> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/connections/authentication/configure-azure-passwordless-authentication-using-azure-postgresql-as-the-metastore.md).

# Configure Azure passwordless authentication using Azure PostgreSQL as the Metastore

Azure’s passwordless authentication balances security and user convenience to provide a robust solution for enhancing the security and usability of PostgreSQL database access. Passwordless authentication allows your organization to minimize the risks associated with traditional password management and offer users a more seamless experience. This page shows you how to configure passwordless authentication for the Metastore in Azure and outlines the various passwordless authentication methods that we support.

## Prerequisites

{% tabs %}
{% tab title="Standalone" %}

* Configure your [Azure database for PostgreSQL](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-configure-sign-in-azure-ad-authentication) to enable passwordless authentication.
* Export the environment variable `SPRING_PROFILES_ACTIVE=AZURE_ENV` in the **owl-env.sh** file.
  {% endtab %}

{% tab title="Kubernetes" %}

* Configure your [Azure database for PostgreSQL](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-configure-sign-in-azure-ad-authentication) to enable passwordless authentication.
* Pass the following Helm Chart variables:

  ```
  --set global.configMap.data.active_profile={AZURE_ENV} \
  --set global.serviceAccount.annotations."azure\.workload\.identity/client-id"=\<client-id\> \
  --set global.platform=aks \
  ```

{% endtab %}
{% endtabs %}

## Setting up Azure passwordless authentication

{% tabs %}
{% tab title="Standalone" %}
There are 3 methods you can use to authenticate Azure databases.

* [Environmental credentials](#Environmental_credentials)
* [Managed identity credentials](#Managed_identity_credentials)
* [Azure CLI credentials](#Azure_CLI_credentials)

## Environmental credentials

This method checks for credentials provided through environment variables. Export the following environment variables in the owl-env.sh file to enable this authentication method.

<table><thead><tr><th width="152">Variable</th><th>Description</th></tr></thead><tbody><tr><td>AZURE_TENANT_ID</td><td>The Microsoft Entra tenant (directory) ID.</td></tr><tr><td>AZURE_CLIENT_ID</td><td>The client (application) ID of an App Registration in the tenant.</td></tr><tr><td>AZURE_CLIENT_SECRET</td><td>A client secret that was generated for the App Registration.</td></tr></tbody></table>

## Managed identity credentials

Additional setup is not required to enable managed identity. For more information, see the official Azure documentation to [configure managed identities to enable authentication for PostgreSQL Metastores](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-configure-managed-identities?pivots=qs-configure-portal-windows-vm) .

## Azure CLI credentials

{% hint style="info" %}
While this authentication method is supported, we recommend the environmental credentials or managed identity credentials options instead.
{% endhint %}

This method requires the Azure CLI to be enabled on the Azure virtual machine and the principal authenticated with the PostgreSQL database. When this is set up, Data Quality & Observability (self-hosted) executes the `az account get-access-token --output json` to retrieve the token to authenticate with PostgreSQL.
{% endtab %}

{% tab title="Kubernetes" %}

## Workload identity credentials

{% stepper %}
{% step %}
Enable the Azure cluster for workload identity.

```
az aks update --resource-group "${RESOURCE_GROUP}" --name "${CLUSTER_NAME}" --enable-oidc-issuer --enable-workload-identity
```

{% endstep %}

{% step %}
Enable federation for the Spark service account used by Data Quality & Observability (self-hosted).

```
az identity federated-credential create --name ${FEDERATED_IDENTITY_CREDENTIAL_NAME} --identity-name "${USER_ASSIGNED_IDENTITY_NAME}" --resource-group "${RESOURCE_GROUP}" --issuer "${AKS_OIDC_ISSUER}" --subject system:serviceaccount:"${SERVICE_ACCOUNT_NAMESPACE}":"${SERVICE_ACCOUNT_NAME}" --audience api://AzureADTokenExchange
```

{% endstep %}

{% step %}
Deploy Data Quality & Observability (self-hosted) with the following Helm variables where `managed-identity-id` is the name of the managed identity and `client-id` is the client ID of the managed identity.

```
--set global.configMap.data.metastore_user=<managed-identity-id> \
--set global.configMap.data.metastore_pass=blank \
--set global.configMap.data.active_profile={AZURE_ENV} \
--set global.serviceAccount.annotations."azure\.workload\.identity/client-id"=<client-id> \
--set global.platform=aks \
```

{% endstep %}

{% step %}
Mount the Spark driver pod and custom executor templates. For more information on pod templates, go to the [official Apache Spark documentation](https://spark.apache.org/docs/latest/running-on-kubernetes.html#pod-template).

* Update the driver pod template and executor pod template yaml files with the following definition:

  ```
  apiVersion: v1
  Kind: Pod
  metadata:
    labels:
      azure.workload.identity/use: "true"
  spec:
    securityContext:
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
  ```
* Update the DQ Agent properties to point to the pod templates. In the DQ Web application, open the Edit Agent modal, and add the following parameter to the **Free form (Appended)** field:

  ```
  -conf spark.kubernetes.driver.podTemplateFile=local:///opt/owl/config/k8s-driver-template.yml,spark.kubernetes.executor.podTemplateFile=local:///opt/owl/config/k8s-executor-template.yml
  ```

{% endstep %}
{% endstepper %}

For more information about configuring your Azure cluster with workload identity, go to the [official Azure documentation](https://learn.microsoft.com/en-us/azure/aks/workload-identity-deploy-cluster#create-a-kubernetes-service-account) .
{% endtab %}
{% endtabs %}