Skip to content

Commit ebf493d

Browse files
fix: use ActiveDirectoryDefault for -G with no username
When -G is passed without a username, sqlcmd was selecting ActiveDirectoryIntegrated (Windows SSPI), which requires an interactive logon token and fails in non-interactive contexts like Emacs inferior shells or CI jobs with 'Integrated Security not supported'. Switch to ActiveDirectoryDefault, which walks the standard Azure credential chain (env vars, managed identity, Azure CLI, VS, then interactive browser). This matches the existing -G help text and works across Windows/Linux/macOS. Users who specifically need SSPI can still pass --authentication-method=ActiveDirectoryIntegrated. Fixes #699
1 parent a409f55 commit ebf493d

2 files changed

Lines changed: 22 additions & 1 deletion

File tree

cmd/sqlcmd/sqlcmd.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -203,7 +203,8 @@ func (a SQLCmdArguments) authenticationMethod(hasPassword bool) string {
203203
if a.UseAad {
204204
switch {
205205
case a.UserName == "":
206-
return azuread.ActiveDirectoryIntegrated
206+
// Default walks the Azure credential chain; works in non-interactive shells (issue #699).
207+
return azuread.ActiveDirectoryDefault
207208
case hasPassword:
208209
return azuread.ActiveDirectoryPassword
209210
default:

cmd/sqlcmd/sqlcmd_test.go

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -519,6 +519,26 @@ func TestConditionsForPasswordPrompt(t *testing.T) {
519519
}
520520
}
521521

522+
func TestAuthenticationMethodForUseAad(t *testing.T) {
523+
tests := []struct {
524+
name string
525+
userName string
526+
hasPassword bool
527+
expected string
528+
}{
529+
{"-G no username picks Default", "", false, azuread.ActiveDirectoryDefault},
530+
{"-G no username, password ignored", "", true, azuread.ActiveDirectoryDefault},
531+
{"-G with username, no password picks Interactive", "user@contoso", false, azuread.ActiveDirectoryInteractive},
532+
{"-G with username and password picks Password", "user@contoso", true, azuread.ActiveDirectoryPassword},
533+
}
534+
for _, tc := range tests {
535+
t.Run(tc.name, func(t *testing.T) {
536+
a := SQLCmdArguments{UseAad: true, UserName: tc.userName}
537+
assert.Equal(t, tc.expected, a.authenticationMethod(tc.hasPassword))
538+
})
539+
}
540+
}
541+
522542
func TestStartupScript(t *testing.T) {
523543
o, err := os.CreateTemp("", "sqlcmdmain")
524544
assert.NoError(t, err, "os.CreateTemp")

0 commit comments

Comments
 (0)