feat(pam): add NTLM auth support for MSSQL#6544
Closed
saifsmailbox98 wants to merge 6 commits into
Closed
Conversation
MSSQL PAM accounts now support Windows Authentication (NTLM) in addition to SQL Server Authentication. The auth method is selected per-account via a discriminated union on the credentials schema, following the same pattern as SSH (password/publickey/certificate). Backend: new MsSqlAuthMethod enum, discriminated union on account credentials, NTLM branch in Tedious/Knex connection validation, MSSQL added to session credentials response union. Frontend: auth method selector on the MSSQL account form with conditional domain field for NTLM.
|
💬 Discussion in Slack: #pr-review-infisical-6544-feat-pam-add-ntlm-auth-support-for-mssql Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
6 tasks
|
Preview environment failed to deploy. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
…hema Old MSSQL accounts without authMethod are handled via .default() in account/sanitized schemas (scoped by parentType) and a service-level backfill in getSessionCredentials. Session credentials schema uses a strict variant without .default() to avoid cross-resource false matches in the flat z.union.
Contributor
Author
|
@claude review once |
…-auth-support-for-mssql-in-pam
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 9387833 | Triggered | Generic Password | 8395a31 | backend-go/docker-compose.test.yml | View secret |
| 29105343 | Triggered | Generic High Entropy Secret | 8395a31 | backend-go/internal/server/gen/http/secrets/client/encode_decode.go | View secret |
| 28944329 | Triggered | PostHog Project API Key | 8395a31 | backend-go/internal/config/config.go | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
MSSQL PAM accounts now support Windows Authentication (NTLM) in addition to SQL Server Authentication. Auth method is selected per-account following the same discriminated union pattern as SSH, with a domain field for NTLM.
Infisical/cli#241
Screenshots
Steps to verify the change
Type
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).