Search code examples
postgresqlazure-active-directoryldap

How to enable Azure Active Directory Authentication for PostgreSQL?


In our organization, we are having common credentials to access the postgres databases, which every developers know, as it is hardcoded in application's connection string. Due to which, whenever a DML/DDL changes happens on databases, it is hard for us trace, as the developers use to make changes on their own. We can't have individual logins for each developers which is tedious to manage.

Note: Also, we can't ensure that the credentials won't be shared with the peer developers.

To get rid of this, we thought of integrating Postgres with Azure Active Directory, for Authentication. If we can map Azure AD group/users to Postgres, security will be tightened as well as maintenance overhead will also reduce.

But, I couldn't find a article to implement this, since most of the articles says the integration for Azure managed postgresql with Azure AD, and not for the postgres running on VMs.

Can anyone guide me or share a detailed article to implement the Azure AD integration for Postgres running on a VM(IaaS)


Solution

  • Using Azure Active Directory is a great idea for the reasons you specified, but unfortunately there's no native support for connection to Azure Active Directory with a local Postgres database (which is essentially what you have with Postgres in a VM). It can be done through the LDAP protocol, however.

    FULL DISCLOSURE: I haven't actually done this part myself (or used the steps in the tutorial link), but this is my understanding from working with system operators. Use LDAP to connect to Azure AD then Postgres to connect via LDAP. More information on LDAP authentication in Postgres can be found here.

    Bhavani's answer is about Azure Database for PostgreSQL, which is a Azure-native database service. This part I have used and I highly recommend it; you get Azure AD integration and can manage the database performance and connectivity specifically without having to also manage VM performance. Note that their screenshot is for the Flexible Server while the reference link says 'Single Server'; I recommend Flexible Server.