Fix SQLAlchemy Entra authentication with connection pools

[pabloacan]

Description

Fixes #48382.

enable_entra_authentication and enable_entra_authentication_async registered a do_connect listener that modified SQLAlchemy's persistent connect_args dictionary in place:

• credential was removed before the DBAPI connection was created.
• The Entra access token remained in password after the first physical connection.

When a connection pool later created another physical connection, the listener no longer had a TokenCredential and raised CredentialValueError. If it had proceeded, it could also have reused an expired access token.

This change copies cparams for each do_connect event, removes the helper-only credential from that per-connection copy, resolves Entra credentials there, and returns dialect.connect(...). The pool's original connection configuration remains unchanged, so every physical connection receives a fresh token resolution.

The same behavior is applied to both synchronous and asynchronous SQLAlchemy integrations.

Tests

• Added regression coverage for two consecutive physical connection attempts in both sync and async SQLAlchemy integrations.

• Updated existing tests to assert that credential remains present in the original parameters while dialect.connect receives only DBAPI-supported arguments.

• Ran:

  python -m pytest tests/test_sqlalchemy.py tests/test_sqlalchemy_async.py
  24 passed, 9 skipped
  

The skipped tests require a live PostgreSQL instance.

Changelog

Added an Unreleased bug-fix entry for SQLAlchemy connection pools using Entra authentication.

[github-actions]

Thank you for your contribution @pabloacan! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
8 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Fixes pooled SQLAlchemy Entra authentication by preserving persistent connection parameters and resolving fresh credentials per physical connection.

Changes:

• Copies connection parameters before removing helper-only credentials.
• Returns DBAPI connections using per-connection Entra credentials.
• Adds sync/async regression tests and a changelog entry.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
azure_postgresql_auth/sqlalchemy/entra_connection.py	Fixes synchronous pooled connections.
azure_postgresql_auth/sqlalchemy/async_entra_connection.py	Applies the fix to async engines.
tests/test_sqlalchemy.py	Adds synchronous regression coverage.
tests/test_sqlalchemy_async.py	Adds asynchronous regression coverage.
CHANGELOG.md	Documents the bug fix.

[pabloacan]

@microsoft-github-policy-service agree company="Industria de Diseño Textil, S.A."

[github-actions]

[Pilot] PR Pipeline Failure Analysis

A CI pipeline failed on this pull request. Here is an automated analysis of what went wrong and how to get the build green.

What failed

The pylint validation step for sdk/postgresql/azure-postgresql-auth failed with exit code 16 (Azure DevOps build #6642215). Two functions are missing return documentation in their docstrings:

• azure_postgresql_auth/sqlalchemy/async_entra_connection.py:42 — enable_entra_authentication_async.provide_token is missing a :returns: description (C4741) and a :rtype: type (C4742).
• azure_postgresql_auth/sqlalchemy/entra_connection.py:39 — enable_entra_authentication.provide_token is missing a :returns: description (C4741) and a :rtype: type (C4742).

Recommended next steps

• In azure_postgresql_auth/sqlalchemy/async_entra_connection.py, add :returns: and :rtype: entries to the docstring of the provide_token inner function inside enable_entra_authentication_async (line 42).
• In azure_postgresql_auth/sqlalchemy/entra_connection.py, add :returns: and :rtype: entries to the docstring of the provide_token inner function inside enable_entra_authentication (line 39).
• Reference the [Azure SDK Python docstring guidelines]((azure.github.io/redacted) for the correct format.
• After fixing, run azpysdk pylint . from sdk/postgresql/azure-postgresql-auth/ locally to confirm the issues are resolved before pushing.
• See the CI troubleshooting guide: https://aka.ms/ci-fix
• Push new commits to address the failures; this comment updates automatically on the next failing run.

Raw pipeline analysis (azsdk ci analyze)

Failed Tasks
### Errors:
[azure-postgresql-auth :: pylint] ************* Module azure_postgresql_auth.sqlalchemy.async_entra_connection
[azure-postgresql-auth :: pylint] azure_postgresql_auth/sqlalchemy/async_entra_connection.py:42: [C4741(docstring-missing-return), enable_entra_authentication_async.provide_token] A return doc is missing in the docstring.
[azure-postgresql-auth :: pylint] azure_postgresql_auth/sqlalchemy/async_entra_connection.py:42: [C4742(docstring-missing-rtype), enable_entra_authentication_async.provide_token] A return type is missing in the docstring.
[azure-postgresql-auth :: pylint] ************* Module azure_postgresql_auth.sqlalchemy.entra_connection
[azure-postgresql-auth :: pylint] azure_postgresql_auth/sqlalchemy/entra_connection.py:39: [C4741(docstring-missing-return), enable_entra_authentication.provide_token] A return doc is missing in the docstring.
[azure-postgresql-auth :: pylint] azure_postgresql_auth/sqlalchemy/entra_connection.py:39: [C4742(docstring-missing-rtype), enable_entra_authentication.provide_token] A return type is missing in the docstring.

[azure-postgresql-auth :: pylint] Your code has been rated at 9.82/10

[azure-postgresql-auth :: pylint] azure-postgresql-auth main package exited with linting error 16.
SUMMARY: /mnt/vss/_work/1/s/sdk/postgresql/azure-postgresql-auth  pylint  FAIL(16)  8.72s
Total checks: 1 | Failed: 1 | Worst exit code: 16

Pipeline: https://dev.azure.com/azure-sdk/public/_build/results?buildId=6642215

Copilot detected the failing pipeline and generated the analysis above. To have it attempt a fix automatically, reply with `@copilot please fix the failing pipeline on this PR`.

Generated by Pipeline Analysis - Next Steps · 26.1 AIC · ⌖ 8.8 AIC · ⊞ 6.6K · ◷