Ignition gateway module · Microsoft Entra ID

Retire the SQL passwords
in your Ignition gateways.

Knurlsoft Datasource Auth signs your Azure SQL connections in with Microsoft Entra ID — certificate, client secret, or managed identity. It keeps the standard Microsoft SQL Server driver; you delete the username and password. No credentials stored in datasource configs. Access tokens never touch disk.

See pricing → How it works
  • Ignition 8.1.33–8.1.44 & 8.3.0–8.3.9
  • Azure SQL DB & Managed Instance
  • Drop-in module (.modl)

Built for the stack you already run

Ignition SCADA Microsoft Entra ID Azure SQL Database SQL Managed Instance mssql-jdbc 12.4+
The old way is a liability

Static SQL credentials don't survive a security review.

Ignition talks to SQL Server the way it did a decade ago: a username and a password, sitting in a datasource config. In an Entra-governed estate, that's the finding auditors circle first.

Passwords in the config

Shared SQL logins live in every gateway's internal DB and gateway backup. Rotating one means touching every gateway by hand.

The JAR-on-the-classpath hack

Bolting a raw auth JAR onto the driver classpath is brittle, invisible to operators, and breaks silently on the next upgrade.

No path to Entra

Your identity team standardized on Entra ID — conditional access, managed identities, cert rotation. Your SCADA layer never got the memo.

One module. Passwords gone.

Datasource Auth makes Ignition a first-class Entra ID citizen.

Install one Ignition module. Point your datasource at the module's token callback. Every SQL login now runs on a short-lived Entra ID access token — acquired, cached, and refreshed automatically, and never written to disk.

  • Delete the username and password from the datasource entirely.
  • Choose certificate, client secret, or managed identity in the gateway UI.
  • Watch a live readiness verdict and one-click connection test.
  • Tokens refresh ahead of expiry automatically, including across a gateway restart — no stale-token gap to fall into.
Databases › Connections › MSSQL_Historian
svc_scada
Removed
••••••••••••
Removed
databaseName=analytics;accessTokenCallbackClass=com.knurlsoft.datasourceauth.bridge.DatasourceAuthTokenCallback
Added
MSSQL_Historian Valid

The standard Microsoft SQL Server driver invokes the callback at every login handshake. The module answers with a fresh Entra ID token.

What you get

Entra ID auth, engineered for the control room.

Native Entra ID auth

Service-principal certificate, client secret, or managed identity — the same identities your Azure estate already trusts.

No token ever hits the disk

Tokens live in memory for their lifetime and are never persisted — no config strings, no datasource properties, no logs. Validation errors carry field and reason, never values. The one secret that does sit on the gateway is the certificate or client secret you supply, held where you put it and encrypted at rest by the gateway.

Drop-in, not re-architecture

Keep the standard SQL Server driver. Add one connection property. No custom JDBC URL, no classpath surgery, no per-datasource code.

A real gateway UI

A live readiness banner, conditional fields per method, an installer for the driver bridge, and a one-click connection test with plain-language diagnostics.

Caching & auto-refresh

A single-flight token service caches, refreshes ahead of expiry, and recovers cleanly on restart — no thundering herd of duplicate refresh calls, no stale-token surprises.

Ships as a module

A proper Ignition .modl with its own config pages and lifecycle — installed, upgraded, and removed like any other module.

How it works

Three steps from password to token.

1

Install the module

Upload the Datasource Auth .modl to your gateway and run the built-in installer to place the driver bridge into user-lib/jdbc.

2

Configure your identity

Pick certificate, client secret, or managed identity in the gateway config page. The module validates it and shows a live Ready verdict.

3

Point the datasource

Clear the username and password, add the callback property, and test. Every SQL login now rides a fresh Entra ID token.

Auth methods

Use the identity that fits the gateway.

Recommended

Service principal certificate

A certificate-backed app registration. The strongest option for gateways outside Azure — no shared secret to leak or expire quietly.

  • PEM certificate + private key on the gateway
  • Rotate on your own cadence
  • Confirmed against a live Azure SQL database

Client secret

The familiar app-registration secret. Fast to stand up for a proof of value, with the secret encrypted at rest by the gateway.

  • Simplest to configure
  • Secret encrypted by the gateway, never logged
  • Confirmed against a live Azure SQL database

Managed identity

For gateways running in Azure: no credential to manage at all. The platform issues the token; the module rides it into SQL.

  • System- or user-assigned (IMDS)
  • Zero secrets on the gateway
  • Implemented and supported; confirmation against a hosted gateway in progress
Security & compliance

Designed to pass the audit, not just the demo.

Datasource Auth was built secret-first. The properties your reviewers ask about are architectural guarantees, not settings someone can misconfigure.

Talk to us about your controls

Tokens are never persisted

No disk, no config, no datasource properties. Access tokens live in memory for their lifetime and nowhere else.

