зеркало из https://github.com/microsoft/msphpsql.git
Updated Features (markdown)
Родитель
c7738c2460
Коммит
573f0396dd
|
@ -839,11 +839,11 @@ The above suggestion applies to [decimal and numeric](https://docs.microsoft.com
|
|||
You can use Azure Key Vault (AKV) to store the master and column encryption keys required for Always Encrypted functionality to work. With AKV, Always Encrypted is supported on Windows, Linux, and macOS. To get started with AKV, see the [documentation](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-get-started). To connect to AKV from a PHP script, you can use the credentials for an Azure account consisting of either an Azure Active Directory username and password, or an application client ID and client secret. The encryption keys can be easily created in SQL Server Management Studio or using PowerShell; details [here](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/create-and-store-column-master-keys-always-encrypted?view=sql-server-2017#creating-column-master-keys-in-azure-key-vault). Support for AKV is provided by the underlying ODBC Driver (version 17 is required), as detailed [here](https://docs.microsoft.com/en-us/sql/connect/odbc/using-always-encrypted-with-the-odbc-driver?view=sql-server-2017#working-with-column-master-key-stores).
|
||||
|
||||
To use AKV from a PHP script, the following keywords are *all* required:
|
||||
* **KeyStoreAuthentication**: specifies the kind of credentials used to connect to the vault. This keyword can take one of two possible values: **`KeyVaultPassword`** or **`KeyVaultClientSecret`**. If it is set to **`KeyVaultPassword`**, then you must connect with a username/password combination. If it is set to **`KeyVaultClientSecret`**, then you must connect using an application client ID/client secret combination.
|
||||
* **KeyStoreAuthentication**: specifies the kind of credentials used to connect to the vault. This keyword can take one of two possible values: **`KeyVaultPassword`** or **`KeyVaultClientSecret`**. If it is set to **`KeyVaultPassword`**, then you must connect with a username/password combination. If it is set to **`KeyVaultClientSecret`**, then you must connect using an application client ID/client secret combination. These values are case-insensitive.
|
||||
* **KeyStorePrincipalId**: specifies the name to connect with. If **KeyStoreAuthentication** is set to **`KeyVaultPassword`**, then **KeyStorePrincipalId** must be an Active Directory username. If **KeyStoreAuthentication** is set to **`KeyVaultClientSecret`**, then **KeyStorePrincipalId** must be an application client ID.
|
||||
* **KeyStoreSecret**: specifies the secret used by the connecting account. If **KeyStoreAuthentication** is set to **`KeyVaultPassword`**, then **KeyStoreSecret** must be the password associated with the username. If **KeyStoreAuthentication** is set to **`KeyVaultClientSecret`**, then **KeyStoreSecret** must be the client secret associated with the application client ID.
|
||||
|
||||
In addition, **ColumnEncryption** must be set to **enabled**. These keywords must be added to the connection options as any other keywords. If none of the three AKV-related keywords are present but **ColumnEncryption** is set to **enabled**, then the driver defaults to using the Windows Certificate Store instead (provided you are running on Windows).
|
||||
In addition, **ColumnEncryption** must be set to **enabled** (this is case-insensitive). These keywords must be added to the connection options as any other keywords. If none of the three AKV-related keywords are present but **ColumnEncryption** is set to **enabled**, then the driver defaults to using the Windows Certificate Store instead (provided you are running on Windows).
|
||||
|
||||
SQLSRV:
|
||||
```
|
||||
|
@ -870,7 +870,7 @@ $conn = sqlsrv_connect($server, $connectionInfo);
|
|||
PDO_SQLSRV:
|
||||
```
|
||||
$connectionInfo = "Database = $databaseName;
|
||||
ColumnEncryption = Enabled;
|
||||
ColumnEncryption = enabled;
|
||||
KeyStoreAuthentication = KeyVaultPassword;
|
||||
KeyStorePrincipalId = $AzureADUsername;
|
||||
KeyStoreSecret = $AzureADPassword; ";
|
||||
|
@ -879,7 +879,7 @@ $conn = new PDO("sqlsrv:server = $server; $connectionInfo", $uid, $pwd);
|
|||
or
|
||||
```
|
||||
$connectionInfo = "Database = $databaseName;
|
||||
ColumnEncryption = Enabled;
|
||||
ColumnEncryption = enabled;
|
||||
KeyStoreAuthentication = KeyVaultClientSecret;
|
||||
KeyStorePrincipalId = $applicationClientID;
|
||||
KeyStoreSecret = $applicationClientSecret; ";
|
||||
|
|
Загрузка…
Ссылка в новой задаче