Improved OBO logging and added OBO observability to SESSION_CONTEXT

[anushakolan]

Why make this change?

Closes #3125

1. Adds OBO (On-Behalf-Of) observability improvements for debugging and auditing user-delegated authentication flows.
2. Enables end-to-end tracing from DAB application logs to SQL Server queries using OpenTelemetry correlation IDs.
3. Provides SQL-side visibility into which user and tenant executed a query when using user-delegated auth.

What is this change?

1. Enhanced OBO Token Logging (OboSqlTokenProvider.cs)

• Added structured logging with EventType field for easier log filtering and analysis
• Included traceId in all OBO-related log messages to enable correlation with distributed traces
• Event types added: OboValidationFailed, OboTokenCacheMiss, OboTokenAcquired, OboTokenCacheHit

2. SESSION_CONTEXT Observability Values (MsSqlQueryExecutor.cs)
   Added the following values to SQL Server SESSION_CONTEXT when set-session-context is enabled:

• dab.trace_id - OpenTelemetry TraceId (set when Activity is present)
• dab.span_id - OpenTelemetry SpanId (set when Activity is present)
• dab.auth_type - Auth type indicator, value: obo (set when user-delegated auth is enabled)
• dab.user_id - User identifier from oid claim, falls back to sub claim (set when user-delegated auth is enabled)
• dab.tenant_id - Azure AD tenant ID from tid claim (set when user-delegated auth is enabled)

How was this tested?

Unit Tests

1. GetSessionParamsQuery_IncludesAllObservabilityValues_WhenActivityAndOboEnabled
2. GetSessionParamsQuery_ExcludesCorrelationIds_WhenNoActivity

Manual E2E Testing

• Deployed to Azure Container App with Azure SQL Database
• Verified OBO token logging in container logs with traceId correlation
• Verified SESSION_CONTEXT values via stored procedure (dbo.GetSessionContext)
• Confirmed correlation between container logs and SQL SESSION_CONTEXT values

[anushakolan]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 6 pipeline(s).

[Copilot]

Pull request overview

This PR improves observability for user-delegated (OBO) authentication by enhancing OBO token acquisition logging and by adding OpenTelemetry correlation + OBO identity details into SQL Server SESSION_CONTEXT when set-session-context is enabled.

Changes:

• Add structured OBO token logging in OboSqlTokenProvider with event types and traceId correlation.
• Extend MsSqlQueryExecutor.GetSessionParamsQuery to set dab.trace_id, dab.span_id, dab.auth_type, dab.user_id, and dab.tenant_id in SESSION_CONTEXT.
• Add unit tests validating inclusion/exclusion of correlation IDs and OBO observability session-context values.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/Service.Tests/UnitTests/SqlQueryExecutorUnitTests.cs	Adds unit tests for new session-context observability values and Activity correlation behavior.
src/Core/Resolvers/OboSqlTokenProvider.cs	Adds structured log fields (EventType + traceId) for OBO validation/cache/acquisition events.
src/Core/Resolvers/MsSqlQueryExecutor.cs	Writes OpenTelemetry correlation IDs and OBO identity markers into SQL Server SESSION_CONTEXT.

[anushakolan]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 6 pipeline(s).