Secret-free logs

Diagnostics carry a field name and a reason — never a credential value. Redaction is baked into the types themselves.

Least privilege

A fixed, single token scope for Azure SQL. It asks Entra for exactly what a SQL login needs and nothing more.

Clean isolation

The driver bridge crosses the classloader boundary using JDK types only — no module internals and no secrets leak across.

Compatibility

Fits the versions you're actually on.

Ignition8.1.33–8.1.44 & 8.3.0–8.3.9 (one product — install the module built for your gateway's line)
TargetsAzure SQL Database & Managed Instance
DriverMicrosoft mssql-jdbc 12.4+
PlatformsLinux & Windows gateways
IdentityCertificate · client secret · managed identity
DeliveryIgnition module (.modl)
Pricing

Priced per gateway. No surprises.

A perpetual license for the gateway it runs on, including a year of updates and support. Deploy it on more gateways as you grow.

Evaluation
Free
Fully functional, two hours at a time
  • Every auth method, nothing held back
  • Runs on the gateway you already license
  • Setup help from the engineers who built it
Get the module
Per gateway
$1,500/ gateway
Perpetual license · 1 year updates & support
  • Production use on one gateway
  • Certificate, client secret & managed identity
  • All updates for 12 months
  • Priority email support
Buy Datasource Auth
Fleet & site
Volume
5+ gateways, or an unlimited site license
  • Tiered per-gateway discount
  • Site & enterprise licensing
  • Rollout guidance for your fleet
Request a quote

Prices in USD. Volume, reseller, and integrator pricing available — just ask.

Unlicensed, Datasource Auth evaluates the way every Ignition module does: it runs fully functional for two hours at a time, and you reset the timer from the gateway as often as you like. Licensed modules on the same gateway are unaffected, so you can try it against a real datasource on the gateway you already run — no separate test rig, no key to request first. On development and test gateways you can run it that way indefinitely, at no charge. Evaluating on a production gateway runs up to 45 days under the license terms. Need longer, or an uninterrupted pilot? Talk to us.

The Knurlsoft roadmap

Datasource Auth is the first of four.

One identity model, one vendor, for your whole Microsoft-aligned Ignition stack — the same Entra ID core, built for the same security buyer. Here's what's next. Need one of these? Tell us — a real request moves it up the list.

On request

Secret Provider

Pull database credentials and API keys straight from Azure Key Vault instead of local gateway storage — the natural companion to Datasource Auth. Your SQL auth is Entra; your remaining secrets live in Key Vault.

I need this →
On request

Audit Forwarder

Stream gateway audit, authentication, and config-change events to Microsoft Sentinel over syslog/CEF, so your SOC finally sees what happens on the plant floor — not a database table nobody queries.

I need this →
On request

OData Connector

A focused D365 + Dataverse bridge with the Entra token handshake already handled — REST + OData, tags, and a scripting API — at a fraction of a generic business-connector license.

I need this →

Also on the roadmap for this module: Entra ID auth for Azure Database for PostgreSQL and MySQL, and full Azure SQL confirmation for the managed-identity method on a hosted gateway. Tell us what you need →

FAQ

The questions your team will ask.

Does the module store the access token anywhere?

No. Tokens are held in memory for their lifetime and never written to disk, config strings, datasource properties, or logs. It's a core design rule, enforced in the type system.

Do I have to change my JDBC driver or connection URL?

No. You keep the standard Microsoft SQL Server driver and your normal connection URL. You add one connection property that points the driver at the module's token callback, and remove the username and password.

Which Ignition versions are supported?

Ignition 8.1.33 through 8.1.44, and Ignition 8.3.0 through 8.3.9. Ignition Edge is not supported. Because 8.3 changed how gateways manage configuration and drivers, it gets its own module built specifically for it — same product, same identity model. Every supported version is tested end to end against a real Azure SQL database, oldest release to newest. Upgrading a gateway from 8.1 to 8.3? Its settings migrate automatically on first boot, and a built-in prepare action walks your datasources across safely, with a short re-attach step once the upgrade completes.

Which databases does it target?

Azure SQL Database and Azure SQL Managed Instance in v1, using the standard Azure SQL token scope. Talk to us about other Entra-enabled SQL targets on your roadmap.

What happens to a gateway backup or a restore?

A gateway backup carries the Datasource Auth bridge and driver along with your config, so a restore brings authentication back up with it. For redundant pairs, install on both nodes.

How is it licensed?

A perpetual license per gateway at $1,500, including one year of updates and support. Volume and site licensing are available for fleets. Renewals keep you on the latest release.

How do I report a bug or get support?

Licensed customers get priority support at support@knurl.io. Found a defect? Send the details to bugs@knurl.io and we'll take it from there.

Ready to retire your SQL passwords?

Try it against a real datasource this week — on the gateway you already run. We'll help you stand it up.

Get the module → See pricing