dbt-labs/dbt-core · error

configure

Error message

configure

What it means

SQLServerAuth::configure returns Result<database::Builder, AuthError>; here it runs parse_auth, apply_connection_args, and the service-principal apply step. `.expect("configure")` panics when any stage yields AuthError. For `authentication: serviceprincipal` the library builds a `sqlserver://` URI with fedauth=ActiveDirectoryServicePrincipal and user+id=<client_id>%40<tenant_id>; the error means the service-principal profile could not be parsed or applied (missing/invalid tenant_id, client_id, client_secret, host, or database).

Source

Thrown at crates/dbt-auth/src/sqlserver/mod.rs:287

        AdapterConfig::new(Mapping::from_iter(
            pairs.into_iter().map(|(k, v)| (k.into(), v.into())),
        ))
    }

    #[test]
    fn test_service_principal_with_tenant_id() {
        let config = make_config([
            ("authentication", "serviceprincipal"),
            ("host", "myserver.database.windows.net"),
            ("database", "mydb"),
            ("tenant_id", "my-tenant"),
            ("client_id", "my-client"),
            ("client_secret", "my-secret"),
        ]);

        let outcome = SQLServerAuth::new(Box::new(crate::NoopAuthWarningPrinter))
            .configure(&config)
            .expect("configure");
        let uri = uri_value(&outcome);

        assert_contains!(&uri, "sqlserver://myserver.database.windows.net:1433");
        assert_contains!(&uri, "database=mydb");
        assert_contains!(&uri, "fedauth=ActiveDirectoryServicePrincipal");
        assert_contains!(&uri, "user+id=my-client%40my-tenant");
        assert_contains!(&uri, "password=my-secret");
    }

    #[test]
    fn test_service_principal_without_tenant_id() {
        let config = make_config([
            ("authentication", "ActiveDirectoryServicePrincipal"),
            ("host", "myserver.database.windows.net"),
            ("database", "mydb"),
            ("client_id", "my-client"),
            ("client_secret", "my-secret"),
        ]);

View on GitHub (pinned to 0267ce9170)

Solutions

1. Read the AuthError message after `configure: ` in the panic to find which key failed.
2. Ensure the Mapping has string values for authentication=serviceprincipal, tenant_id, client_id, client_secret, host, database.
3. If URI construction fails, check the apply step that appends user+id=<client>%40<tenant> and fedauth=ActiveDirectoryServicePrincipal.
4. Keep authentication values lowercase `serviceprincipal` (or the accepted alias) exactly as parse_auth expects.
5. Run `cargo test -p dbt-auth sqlserver::tests::test_service_principal_with_tenant_id` to iterate narrowly.

Example fix

// before
let config = make_config([
    ("authentication", "serviceprincipal"),
    ("host", "myserver.database.windows.net"),
    // tenant_id missing -> configure errs
    ("client_id", "my-client"),
    ("client_secret", "my-secret"),
]);
// after
let config = make_config([
    ("authentication", "serviceprincipal"),
    ("host", "myserver.database.windows.net"),
    ("database", "mydb"),
    ("tenant_id", "my-tenant"),
    ("client_id", "my-client"),
    ("client_secret", "my-secret"),
]);

fn ensure_service_principal(config: &AdapterConfig) -> Result<(), String> {
    for key in ["authentication", "host", "client_id", "client_secret"] {
        if config.get_str(key).is_none() {
            return Err(format!("service principal profile missing `{key}`"));
        }
    }
    if config.get_str("database").is_none() {
        return Err("service principal profile missing `database`".into());
    }
    // tenant_id optional; when present it is appended as client_id%40tenant_id
    Ok(())
}

When it happens

Trigger: Calling SQLServerAuth::configure with a config whose authentication is `serviceprincipal` (as in crates/dbt-auth/src/sqlserver/mod.rs:287) but where parse_auth cannot build the ServicePrincipal IR — e.g. missing `tenant_id`, `client_id`, or `client_secret`, non-string values, or an unrecognized authentication value.

Common situations: Test updates to the service-principal URI format (e.g. percent-encoded tenant suffix) that no longer match parse_auth; profiles omitting tenant_id; refactors of the SQLServer AuthIR that narrow accepted key spellings (`authentication` vs `auth_type`).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Schema not found for canonical FQN: {}
• `EnterGuard` values dropped out of order. Guards returned by
• {e} {:?}
• {e}
• inconsistent park state; actual = {actual}

AI-assisted analysis of dbt-labs/dbt-core@0267ce9170 (2026-09-07). Data as JSON: /api/errors/8313bc9b54ef63be. Report an issue: GitHub.