What causes "Domain must be provided for NTLM config" in Budibase/budibase?

Edit the datasource in the builder and set the Domain field under NTLM configuration (e.g. 'CORP' or 'corp.example.com').

Budibase/budibase · error · Error

Domain must be provided for NTLM config

Error message

Domain must be provided for NTLM config

What it means

The Microsoft SQL Server integration validates its config in connect() before creating a client. When authentication type is NTLM, an ntlmConfig object with a non-empty domain is mandatory; if domain is missing/empty the integration throws 'Domain must be provided for NTLM config'. This fails fast rather than producing a confusing mssql driver error later.

Source

Thrown at packages/server/src/integrations/microsoftSqlServer.ts:322

          const response = await clientApp.acquireTokenByClientCredential({
            scopes: ["https://database.windows.net/.default"],
            azureRegion: "DisableMsalForceRegion",
          })

          clientCfg.authentication = {
            type: "azure-active-directory-access-token",
            options: {
              token: response!.accessToken,
            },
          }
          break
        }
        case MSSQLConfigAuthType.NTLM: {
          const { domain, trustServerCertificate } =
            this.config.ntlmConfig || {}

          if (!domain) {
            throw Error("Domain must be provided for NTLM config")
          }

          clientCfg.authentication = {
            type: "ntlm",
            // @ts-expect-error - username and password not required for NTLM
            options: {
              domain,
            },
          }
          clientCfg.options ??= {}
          clientCfg.options.trustServerCertificate = !!trustServerCertificate
          break
        }
        case null:
        case undefined:
          break
        default:
          utils.unreachable(this.config)

View on GitHub (pinned to a81a902e9a)

Solutions

Edit the datasource in the builder and set the Domain field under NTLM configuration (e.g. 'CORP' or 'corp.example.com').
If updating via API/JSON, add ntlmConfig: { domain: '...', ... } to the datasource config and re-test the connection.
If your server does not actually use NTLM, switch authentication type to 'sql' (username/password) instead.
Re-run Test Connection after the change to confirm.

Example fix

// before
{ authType: "ntlm", user: "svc", password: "***" }
// after
{ authType: "ntlm", user: "svc", password: "***", ntlmConfig: { domain: "CORP", trustServerCertificate: true } }

Defensive patterns

Strategy: validation

Validate before calling

if (config.authType === "ntlm" && !config.ntlmConfig?.domain) {
  throw new Error("NTLM auth requires ntlmConfig.domain")
}

Type guard

const hasNtlmDomain = (
  c: MSSQLConfig
): c is MSSQLConfig & { ntlmConfig: { domain: string } } =>
  c.authType === MSSQLConfigAuthType.NTLM &&
  typeof c.ntlmConfig?.domain === "string" && c.ntlmConfig.domain.length > 0

Try / catch

try {
  await datasource.testConnection()
} catch (e) {
  if (String(e?.message).includes("Domain must be provided for NTLM")) {
    promptUserForNtlmDomain()
  }
}

Prevention

Fill every NTLM field (domain, username, password) when selecting NTLM auth
Validate datasource JSON imports against the config schema before saving
Use SQL auth instead of NTLM if no AD domain applies
Always run Test Connection right after configuring the datasource

When it happens

Trigger: Any datasource operation (testConnection, buildSchema, read, create...) on an MSSQL integration whose config.authType === 'ntlm' but whose ntlmConfig.domain is undefined or empty string.

Common situations: Creating the datasource via JSON import/API and omitting ntlmConfig entirely; filling username/password but not the domain field; older configs created before NTLM support that were switched to NTLM auth without adding the domain.

Related errors

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/2921689df52896c3. Report an issue: GitHub.