[OBO] Add CLI support for user-delegated authentication configuration

[Copilot]

Why make this change?

Implements CLI configuration for OBO (On-Behalf-Of) delegated identity as specified in issue #2898. Enables operators to configure per-user Entra ID authentication to Azure SQL via CLI commands instead of manual config file editing.

What is this change?

New Configuration Type

• UserDelegatedAuthConfig record with Enabled, DatabaseAudience, DisableConnectionPooling, TokenCacheDurationMinutes properties
• Added to DataSource as optional property with full serialization support

CLI Commands

dab configure --data-source.user-delegated-auth.enabled true
dab configure --data-source.user-delegated-auth.database-audience "https://database.windows.net"

Validation

• Restricts user-delegated-auth to MSSQL database type only
• Validates enabled state when setting properties
• Preserves existing configuration when updating individual fields

Generated Configuration

{
  "data-source": {
    "database-type": "mssql",
    "connection-string": "...",
    "user-delegated-auth": {
      "enabled": true,
      "database-audience": "https://database.windows.net"
    }
  }
}

How was this tested?

• Unit Tests (12 new tests: 10 CLI configuration, 2 runtime parsing)
• Integration Tests (verified with PostgreSQL/MySQL rejection scenarios)

Sample Request(s)

Initialize and configure OBO in one workflow:

# Initialize MSSQL config
dab init --database-type mssql --connection-string "Server=myserver.database.windows.net;Database=mydb"

# Enable user-delegated auth
dab configure --data-source.user-delegated-auth.enabled true \
              --data-source.user-delegated-auth.database-audience "https://database.windows.net"

Update audience for existing configuration:

dab configure --data-source.user-delegated-auth.database-audience "https://database.usgovcloudapi.net"

Validation - fails for non-MSSQL:

dab init --database-type postgresql --connection-string "..."
dab configure --data-source.user-delegated-auth.enabled true
# Error: user-delegated-auth is only supported for database-type 'mssql'.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• http://api.nuget.org:443/DigiCertCSRSA4096RootG5.crl
  • Triggering command: /usr/bin/dotnet dotnet build src/Azure.DataApiBuilder.sln grep -l rceOptions nRpcErrorCodes.cs de/node/bin/grep rceOptions s/MySqlGraphQLMu-l nfig/composer/veTryConfigureSettings\|TryUpdateConfiguredDataSourceOptions grep -l rceOptions llectionExtensions.cs rep rceOptions (http block)
• http://api.nuget.org:443/NETFoundationProjectsCodeSigningCA2.crl
  • Triggering command: /usr/bin/dotnet dotnet build src/Azure.DataApiBuilder.sln grep -l rceOptions nRpcErrorCodes.cs de/node/bin/grep rceOptions s/MySqlGraphQLMu-l nfig/composer/veTryConfigureSettings\|TryUpdateConfiguredDataSourceOptions grep -l rceOptions llectionExtensions.cs rep rceOptions (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[OBO] CLI Support for Enabling OBO Delegated Identity</issue_title>
<issue_description>Implement CLI support for enabling OBO exactly as defined in the design.

• These CLI Commands should be supported
  dab configure --data-source.user-delegated-auth.enabled true
dab configure --data-source.user-delegated-auth.database-audience "<audience>"

• Ensure CLI writes correct config structure

• Ensure runtime consumes CLI‑produced config

Testing:

1. CLI sets user-delegated-auth.enabled = true
2. CLI sets correct database-audience
3. runtime reads CLI output correctly
4. invalid CLI input fails deterministically</issue_description>

<agent_instructions>https://microsoft-my.sharepoint.com/:w:/p/anushakolan/IQDsb4patJ52Q65Cp0QHQ-b_Aazplc1go_6k2HccCOYLQNU?e=Bpuv1Z&wdOrigin=TEAMS-MAGLEV.null_ns.rwc&wdExp=TEAMS-TREATMENT&wdhostclicktime=1770765689642&web=1

Follow this design document for more context and questions, understand the requirement of the task, this is the main task, #2898, create the PR accordingly.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes [OBO] CLI Support for Enabling OBO Delegated Identity #3127

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.