golang-migrate/migrate · error

both password and useMsi=true were passed

Error message

both password and useMsi=true were passed

What it means

ErrMultipleAuthOptionsPassed is returned by the sqlserver driver's Open when the URL both enables useMsi=true and contains a password in the userinfo. Azure MSI and explicit password auth are mutually exclusive, so the driver rejects the combination.

Source

Thrown at database/sqlserver/sqlserver.go:32

	"github.com/Azure/go-autorest/autorest/adal"
	"github.com/golang-migrate/migrate/v4"
	"github.com/golang-migrate/migrate/v4/database"
	mssql "github.com/microsoft/go-mssqldb" // mssql support
)

func init() {
	database.Register("sqlserver", &SQLServer{})
}

// DefaultMigrationsTable is the name of the migrations table in the database
var DefaultMigrationsTable = "schema_migrations"

var (
	ErrNilConfig                 = fmt.Errorf("no config")
	ErrNoDatabaseName            = fmt.Errorf("no database name")
	ErrNoSchema                  = fmt.Errorf("no schema")
	ErrDatabaseDirty             = fmt.Errorf("database is dirty")
	ErrMultipleAuthOptionsPassed = fmt.Errorf("both password and useMsi=true were passed")
)

var lockErrorMap = map[int]string{
	-1:   "The lock request timed out.",
	-2:   "The lock request was canceled.",
	-3:   "The lock request was chosen as a deadlock victim.",
	-999: "Parameter validation or other call error.",
}

// Config for database
type Config struct {
	MigrationsTable string
	DatabaseName    string
	SchemaName      string
}

// SQL Server connection
type SQLServer struct {

View on GitHub (pinned to 01a9643f14)

Solutions

1. Remove the password (and typically username) from the URL userinfo when useMsi=true is set
2. Use the same connection-string template with a conditional that omits credentials for MSI environments
3. If password auth is intended, drop useMsi=true from the query

Example fix

// before
migrate.Open("sqlserver://user:pass@myserver.database.windows.net:1433?database=mydb&useMsi=true")
// after
migrate.Open("sqlserver://myserver.database.windows.net:1433?database=mydb&useMsi=true")

u, _ := url.Parse(dsn)
_, hasPass := u.User.Password()
if hasPass && u.Query().Get("useMsi") == "true" {
    return errors.New("cannot combine URL password with useMsi=true")
}

func authOptionsConsistent(u *url.URL) bool {
    _, hasPass := u.User.Password()
    return !(hasPass && u.Query().Get("useMsi") == "true")
}

When it happens

Trigger: Opening sqlserver://user:password@host/db?useMsi=true — the URL userinfo carries a password while MSI is requested.

Common situations: Templated connection strings where a default password is always injected; switching local dev (password) to Azure (MSI) without stripping the password; copy-pasted URLs accumulating parameters.

Related errors

• no config
• no database name
• no schema
• database is dirty
• database is dirty

AI-assisted analysis of golang-migrate/migrate@01a9643f14 (2026-09-02). Data as JSON: /api/errors/9afb4c37ff457cd3. Report an issue: GitHub.