using DefaultAzureCredential. " +

"Verify that the configured identity has permission to access the Redis resource " +

"and that all required environment settings are correct.",

ex);

}

}

try

{

return await ConnectionMultiplexer.ConnectAsync(options);

}

catch (RedisConnectionException ex)

{

throw new InvalidOperationException(

"Failed to connect to Redis using the provided configuration. " +

"Verify that the Redis connection string, network connectivity, and Redis instance " +

"configuration are correct.",

ex);

}

@pharring, this suggestion from copilot seems reasonable to fix, thoughts?

Copilot is right to suggest the improvement. also, we should have an additional catch block to catch rest of the exceptions if any.

Again, sorry for being dense/uninformed here, but what's the guidance in this repo regarding exception handling? Copilot's suggestion is to wrap inner exceptions in InvalidOperationException. I don't see that pattern anywhere else in startup. Is it what you want?

We could create a specialized "L2CacheException" to wrap any exceptions thrown in L2 cache setup. Is that what you want?

Copilot · 2026-01-21T21:51:14Z

src/Service/Startup.cs

+        private static async Task<IConnectionMultiplexer> CreateConnectionMultiplexerAsync(string connectionString)
+        {
+            ConfigurationOptions options = ConfigurationOptions.Parse(connectionString);
+
+            // Determine if an endpoint is localhost/loopback
+            static bool IsLocalhostEndpoint(EndPoint ep) => ep switch
+            {
+                DnsEndPoint dns => string.Equals(dns.Host, "localhost", StringComparison.OrdinalIgnoreCase),
+                IPEndPoint ip => IPAddress.IsLoopback(ip.Address),
+                _ => false,
+            };
+
+            // If no password is provided, and the endpoint (or at least one of them) is non-localhost,
+            // attempt to use Entra authentication.
+            if (string.IsNullOrEmpty(options.Password) && !options.EndPoints.Any(IsLocalhostEndpoint))
+            {
+                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
+            }
+
+            return await ConnectionMultiplexer.ConnectAsync(options);
+        }


The new CreateConnectionMultiplexerAsync method and its Entra authentication logic lack test coverage. Consider adding unit tests to verify:

Correct behavior when password is provided (should not use Entra)

Correct behavior when connecting to localhost without password (should not use Entra)

Correct behavior when connecting to a non-localhost endpoint without password (should use Entra)

Behavior with mixed localhost and non-localhost endpoints

@pharring, would these unit tests be useful at least - since we are not adding integration tests?

src/Service/Startup.cs

…/github.com/pharring/data-api-builder into dev/pharring/AddEntraAuthForRedisConnection

Aniruddh25 · 2026-01-28T05:32:52Z

/azp run

azure-pipelines · 2026-01-28T05:33:17Z

Azure Pipelines successfully started running 6 pipeline(s).

Aniruddh25 · 2026-01-31T04:03:49Z

/azp run

azure-pipelines · 2026-01-31T04:04:11Z

Azure Pipelines successfully started running 6 pipeline(s).

souvikghosh04

Added some review comments. also, it would be good to mention how this was tested as I don't see any supporting tests for the change. having test coverage with different scenarios would be great.

souvikghosh04 · 2026-01-31T12:46:08Z

src/Service/Startup.cs

+                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
+            }
+
+            return await ConnectionMultiplexer.ConnectAsync(options);


Copilot is right to suggest the improvement. also, we should have an additional catch block to catch rest of the exceptions if any.

souvikghosh04 · 2026-01-31T15:18:24Z

src/Service/Startup.cs

                        {
                            // NOTE: this is done to reuse the same connection multiplexer for both the cache and backplane
-                            Task<ConnectionMultiplexer> connectionMultiplexerTask = ConnectionMultiplexer.ConnectAsync(level2CacheOptions.ConnectionString);
+                            Task<IConnectionMultiplexer> connectionMultiplexerTask = CreateConnectionMultiplexerAsync(level2CacheOptions.ConnectionString);


can we put this under a feature switch or DAB config flag for safer side or an option to opt-in/opt-out?

