Azure AD/Token/Certificates/SQL - I'm lost - vb.net

Question

I started a company 3 months ago and there is no software (CRM+other business tasks) that meets my needs. Reluctantly I decided to write my own 2 months ago and it is now 80% complete! I've been pointed here to Stack Overflow throughout my journey many times and you guys have been a great help -- first and foremost thank you! I've been able to stay quiet until now...
The problem:
I have connection strings all over the place with SQL Authentication username/password exposed. My business partner is across the country so I need to give him access and open a port etc. I've made the move to Microsoft Azure (all setup with a VPN gateway, VM's are running and linked with Azure AD) to lockdown the environment a bit. I'd like to take full advantage of what it offers and use Active Directory for authentication on login (MFA) and then use the token in my query strings removing the need for a hard coded connection string with username/passwords...
I've done a lot of research and it seems I can accomplish what I want but I can't quite figure it out.
App is written in VB.net and most Microsoft docs on the topic are in C#, requiring edits to the app.xaml.cs file which doesn't exist in vb.net, and even if I got around that piece i'm not sure how to configure the sql connection strings to use the token.
Once I get this out of the way I can get back to finishing the software so I can get on the phone and help us take off before the money runs out! Your help is greatly appreciated!
EDIT :
I'm going this route because from what I've found, I can't use Authentication = Active Directory Integrated in my sql string because my AD is not federated (no on-premise ADFS), Active Directory Password still requires the sql admin setup in Azure to be in the sql string. I looked at key vaults which while doing research led me to registering my app which seems to be exactly what I want and where my questions is derived. Microsoft provides a great example downloadable project but again its in C#...If there is a recommendation on a different option i'm all ears...
EDIT 9/3/19 -- A lot of circling and research...I need to convert this code from c# to vb.net. More information on what the below is and how it is broken down from its creator : https://colinsalmcorner.com/post/configuring-aad-authentication-to-azure-sql-databases
public async Task<string> GetAccessTokenAsync(string clientId, string clientSecret, string authority, string resource, string scope)
{
var authContext = new AuthenticationContext(authority, TokenCache.DefaultShared);
var clientCred = new ClientCredential(clientId, clientSecret); << CAN I MAKE THESE (ClientId, ClientSecret) TIED TO TEXTBOXES FOR USERNAME/PASSWORD ON MY APPLICATION?
var result = await authContext.AcquireTokenAsync(resource, clientCred);
if (result == null)
{
throw new InvalidOperationException("Could not get token");
}
return result.AccessToken; <<WHAT DOES RETURN DO HERE?
}
AND
public async Task<SqlConnection> GetSqlConnectionAsync(string tenantId, string clientId, string clientSecret, string dbServer, string dbName)
{
var authority = string.Format("https://login.windows.net/{0}", tenantId);
var resource = "https://database.windows.net/";
var scope = "";
var token = await GetTokenAsync(clientId, clientSecret, authority, resource, scope);
var builder = new SqlConnectionStringBuilder();
builder["Data Source"] = $"{dbServer}.database.windows.net";
builder["Initial Catalog"] = dbName;
builder["Connect Timeout"] = 30;
builder["Persist Security Info"] = false;
builder["TrustServerCertificate"] = false;
builder["Encrypt"] = true;
builder["MultipleActiveResultSets"] = false;
var con = new SqlConnection(builder.ToString());
con.AccessToken = token;
return con;
}

Answer 1

I can understand that you want to use Azure AD access token to connect to Azure SQL DB. Based on the docs you provided and my own research , for now, we can use Azure AD service principle to get access token to connect to Azure SQL only.
I believe you have did some research on it already and find the codes to implement it using C# SDK. However there is no VB.net code sample to do it which confused you .
Honestly , I am not so familiar with VB.net , but I still implemented a demo to do that for you , pls refer to the code below :
Imports System.IO
Imports System.Net
Imports System.Text
Module Module1
Sub Main()
Dim tenant = ""
Dim client_id = ""
Dim username = ""
Dim password = ""
Dim client_secret = ""
Dim sqlserverName = ""
Dim dbname = ""
Dim dbConn = New SqlClient.SqlConnection
dbConn.ConnectionString = "Data Source=" + sqlserverName + ".database.windows.net;Initial Catalog=" + dbname + ";Connect Timeout=30"
dbConn.AccessToken = getAccessToken(tenant, client_id, client_secret, username, password)
Console.WriteLine("User: " + username)
Console.WriteLine("access token value:" + dbConn.AccessToken)
dbConn.Open()
Dim sqlQuery = "select ##version"
Dim Result = New SqlClient.SqlCommand(sqlQuery, dbConn).ExecuteScalar()
Console.WriteLine("query result from Azure SQL : " + Result.ToString)
Console.ReadKey()
End Sub
Function getAccessToken(tenant, client_id, client_secret, username, password) As String
Dim request As HttpWebRequest
request = HttpWebRequest.Create("https://login.microsoftonline.com/" + tenant + "/oauth2/token")
request.Method = "POST"
request.ContentType = "application/x-www-form-urlencoded"
Dim requestBody =
"grant_type=client_credentials" +
"&client_id=" + client_id +
"&client_secret=" + WebUtility.UrlEncode(client_secret) +
"&username=" + WebUtility.UrlEncode(username) +
"&password=" + WebUtility.UrlDecode(password) +
"&resource=https%3A%2F%2Fdatabase.windows.net%2F"
Dim encoding As New UTF8Encoding
Dim byteData As Byte() = encoding.GetBytes(requestBody)
request.ContentLength = byteData.Length
Dim postreqstream As Stream = request.GetRequestStream()
postreqstream.Write(byteData, 0, byteData.Length)
postreqstream.Close()
Dim result = request.GetResponseAsync().GetAwaiter().GetResult()
Dim result_str = New StreamReader(result.GetResponseStream()).ReadToEnd
Dim tokenResp As TokenResponse = Newtonsoft.Json.JsonConvert.DeserializeObject(Of TokenResponse)(result_str)
Return tokenResp.access_token
End Function
Public Class TokenResponse
Public Property token_type As String
Public Property expires_in As String
Public Property ext_expires_in As String
Public Property expires_on As String
Public Property not_before As String
Public Property resource As String
Public Property access_token As String
End Class
End Module
Pls refer to the steps below to create associated Azure AD apps and fill all params to run it :
Creating a Azure AD app in your tenant ,type its name and click register directly, in my case , the app name is DBadmin:
Note its application ID :
Creating a client secret for this app and note the secret :
Adding Azure SQL user login permission to this app :
Grant permission as an admin:
Go to "Groups" blade ,create an Azure AD group , adding the app we just created at same time :
Go to the Azure SQL server that you want to access , and adding the group we just created in to Azure AD admin of SQL server :
Remember to click save after adding .
Ok, we have done all configs here , just modify the params in code to try to connect to your Azure SQL .
Code result :
Hope it helps . Anyway If you just want to hide connection string in your config file.Key vault should be the best choice for you .