Skip to content

Add TrustServerCertificate to SqlServerAdapter#2094

Merged
MasterOdin merged 3 commits intocakephp:masterfrom
ingLomeland:bugfix-sqlsrv
Jul 3, 2022
Merged

Add TrustServerCertificate to SqlServerAdapter#2094
MasterOdin merged 3 commits intocakephp:masterfrom
ingLomeland:bugfix-sqlsrv

Conversation

@ingLomeland
Copy link
Copy Markdown
Contributor

@ingLomeland ingLomeland commented May 19, 2022

Fixes #2093

This PR adds TrustServerCertificate=true to the connection string. This is needed for sqlserver 2017 and 2019. Tested that phinx works with sqlsrv 2019 after this fix.

@markstory

@garas
Copy link
Copy Markdown
Member

garas commented May 20, 2022

TrustServerCertificate=true skips the trust chain validation, so the application connects even if the certificate can't be verified. Using TrustServerCertificate=false enforces certificate validation and is a best practice.

It should be enabled through configuration. For this, it needs some new configuration key like dsn_options, might be useful for other adapters too.

@ingLomeland
Copy link
Copy Markdown
Contributor Author

Hi, added it as a configuration option. Could you look at it again? @garas


// option to turn on TrustServerCertificate
if (isset($options['trust_server_certificate'])) {
$dsn .= ';TrustServerCertificate=' . $options['trust_server_certificate'];
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we handle converting the boolean into a string? Having users define a string true is a bit counter-intuitive.

Copy link
Copy Markdown
Member

@MasterOdin MasterOdin May 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if there's a way to generalize this so that we don't need to add handlers for all possible additional allowed options for SQLServer. We use the prefix sqlsrv_attr_ for detecting PDO settings, perhaps we can do a similar prefix for DSN specific settings, or have a key that expects to point at an associative array of settings? This way, we don't need to have this same if statement setup for a number of different options, and in this case, I think having them be whatever the user inputs makes sense (e.g. a string) as that's what the settings page calls for.

I would probably lean towards the array option (dsn_options?) as that seems more easily extendable to other adapters if we ever need it.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added dsn_options

Comment on lines +53 to +59
public function testConnectionWithDsnOptions()
{
$options = $this->adapter->getOptions();
$options['dsn_options'] = ['TrustServerCertificate' => 'true'];
$this->adapter->setOptions($options);
$this->assertInstanceOf('PDO', $this->adapter->getConnection());
}
Copy link
Copy Markdown
Member

@MasterOdin MasterOdin May 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test isn't overly valuable as it doesn't really test that the dsn_options were used in any way, but there's currently not a good way to do that. This method is also similar with how we test the effect of port missing as well:

public function testConnectionWithoutPort()
{
$options = $this->adapter->getOptions();
unset($options['port']);
$this->adapter->setOptions($options);
$this->assertInstanceOf('PDO', $this->adapter->getConnection());
}

so it's not like this is the only place we have this. I'd like to address this in a separate PR, so I'm fine with merging this for now as is.

@MasterOdin MasterOdin merged commit 2046c44 into cakephp:master Jul 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

How to use sqlsrv 2019?

4 participants