Connections in ADOMD.NET - Establishing secure connections

When you use a connection in ADOMD.NET, the security method that the connection uses depends on the value of the ProtectionLevel property in the connection string. You set this property when you call the Open method of the AdomdConnection.

The ProtectionLevel property offers four security levels: unauthenticated, authenticated, signed, and encrypted. The following table describes each level.

Note

Database connection pooling requires identical connection strings, so the database can't manage security for pooled connections. Manage security elsewhere.

Security Level ProtectionLevel Value
Unauthenticated connection
An unauthenticated connection doesn't use any form of authentication. This kind of connection is the most widely supported, but least secure, form of connection.		 None
Authenticated connection
An authenticated connection authenticates the user who is making the connection, but doesn't secure additional communications. This kind of connection is useful because you can establish the identity of the user or application that is connecting to an analytical data source.		 Connect
Signed connection
A signed connection authenticates the user who is requesting the connection, and then ensures that transmissions aren't modified. This kind of connection is useful when the authenticity of the transferred data must be verified. However, a signed connection only prevents the content of the data packet from being modified. The content can still be viewed in transit.



Note that a signed connection is only supported by the XML for Analysis provider supplied by SQL Server Analysis Services.		 Pkt Integrity or PktIntegrity
Encrypted connection
An encrypted connection is the default connection type used by ADOMD.NET. This kind of connection authenticates the user who is requesting the connection, and then also encrypts the data that is transmitted. An encrypted connection is the most secure form of connection that ADOMD.NET can create. The content of the data packet can't be viewed or modified, which protects data during transit.



An encrypted connection is only supported by the XML for Analysis provider supplied by SQL Server Analysis Services.		 Pkt Privacy or PktPrivacy

Available security levels depend on the connection type:

  • TCP connections support all four security levels. A TCP connection with Windows Integrated Security provides the most secure connection to an analytical data source.

  • An HTTP connection can only be an authenticated connection. Therefore, set the ProtectionLevel property to Connect.

  • An HTTPS connection can only be an encrypted connection. Therefore, set the ProtectionLevel property to Pkt Privacy or PktPrivacy.

Securing TCP connections

For TCP connections, the ProtectionLevel property supports all four security levels:

ProtectionLevel Value Use with TCP Connection? Results
None Yes Specifies an unauthenticated connection.

A TCP stream is requested from the provider, but the provider doesn't authenticate the user who requests the stream.
Connect Yes Specifies an authenticated connection.

A TCP stream is requested from the provider, and then the provider authenticates the security context of the user who requests the stream:

If authentication succeeds, no other action is taken. If authentication fails, the AdomdConnection object disconnects from the multidimensional data source and throws an exception.

After authentication succeeds or fails, the security context that is used to authenticate the connection is disposed.
Pkt Integrity or PktIntegrity Yes Specifies a signed connection.

A TCP stream is requested from the provider, and then the provider authenticates the security context of the user who requests the stream:



If authentication succeeds, the AdomdConnection object closes the existing TCP stream and opens a signed TCP stream to handle all requests. The provider uses the connection's security context to authenticate each data or metadata request. It also digitally signs each packet to confirm that the payload hasn't changed.



If authentication fails, the AdomdConnection object disconnects from the multidimensional data source and throws an exception.
Pkt Privacy or PktPrivacy Yes Specifies an encrypted connection.



Omitting the ProtectionLevel property from the connection string also specifies an encrypted connection.



A TCP stream is requested from the provider, and then the provider authenticates the security context of the user requesting the stream:



If authentication succeeds, the AdomdConnection object closes the existing TCP stream and opens an encrypted TCP stream to handle all requests. Each request for data or metadata is authenticated by using the security context that was used to open the connection. Additionally, the payload of each TCP packet is encrypted by using the highest encryption method supported by both the provider and the multidimensional data source.



If authentication fails, the AdomdConnection object disconnects from the multidimensional data source and throws an exception.

Use Windows Integrated Security for the connection

Windows Integrated Security is the most secure way to establish and protect a connection to an Azure Analysis Services instance. It doesn't reveal credentials, such as a username or password, during authentication. Instead, it uses the security identifier of the current process to establish identity. For most client applications, this security identifier represents the identity of the currently signed-in user.

To use Windows Integrated Security, the connection string requires the following settings:

  • For the Integrated Security property, either don't set this property or set this property to SSPI.

    Note

    Windows Integrated Security supports only TCP connections. For HTTP connections, set Integrated Security to Basic.

  • Set the ProtectionLevel property to Connect, Pkt Integrity, or Pkt Privacy.

Securing HTTP connections

Use HTTPS and Secure Sockets Layer (SSL) to secure HTTP communication with an analytical data source.

Because an XMLA provider uses only secure HTTP, sign each ADOMD.NET HTTP connection as shown in the following table.

ProtectionLevel Value Use with HTTP or HTTPS
None No
Connect HTTP
Pkt Integrity or PktIntegrity No
Pkt Privacy or PktPrivacy HTTPS

Opening a secure HTTP connection

This example uses ADOMD.NET to open an HTTP connection to the AdventureWorksAS sample Analysis Services database:

Public Function GetAWEncryptedConnection( _  
    Optional ByVal serverName As String = "https:\\localhost\isapy\msmdpump.dll") _  
    As AdomdConnection  
  
    Dim strConnectionString As String = ""  
    Dim objConnection As New AdomdConnection  
  
    Try  
        ' To establish an encrypted connection, set the   
        ' ProtectionLevel setting to PktPrivacy.  
        strConnectionString = "DataSource=" & serverName & ";" & _  
            "Catalog=AdventureWorksAS;" & _  
            "ProtectionLevel=PktPrivacy;"  
  
        ' The connection string doesn't include a username or password.  
        ' ADOMD.NET uses the current security context for authentication  
        ' purposes.  
  
        objConnection.ConnectionString = strConnectionString  
        objConnection.Open()  
    Catch ex As Exception  
        objConnection = Nothing  
        Throw ex  
    Finally  
        ' Return the encrypted connection.  
        GetAWEncryptedConnection = objConnection  
    End Try  
End Function
  • Last updated on