User Entra authentication to Postgres flexible server

Peter Koller 45

When using EntraID authentication is the only option for users the token based authentication flow descibed here? Our users now have to obtain a new token every hour when working with tools like PowerBI.

Peter Koller 45 Reputation points

2025-01-22T14:43:33.54+00:00

Thanks for the quick reply. If I read this correctly you are saying that we just have to live with the tokens expiring and the users need to do a az account get-access-token --resource-type oss-rdbms every 5-60 minutes?
Vijayalaxmi Kattimani 985 Reputation points Microsoft Vendor

2025-01-22T15:11:52.8233333+00:00

Hi @Peter Koller,

Could you please confirm if you are connecting using a managed identity?
Peter Koller 45 Reputation points

2025-01-22T15:17:19.88+00:00

no our users are connecting using their usernames + the token
Vijayalaxmi Kattimani 985 Reputation points Microsoft Vendor

2025-01-23T09:04:15.7633333+00:00

Hi @Peter Koller,

Based on my research, the default validity period for a SAML token is 1 hour. The token’s validity is defined by the NotOnOrAfter value in the <conditions> element of the token.

When the token expires, the client must request a new one. This is often done silently through Single Sign-On (SSO), so users don't have to sign in interactively again.

The NotOnOrAfter value can be adjusted using the AccessTokenLifetime parameter in a TokenLifetimePolicy. This adjusted lifetime includes the configured value plus a 5-minute clock skew.

However, the NotOnOrAfter value in the <SubjectConfirmationData> element is not affected by the token lifetime configuration.

Please refer to the below mentioned link for more information.

https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes#saml-tokens

I hope this information helps. Please do let us know if you have any further queries.
Vijayalaxmi Kattimani 985 Reputation points Microsoft Vendor

2025-01-27T09:22:53.5966667+00:00

Hi @Peter Koller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Vijayalaxmi Kattimani 985 Reputation points Microsoft Vendor

2025-01-22T14:38:24.52+00:00

Hi Peter Koller,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

As we understand that, you are encountering challenges with token-based authentication using Microsoft Entra ID.

We would like to inform you that, the access token's validity is 5 minutes to 60 minutes. You should get the access token before initiating the sign-in to Azure Database for PostgreSQL. Existing token's lifetime will not be changed. After they expire, a new token will be issued based on the default value.

If you need to continue to define the time period before initiating the sign in again, configure sign-in frequency in Conditional Access. To learn more about Conditional Access, please refer this link Configure authentication session management with Conditional Access.

Please refer to the below mentioned link for more information.

https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes#token-lifetime-policies-for-refresh-tokens-and-session-tokens

I hope, This response will address your query and helped you to overcome on your challenges.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

User Entra authentication to Postgres flexible server

1 answer

Your answer