aad support for ms sql server (windmill-labs#874)

Co-authored-by: Henri Courdent <[email protected]>

Author: alpetric

docs/getting_started/0_scripts_quickstart/5_sql_quickstart/fill_mssql.png

@@ -147,16 +147,21 @@ Fill out the form with the information of your MS SQL instance and "Test connect
 
 ![Paste in Resource Values](./fill_mssql.png.webp)
 
-| Property | Type   | Description     | Default | Required | Where to Find                                                                         |
-| -------- | ------ | --------------- | ------- | -------- | ------------------------------------------------------------------------------------- |
-| host     | string | Instance host   |         | true     | Your hosting provider's control panel or in your server's MS SQL configuration file    |
-| port     | number | Instance port   |         | false    | Your hosting provider's control panel or in your server's MS SQL configuration file    |
-| user     | string | Username        |         | true     | Created in MS SQL (e.g., via SQL Server Management Studio) or provided by your hosting |
-| dbname   | string | Database name   |         | true     | Created in MS SQL (e.g., via SQL Server Management Studio) or provided by your hosting |
-| password | string | User's password |         | true     | Created in MS SQL (e.g., via SQL Server Management Studio) or provided by your hosting |
+| Property | Type   | Description     | Default | Required | Where to Find                                                                              |
+| -------- | ------ | --------------- | ------- | -------- | -------------------------------------------------------------------------------------      |
+| host     | string | Instance host   |         | true     | Your hosting provider's control panel or in your server's MS SQL configuration file        |
+| port     | number | Instance port   |         | false    | Your hosting provider's control panel or in your server's MS SQL configuration file        |
+| user     | string | Username        |         | true     | Created in MS SQL (e.g., via SQL Server Management Studio) or provided by your hosting     |
+| dbname   | string | Database name   |         | true     | Created in MS SQL (e.g., via SQL Server Management Studio) or provided by your hosting     |
+| password | string | User's password |         | true     | Created in MS SQL (e.g., via SQL Server Management Studio) or provided by your hosting     |
+| aad_token| object | OAuth token AD  |         | true     | Either username/password or aad_token should be provided. Requires OAuth setup in Windmill |
 
 To specify the application intent for read-only requests, add `-- ApplicationIntent=ReadOnly` to the script.
 
+:::info
+When using domain credentials via Entra (Azure Active Directory) you need to add the scope `https://database.windows.net//.default` to the [Windmill OAuth instance setting](../../misc/setup_oauth#azure).
+:::
+
 ### BigQuery
 
 To be able to connect to a [BigQuery](https://cloud.google.com/bigquery) instance, we'll need to define a Resource with the `BigQuery` Resource Type first.

docs/getting_started/0_scripts_quickstart/5_sql_quickstart/fill_mssql.png.webp

@@ -494,6 +494,36 @@ SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS org_accou
 
 Take a look at [this guide](../../misc/9_guides/snowflake_app_with_user_roles/index.mdx#sample-app-setup) to learn more about how to build an App with the Snowflake OAuth integration.
 
+### Azure OAuth
+
+Go to your [Azure AAD App registrations](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps) and create a new registration.
+
+Select a name set the rediredct url to: `https://<YOUR WINDMILL BASE URL>/oauth/callback/azure_oauth` and application type to "Web".
+
+![Azure OAuth Setup](./azure_oauth.png.webp)
+
+Next in "Certificates and secrets" create a new client secret and copy the **Secret Value** as this is the client secret you'll set later in the Windmill OAuth settings (the Secret ID is not required).
+
+Then under "API permissions" you have to select the appropriate permissions that the OAuth application shall be able to access:
+
+**Example MSSQL**:
+- select "Add a permission"
+- Type "Delegated"
+- select "Azure SQL Database" -> "user_impersonation"
+
+![Azure Oauth API permissions](./azure_oauth_api_permissions.png.webp)
+
+Next create a new OAuth client in the [Windmill instance settings](../advanced/instance_settings#authoauth) and fill in
+- the "Client ID" corresponding to the "Application (client) ID" in Azure "Overview" menu item
+- the "Client Secret" corresponding to the Secret Value from client secret you created earlier
+- the "Tenant ID" from the "Overview" menu item
+
+![Azure IDs](./azure_oauth_ids.png.webp)
+
+Now depending on which application you're trying to use you, you will need to as extra "scopes" such as `https://database.windows.net//.default` for [MS SQL Server](../getting_started/scripts_quickstart/sql#ms-sql).
+
+![Azure Windmill](./azure_oauth_windmill.png.webp)
+
 ### Custom OAuth
 
 Under [Enterprise Edition](/pricing), you can add a completely custom OAuth without requiring a dev setup. The item accepts an extra optional field: `connect_config` or `login_config` of type OAuthConfig: