dbt-labs/dbt-core · critical

authentication method {} not implemented

Error message

authentication method {} not implemented

What it means

When parsing a SQL Server profile's `authentication` setting, `parse_auth` matches the configured string against supported methods (ActiveDirectoryServicePrincipal, ActiveDirectoryAccessToken, ActiveDirectoryPassword, environment). A few legacy/alternative method names — ActiveDirectoryInteractive, ActiveDirectoryIntegrated, CLI, auto — are recognized but explicitly not implemented, so the code panics with `unimplemented!` naming the method. This is distinct from an invalid method name, which returns a config error instead.

Source

Thrown at crates/dbt-auth/src/sqlserver/mod.rs:193

            let access_token = config.require_str("access_token")?;
            // The driver rejects an empty token with a message that names the `password`
            // URI parameter, which does not exist in the user's profile. Fail earlier with
            // the profile field name instead.
            if access_token.is_empty() {
                return Err(AuthError::config(
                    "`access_token` must not be empty when using ActiveDirectoryAccessToken authentication",
                ));
            }
            Ok(SQLServerAuthIR::ActiveDirectoryAccessToken { access_token })
        }
        "ActiveDirectoryPassword" => Ok(SQLServerAuthIR::ActiveDirectoryPassword {
            user: config.require_str("UID")?,
            password: config.require_str("PWD")?,
            client_id: config.require_str("client_id")?,
        }),
        "environment" => Ok(SQLServerAuthIR::ActiveDirectoryEnvironment),
        "ActiveDirectoryInteractive" | "ActiveDirectoryIntegrated" | "CLI" | "auto" => {
            unimplemented!("authentication method {} not implemented", authentication)
        }
        _ => Err(AuthError::config(format!(
            "Invalid authentication method: {authentication} must be one of: [ActiveDirectoryServicePrincipal, ActiveDirectoryAccessToken, ActiveDirectoryPassword, environment]"
        ))),
    }
}

fn apply_connection_args(
    config: &AdapterConfig,
    mut builder: DatabaseBuilder,
    _warning_printer: &dyn AuthWarningPrinter,
) -> Result<DatabaseBuilder, AuthError> {
    let host = config.require_str("host")?;
    let port = config
        .get_string("port")
        .unwrap_or_else(|| DEFAULT_PORT.into());

    // both "mssql://" and "sqlserver://" are supported by the driver,

View on GitHub (pinned to 0267ce9170)

Solutions

1. Change the profile's `authentication` value to a supported method: ActiveDirectoryServicePrincipal, ActiveDirectoryAccessToken, ActiveDirectoryPassword, or environment.
2. For interactive Azure AD login, obtain a token out-of-band (e.g., `az account get-access-token`) and use `ActiveDirectoryAccessToken` with that token instead.
3. If you need the interactive/integrated methods, implement them in `crates/dbt-auth/src/sqlserver/mod.rs` replacing the `unimplemented!` arm.

Example fix

// before (profile config)
authentication: ActiveDirectoryInteractive
// after
authentication: ActiveDirectoryServicePrincipal

const SUPPORTED: [&str; 4] = [
    "ActiveDirectoryServicePrincipal",
    "ActiveDirectoryAccessToken",
    "ActiveDirectoryPassword",
    "environment",
];
fn validate_auth_method(m: &str) -> Result<(), String> {
    const UNSUPPORTED: [&str; 4] = ["ActiveDirectoryInteractive", "ActiveDirectoryIntegrated", "CLI", "auto"];
    if UNSUPPORTED.contains(&m) {
        return Err(format!("method {m} is recognized but not implemented; use one of {SUPPORTED:?}"));
    }
    if !SUPPORTED.contains(&m) {
        return Err(format!("invalid authentication method {m}"));
    }
    Ok(())
}

fn is_supported_sqlserver_auth(m: &str) -> bool {
    matches!(m, "ActiveDirectoryServicePrincipal" | "ActiveDirectoryAccessToken" | "ActiveDirectoryPassword" | "environment")
}

// Error surfaces as AuthError (config variant) only for invalid names; the
// unsupported-but-recognized names panic. Validate the profile before configure():
let auth = profile.get("authentication").and_then(|v| v.as_str()).unwrap_or("");
if matches!(auth, "ActiveDirectoryInteractive" | "ActiveDirectoryIntegrated" | "CLI" | "auto") {
    return Err(anyhow!("authentication method {auth} is not supported; use ActiveDirectoryServicePrincipal/AccessToken/Password/environment"));
}
let auth_ir = sqlserver_auth.configure(config).context("SQL Server auth configuration failed")?;

When it happens

Trigger: Calling `configure` on a SQLServer profile whose `authentication` key is set to `ActiveDirectoryInteractive`, `ActiveDirectoryIntegrated`, `CLI`, or `auto`.

Common situations: Users copy connection settings from Microsoft's SQL Server/ODBC docs or the pyodbc/Azure docs, which commonly list `ActiveDirectoryInteractive` or `ActiveDirectoryIntegrated` as valid Azure AD auth modes; these names are valid for Microsoft tooling but not yet supported by this Rust SQL Server auth implementation.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• generic backend authentication
• Starburst
• Athena
• Trino
• Dremio

AI-assisted analysis of dbt-labs/dbt-core@0267ce9170 (2026-09-07). Data as JSON: /api/errors/c564837b8e14116e. Report an issue: GitHub.