Improved OBO logging and added OBO observability to SESSION_CONTEXT by anushakolan · Pull Request #3192 · Azure/data-api-builder

anushakolan · 2026-03-04T23:52:41Z

Why make this change?

Closes #3125

Adds OBO (On-Behalf-Of) observability improvements for debugging and auditing user-delegated authentication flows.
Enables end-to-end tracing from DAB application logs to SQL Server queries using OpenTelemetry correlation IDs.
Provides SQL-side visibility into which user and tenant executed a query when using user-delegated auth.

What is this change?

Enhanced OBO Token Logging (OboSqlTokenProvider.cs)

Added structured logging with EventType field for easier log filtering and analysis
Included traceId in all OBO-related log messages to enable correlation with distributed traces
Event types added: OboValidationFailed, OboTokenCacheMiss, OboTokenAcquired, OboTokenCacheHit

SESSION_CONTEXT Observability Values (MsSqlQueryExecutor.cs)
Added the following values to SQL Server SESSION_CONTEXT when set-session-context is enabled:

dab.trace_id - OpenTelemetry TraceId (set when Activity is present)
dab.span_id - OpenTelemetry SpanId (set when Activity is present)
dab.auth_type - Auth type indicator, value: obo (set when user-delegated auth is enabled)
dab.user_id - User identifier from oid claim, falls back to sub claim (set when user-delegated auth is enabled)
dab.tenant_id - Azure AD tenant ID from tid claim (set when user-delegated auth is enabled)

How was this tested?

Unit Tests

GetSessionParamsQuery_IncludesAllObservabilityValues_WhenActivityAndOboEnabled
GetSessionParamsQuery_ExcludesCorrelationIds_WhenNoActivity

Manual E2E Testing

Deployed to Azure Container App with Azure SQL Database
Verified OBO token logging in container logs with traceId correlation
Verified SESSION_CONTEXT values via stored procedure (dbo.GetSessionContext)
Confirmed correlation between container logs and SQL SESSION_CONTEXT values

…orrelation

anushakolan · 2026-03-05T00:03:45Z

/azp run

azure-pipelines · 2026-03-05T00:04:09Z

Azure Pipelines successfully started running 6 pipeline(s).

Copilot

Pull request overview

This PR improves observability for user-delegated (OBO) authentication by enhancing OBO token acquisition logging and by adding OpenTelemetry correlation + OBO identity details into SQL Server SESSION_CONTEXT when set-session-context is enabled.

Changes:

Add structured OBO token logging in OboSqlTokenProvider with event types and traceId correlation.
Extend MsSqlQueryExecutor.GetSessionParamsQuery to set dab.trace_id, dab.span_id, dab.auth_type, dab.user_id, and dab.tenant_id in SESSION_CONTEXT.
Add unit tests validating inclusion/exclusion of correlation IDs and OBO observability session-context values.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs	Adds unit tests for new session-context observability values and Activity correlation behavior.
src/Core/Resolvers/OboSqlTokenProvider.cs	Adds structured log fields (EventType + traceId) for OBO validation/cache/acquisition events.
src/Core/Resolvers/MsSqlQueryExecutor.cs	Writes OpenTelemetry correlation IDs and OBO identity markers into SQL Server `SESSION_CONTEXT`.

src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

anushakolan · 2026-03-05T00:13:53Z

/azp run

azure-pipelines · 2026-03-05T00:14:18Z

Azure Pipelines successfully started running 6 pipeline(s).

src/Core/Resolvers/MsSqlQueryExecutor.cs

src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs

Aniruddh25

OBO should trace irrespective of set-session-context values.

anushakolan · 2026-03-18T21:40:00Z

/azp run

azure-pipelines · 2026-03-18T21:40:23Z

Azure Pipelines successfully started running 6 pipeline(s).

aaronburtle · 2026-03-19T21:27:09Z

src/Core/Resolvers/OboSqlTokenProvider.cs

        {
-            _logger.LogWarning("Cannot acquire OBO token: ClaimsPrincipal is null.");
+            _logger.LogWarning(
+                "{EventType}: Cannot acquire OBO token - ClaimsPrincipal is null (traceId: {TraceId}).",


Should we use an enum for the EventType instead of just providing a string?

aaronburtle · 2026-03-19T21:49:26Z

DAB currently has its own correlation system, which adds a correlation ID to the DAB logs. So if a user were to get say a 500 error on a REST call they would have in the DAB logs a correlation id associated with the error. The dab logs would also show the Obo Token being acquired with a separate traceid. But in the SQL Server session context, there will only be the trace id, not the dab correlation id.

So in order to connect the dab error log to the SQL audit, the user would have to go through some sort of APM tool to match the requests by timestamp, or theyd need to know that both IDs belong to the same http request.

