Darling: non-interactive Entra auth (Service Principal + Managed Identity) for headless targets #3484

Goal

Support non-interactive Microsoft Entra auth — Service Principal (client id + secret) and Managed Identity — for headless Darling target connections, so a 24/7 collector can monitor Azure SQL DB / MI with Entra auth. Requested by a prospect evaluating Darling for enterprise 24/7 monitoring; the auth already works in Lite.

Scope

• IN: ServicePrincipal (ActiveDirectoryServicePrincipal) and ManagedIdentity (ActiveDirectoryManagedIdentity) — both non-interactive, the right fit for an unattended service.
• OUT (explicitly): the interactive modes — EntraMFA, EntraDeviceCodeAuth, EntraDefaultCredential. Those need a broker/interactive user and stay refused headless, with a clear message pointing to the two supported modes.

Approach — 1:1 from Lite

The auth machinery is already in shared PerformanceMonitor.Common (AuthenticationTypes, the Entra connection-string mapping Lite uses). Reuse it; do not re-author. Work:

1. Open Darling's auth validation gate (DarlingMcpServerAdminTools "auth must be Windows or SQL") to accept the two non-interactive Entra modes; keep interactive modes refused.
2. Extend the darling.json server-config shape to carry the auth mode + Service Principal client id and DPAPI-encrypted client secret (reuse DarlingSecrets LocalMachine+entropy, same as SQL passwords); Managed Identity carries an optional user-assigned client id and no secret.
3. Build the target connection string via the shared Entra path.
4. add_servers MCP tool + config parsing + the Viewer add-server UI (backend first).
5. Tests.

Testing note

Live Entra requires an AAD-authenticated Azure SQL target + an app registration, which is hard in-house — and Lite itself pins this behavior with unit tests (its EntraDefaultCredential is documented "unverified against a live Entra tenant"). Mirror that: unit-pin the connection-string mapping, the validation accept/refuse matrix, and the secret DPAPI round-trip. A live smoke against a real tenant is a follow-up if/when a tenant is available.

Found/authored on nightly.443 (639a80ad).