Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

ActiveDirectoryServicePrincipalAccessToken: password/token not propagated to driver

Open Beginner friendly
#757 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
azure, go
Domain
authentication, cli, security

Research direction

Start in pkg/sqlcmd/connect.go at the password-propagation branch and compare its listed authentication methods with ActiveDirectoryServicePrincipalAccessToken. Reproduce with the SQLCMDPASSWORD command from the issue, then verify the token reaches the driver and audit the other azuread methods for the same gap.

Written by the indexing model from the issue text.

Description

sqlcmd advertises ActiveDirectoryServicePrincipalAccessToken via --authentication-method (see the help string in cmd/sqlcmd/sqlcmd.go around line 454), but the method does not actually work end-to-end.

Root cause

The go-mssqldb azuread connector for this method expects the pre-obtained bearer token to arrive in the connection string as the password. sqlcmd's pkg/sqlcmd/connect.go only attaches url.UserPassword(UserName, Password) to the URL for a specific set of methods (SqlPassword, ActiveDirectoryPassword, ActiveDirectoryServicePrincipal, ActiveDirectoryApplication, ActiveDirectoryClientAssertion). ActiveDirectoryServicePrincipalAccessToken is not in that list, so the value of -P / SQLCMDPASSWORD is silently dropped and the driver receives no token.

Repro

SQLCMDPASSWORD=<a valid AAD access token> sqlcmd -S <server> --authentication-method ActiveDirectoryServicePrincipalAccessToken -U <ignored>

Driver fails because no token was passed.

Suggested fix

Add ActiveDirectoryServicePrincipalAccessToken (and audit other azuread methods for the same gap) to the password-propagation branch in pkg/sqlcmd/connect.go.

Context

Surfaced in #639 while updating README docs to enumerate the supported --authentication-method values.

Dominant language
Go
Stars
595
Forks
91
Avg merge
9h 35m
Merged PRs (30d)
1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/go-sqlcmd

All issues in microsoft/go-sqlcmd

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.