If the dab.correlation_id was also included in the SESSION_CONTEXT, then the user could directly join the SQL audit log to the DAB error log without needing to use any other tools. This might be particularly useful if there are different people or teams looking at the different logs.

Not a blocker, but something I think we should consider.

aaronburtle · 2026-03-19T22:02:03Z

src/Core/Resolvers/MsSqlQueryExecutor.cs

+                if (currentActivity is not null)
+                {
+                    string traceIdParamName = $"{SESSION_PARAM_NAME}{counter.Next()}";
+                    parameters.Add(traceIdParamName, new(currentActivity.TraceId.ToString()));


Because of our retry policy in query executor, a transient fault may end up trying to re-add params that already exist in this dictionary, which would error out. This is an already existing issue however, and I dont think Ive seen this show up yet, but figured it is worth flagging, and i think can be fixed by changing from .add to using an indexer; parameters[traceIdParamName]=foo

aaronburtle

Looks good! Couple comments, but no blockers.

anushakolan added 2 commits March 4, 2026 15:46

Improved OBO logging and added OBO observability to SESSION_CONTEXT

8dc80df

Merge remote-tracking branch 'origin/main' into dev/anushakolan/obo-c…

31dba47

…orrelation

anushakolan marked this pull request as ready for review March 5, 2026 00:03

Copilot AI review requested due to automatic review settings March 5, 2026 00:03

anushakolan requested review from Alekhya-Polavarapu, Aniruddh25, JerryNixon, RubenCerna2079, aaronburtle, rusamant, sourabh1007, souvikghosh04, stuartpa and vadeveka as code owners March 5, 2026 00:03

Copilot started reviewing on behalf of anushakolan March 5, 2026 00:04 View session

Copilot AI reviewed Mar 5, 2026

View reviewed changes

src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs Outdated Show resolved Hide resolved

Update src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs

aceafbd

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Aniruddh25 added 2 commits March 8, 2026 16:58

Merge branch 'main' into dev/anushakolan/obo-correlation

80c1e43

Merge branch 'main' into dev/anushakolan/obo-correlation

530f644

Aniruddh25 reviewed Mar 11, 2026

View reviewed changes

src/Core/Resolvers/MsSqlQueryExecutor.cs Outdated Show resolved Hide resolved

Aniruddh25 reviewed Mar 11, 2026

View reviewed changes

src/Core/Resolvers/MsSqlQueryExecutor.cs Outdated Show resolved Hide resolved

Aniruddh25 reviewed Mar 11, 2026

View reviewed changes

src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs Show resolved Hide resolved

Aniruddh25 reviewed Mar 11, 2026

View reviewed changes

src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs Show resolved Hide resolved

Aniruddh25 requested changes Mar 11, 2026

View reviewed changes

Aniruddh25 and others added 2 commits March 11, 2026 14:55

Merge branch 'main' into dev/anushakolan/obo-correlation

e243ca3

Merge branch 'main' into dev/anushakolan/obo-correlation

fa929c2

Merge branch 'main' into dev/anushakolan/obo-correlation

a5bea96

anushakolan assigned anushakolan and Aniruddh25 Mar 18, 2026

anushakolan added 2 commits March 18, 2026 14:39

Addressed comments and added more testing.

649fcc9

Merge branch 'main' into dev/anushakolan/obo-correlation

c615dc2

anushakolan assigned aaronburtle Mar 18, 2026

anushakolan added the obo These tasks are related to DAB OBO Delegated Identity implmentation. label Mar 18, 2026

anushakolan added this to Data API builder Mar 18, 2026

github-project-automation bot moved this to Review In Progress in Data API builder Mar 18, 2026

anushakolan added this to the March 2026 milestone Mar 18, 2026

souvikghosh04 self-assigned this Mar 19, 2026

aaronburtle reviewed Mar 19, 2026

View reviewed changes

aaronburtle approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into dev/anushakolan/obo-correlation

0afa20c

Aniruddh25 approved these changes Mar 20, 2026

View reviewed changes

Conversation

anushakolan commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why make this change?

What is this change?

How was this tested?

Unit Tests

Manual E2E Testing

Uh oh!

anushakolan commented Mar 5, 2026

Uh oh!

azure-pipelines bot commented Mar 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

anushakolan commented Mar 5, 2026

Uh oh!

azure-pipelines bot commented Mar 5, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aniruddh25 left a comment

Choose a reason for hiding this comment

Uh oh!

anushakolan commented Mar 18, 2026

Uh oh!

azure-pipelines bot commented Mar 18, 2026

Uh oh!

aaronburtle Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

aaronburtle commented Mar 19, 2026

Uh oh!

aaronburtle Mar 19, 2026

Choose a reason for hiding this comment

Uh oh!

aaronburtle left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

anushakolan commented Mar 4, 2026 •

edited

Loading