Support Azure AD / Entra ID `ActiveDirectoryPassword` authentication for SQL Server

[ByteMeDirk]

Hi team,

We’ve run into a limitation around SQL Server authentication that currently blocks us from using the CLI for contract validation in one of our key source systems.

If you have any suggestions on a working solution for the below use case, that would also be greatly appreciated!

Use case

We have a SQL Server–backed source system where:

• The database is only accessible via Azure AD / Entra ID authentication (no SQL logins allowed).
• We are successfully ingesting data from this source using dlt, which supports Azure AD–based auth.
• We would now like to validate this data using datacontract-cli against the same source, but we cannot, because the CLI only supports:
  • SQL auth (DATACONTRACT_SQLSERVER_USERNAME / DATACONTRACT_SQLSERVER_PASSWORD), and
  • Windows integrated auth via DATACONTRACT_SQLSERVER_TRUSTED_CONNECTION.

Since the database does not allow the creation of SQL users and we cannot use Windows integrated auth in this environment, we currently have no way to point datacontract-cli at this source system for validation.

Requested feature

Add support for Azure AD / Entra ID authentication modes for SQL Server, specifically ActiveDirectoryPassword (and potentially related Entra ID modes if feasible), so that:

• We can authenticate using an Entra ID principal and password (or possibly client credentials / device code in the future).
• The CLI can connect to the same SQL Server sources we already use with tools like dlt and other Entra-aware connectors.

Concretely, something along these lines would already unblock us:

• New environment variables (example naming, open to your design):
  • DATACONTRACT_SQLSERVER_AUTHENTICATION=ActiveDirectoryPassword
  • DATACONTRACT_SQLSERVER_AD_USERNAME
  • DATACONTRACT_SQLSERVER_AD_PASSWORD
• Or a more generic mechanism to pass through Authentication=Active Directory Password (or equivalent) into the underlying connection string/driver.

[jschoedl]

ActiveDirectoryPassword, ActiveDirectoryServicePrincipal and ActiveDirectoryInteractive are actually supported by Soda Core v3 (which is used by the CLI), but there is no CLI option to use it yet. I just created PR #1081 that would introduce new environment variables similar to your proposal.