UAMI

Overview

This section describes how to connect the TSS to its database using Azure UAMI.

Setting up UAMI

UAMI is a method of authentication between multiples Azure resources. Notably, it can be used to connect the TSS to its database without a password.

The Azure resources group setup should contains at least 3 resources: a VM hosting the TSS, a database server, and a managed identity.
 
There is a series of steps to follow to make the UAMI works for the UIM:

•Assign the already created UAMI to the TSS Server

•Add Microsoft Entra admin to the Azure SQL Server

•Login to DB and add roles for UAMI:
CREATE USER [<Client-ID>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<Client-ID>];
ALTER ROLE db_datawriter ADD MEMBER [<Client-ID>];

Using UIM GUI

During the first configuration step, choose "Azure Managed Identities" in the authentication dropbox, and use the managed identity's Client ID as login:

In the second screen, enter the client ID in the associated box (it should be there by default):

Using Command line

This section describes how to connect the TSS to its database using Azure UAMI in command line.
The argument is used to specify to use the UAMI connection. The Client ID is specified in the 'login' argument.

example:

UIM.exe /new_install /port:3306 /id:1 /remote: /remote_port:3306 /service: /database_host:sql-tssdb-euw-0dba87.database.windows.net /database_driver:SQLSERVER /login:208d7a9a-3c24-4e8b-8ea0-93e23938b16e /path:"F:\LocalLogs\UIMNewInstall.txt" /external_database:true /UAMI:true