Using the Microsoft ODBC Data Source Administrator

You can use the Microsoft ODBC Data Source Administrator to edit the DSN configuration. Note that the DSN is created during the installation process.

Complete the following steps to edit the DSN configuration:

1. Select Start > Search, and enter ODBC Data Sources in the Search box.
2. Choose the version of the ODBC Administrator that corresponds to the bitness of your application (32-bit or 64-bit).
3. Click the System DSN tab.
4. Select the system data source and click Configure.
5. Edit the information on the Connection tab and click OK.

Note: For .NET Framework 4.0, the driver distributes Microsoft Visual C++ 2015-2022 Redistributable. For .NET Framework 3.5, the driver distributes Microsoft Visual C++ 2008 Redistributable.

Ensuring Registry Access

The driver stores connection information in the Windows registry. To ensure that the driver can write to the registry, perform either of the following actions:

1. Run the calling application as an administrator.
2. Connect via a User DSN instead of a System DSN.

Connecting to Azure Cosmos DB

Azure Cosmos DB supports connecting and authenticating by Account Key, through Azure AD, or through Azure Service Principal.

Account Key

Log in to the Azure Portal, select Azure Cosmos DB, and select your account.

Set the following to authenticate:

• AccountEndpoint: The Cosmos DB account URL. Set this to the URI value found in the Settings > Keys blade of the Cosmos DB account.
• AccountKey: A master key token or a resource token for connecting to Azure Cosmos DB. Set this to the PRIMARY KEY value found in the Settings > Keys blade of the Cosmos DB account.
• TokenType: (optional). Set this to "master" (the default value) if you are using a Master Token, which is a full permissions token generated during account creation. Otherwise, set this property to "resource" if you are using a Resource Token, which is a custom permissions token generated when a database user is set up.

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the driver to access Azure Cosmos DB endpoints securely.

Authentication to Entra ID always requires that you first create and register a custom OAuth application. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections.

Desktop Applications

During the registration of your custom application, as described in Creating an Entra ID (Azure AD) Application, record the following values: client Id, client secret, and callback URL (redirect URI).

Then, set the following connection properties:

• AuthScheme: AzureAD.
• InitiateOAuth:
  • GETANDREFRESH: Use for the initial login. Launches the login page and saves tokens.
  • REFRESH: Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Headless Machines

Headless environments like CI/CD pipelines, background services, or server-based integrations do not have an interactive browser. To authenticate using AzureAD, you must complete the OAuth flow on a separate device with a browser and transfer the authentication result to the headless system.

Setup options:

• Obtain and exchange a verifier code
  • Use another device to sign in and retrieve a verifier code, which the headless system uses to request tokens.
• Transfer an OAuth settings file
  • Authenticate on another device, then copy the stored token file to the headless environment.

Using a Verifier Code

1. On a device with a browser:
   • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
   • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
   • Call the GetOAuthAuthorizationURL stored procedure to generate a sign-in URL.
   • Open the returned URL in a browser. Sign in and grant permissions to the driver. You are redirected to the callback URL, which contains the verifier code.
   • After signing in, save the value of the code parameter from the redirect URL. You will use this later to set the OAuthVerifier connection property.
2. On the headless machine:
   • Set the following properties:
     • AuthScheme: AzureAD.
     • OAuthVerifier: The verifier code you saved.
     • OAuthSettingsLocation: The path of the file that holds the OAuth token values.
     • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
     • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
   • After tokens are saved, reuse them by setting:
     • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
     • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
     • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

Transferring OAuth Settings

1. On a device with a browser:
   • Connect using the instructions in the Desktop Applications section.
   • After connecting, tokens are saved to the file path in OAuthSettingsLocation. The default filename is OAuthSettings.txt.

   Encrypted values are stored in the system registry.

2. On the headless machine:
   • Copy the OAuth settings file to the machine.
   • Set the following properties:
     • AuthScheme: AzureAD.
     • OAuthSettingsLocation: Make sure this location grants read and write permissions to the driver to enable the automatic refreshing of the access token.
     • OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
     • OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.

After setup, the driver uses the stored tokens to refresh the access token automatically, no browser or manual login is required.

Azure Service Principal

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Azure Service Principal is role-based application-based authentication. This means that authentication is done per application, rather than per user. All tasks taken on by the application are executed without a default user context, but based on the assigned roles. The application access to the resources is controlled through the assigned roles' permissions.

For information about how to set up Azure Service Principal authentication, see Creating a Service Principal App in Entra ID (Azure AD).