I don't think it needs a switch because it's automatic. If you don't supply a password, and you're not using localhost, then we assume you want Entra auth.

souvikghosh04 · 2026-01-31T15:19:34Z

src/Service/Startup.cs

+            ConfigurationOptions options = ConfigurationOptions.Parse(connectionString);
+
+            // Determine if an endpoint is localhost/loopback
+            static bool IsLocalhostEndpoint(EndPoint ep) => ep switch
+            {
+                DnsEndPoint dns => string.Equals(dns.Host, "localhost", StringComparison.OrdinalIgnoreCase),
+                IPEndPoint ip => IPAddress.IsLoopback(ip.Address),
+                _ => false,
+            };
+
+            // If no password is provided, and the endpoint (or at least one of them) is non-localhost,
+            // attempt to use Entra authentication.
+            if (string.IsNullOrEmpty(options.Password) && options.EndPoints.Any(static ep => !IsLocalhostEndpoint(ep)))
+            {
+                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
+            }


it would be good to have some error handling and loggings for this function.

Sorry for being dense, but can you show me what that might look like for your code base? Remember this is in startup, so exceptions are generally fatal and will be handled at the top-level.

Allow Entra authentication when connecting to Redis

a02948a

JerryNixon approved these changes Jan 21, 2026

View reviewed changes

JerryNixon marked this pull request as ready for review January 21, 2026 21:47

Copilot AI review requested due to automatic review settings January 21, 2026 21:47

JerryNixon requested review from Alekhya-Polavarapu, Aniruddh25, RubenCerna2079, aaronburtle, anushakolan, neeraj-sharma2592, rusamant, sourabh1007, souvikghosh04 and vadeveka as code owners January 21, 2026 21:47

Merge branch 'main' into dev/pharring/AddEntraAuthForRedisConnection

35e4e75

Copilot started reviewing on behalf of JerryNixon January 21, 2026 21:47 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

pharring and others added 3 commits January 27, 2026 11:33

Make localhost logic fit the comment

62d1ceb

Merge branch 'dev/pharring/AddEntraAuthForRedisConnection' of https:/…

2617bec

…/github.com/pharring/data-api-builder into dev/pharring/AddEntraAuthForRedisConnection

Merge branch 'main' into dev/pharring/AddEntraAuthForRedisConnection

e98df40

Aniruddh25 assigned souvikghosh04 and aaronburtle Jan 29, 2026

Merge branch 'main' into dev/pharring/AddEntraAuthForRedisConnection

b7e008e

souvikghosh04 reviewed Jan 31, 2026

View reviewed changes

Merge branch 'main' into dev/pharring/AddEntraAuthForRedisConnection

115b6a8

-                options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
-            }
-            return await ConnectionMultiplexer.ConnectAsync(options);
+                try
+                {
+                    options = await options.ConfigureForAzureWithTokenCredentialAsync(new DefaultAzureCredential());
+                }
+                catch (CredentialUnavailableException ex)
+                {
+                    throw new InvalidOperationException(
+                        "Failed to acquire Azure credentials for Redis. " +
+                        "Ensure that a managed identity or other Azure credentials are correctly configured " +
+                        "for this environment before enabling Entra authentication for Redis.",
+                        ex);
+                }
+                catch (AuthenticationFailedException ex)
+                {
+                    throw new InvalidOperationException(
+                        "Azure authentication for Redis failed while using DefaultAzureCredential. " +
+                        "Verify that the configured identity has permission to access the Redis resource " +
+                        "and that all required environment settings are correct.",
+                        ex);
+                }
+            }
+            try
+            {
+                return await ConnectionMultiplexer.ConnectAsync(options);
+            }
+            catch (RedisConnectionException ex)
+            {
+                throw new InvalidOperationException(
+                    "Failed to connect to Redis using the provided configuration. " +
+                    "Verify that the Redis connection string, network connectivity, and Redis instance " +
+                    "configuration are correct.",
+                    ex);
+            }

Conversation

pharring commented Jan 10, 2026

Why make this change?

What is this change?

How was this tested?

Sample Request(s)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Aniruddh25 Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

souvikghosh04 Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pharring Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Aniruddh25 Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Aniruddh25 commented Jan 28, 2026

Uh oh!

azure-pipelines bot commented Jan 28, 2026

Uh oh!

Aniruddh25 commented Jan 31, 2026

Uh oh!

azure-pipelines bot commented Jan 31, 2026

Uh oh!

souvikghosh04 left a comment

Choose a reason for hiding this comment

Uh oh!

souvikghosh04 Jan 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

souvikghosh04 Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

pharring Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

souvikghosh04 Jan 31, 2026

Choose a reason for hiding this comment

Uh oh!

pharring Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

souvikghosh04 Jan 31, 2026 •

edited

Loading

souvikghosh04 Jan 31, 2026 •

edited

Loading