golang-migrate/migrate · error

both password and useMsi=true were passed

Error message

both password and useMsi=true were passed

What it means

ErrMultipleAuthOptionsPassed is returned by the sqlserver driver's Open when the URL both enables useMsi=true and contains a password in the userinfo. Azure MSI and explicit password auth are mutually exclusive, so the driver rejects the combination.

Solutions

1. Remove the password (and typically username) from the URL userinfo when useMsi=true is set
2. Use the same connection-string template with a conditional that omits credentials for MSI environments
3. If password auth is intended, drop useMsi=true from the query

Example fix

// before
migrate.Open("sqlserver://user:pass@myserver.database.windows.net:1433?database=mydb&useMsi=true")
// after
migrate.Open("sqlserver://myserver.database.windows.net:1433?database=mydb&useMsi=true")

u, _ := url.Parse(dsn)
_, hasPass := u.User.Password()
if hasPass && u.Query().Get("useMsi") == "true" {
    return errors.New("cannot combine URL password with useMsi=true")
}

func authOptionsConsistent(u *url.URL) bool {
    _, hasPass := u.User.Password()
    return !(hasPass && u.Query().Get("useMsi") == "true")
}

When it happens

Trigger: Opening sqlserver://user:password@host/db?useMsi=true — the URL userinfo carries a password while MSI is requested.

Common situations: Templated connection strings where a default password is always injected; switching local dev (password) to Azure (MSI) without stripping the password; copy-pasted URLs accumulating parameters.

Related errors

• database is dirty
• no config
• no database name
• no schema
• conn: , db

AI-assisted analysis of golang-migrate/migrate@01a9643f14 (2026-09-02). Data as JSON: /api/errors/9afb4c37ff457cd3. Report an issue: GitHub.

Appendix: source

Thrown at database/sqlserver/sqlserver.go:32

	"github.com/Azure/go-autorest/autorest/adal"
	"github.com/golang-migrate/migrate/v4"
	"github.com/golang-migrate/migrate/v4/database"
	mssql "github.com/microsoft/go-mssqldb" // mssql support
)

func init() {
	database.Register("sqlserver", &SQLServer{})
}

// DefaultMigrationsTable is the name of the migrations table in the database
var DefaultMigrationsTable = "schema_migrations"

var (
	ErrNilConfig                 = fmt.Errorf("no config")
	ErrNoDatabaseName            = fmt.Errorf("no database name")
	ErrNoSchema                  = fmt.Errorf("no schema")
	ErrDatabaseDirty             = fmt.Errorf("database is dirty")
	ErrMultipleAuthOptionsPassed = fmt.Errorf("both password and useMsi=true were passed")
)

var lockErrorMap = map[int]string{
	-1:   "The lock request timed out.",
	-2:   "The lock request was canceled.",
	-3:   "The lock request was chosen as a deadlock victim.",
	-999: "Parameter validation or other call error.",
}

// Config for database
type Config struct {
	MigrationsTable string
	DatabaseName    string
	SchemaName      string
}

// SQL Server connection
type SQLServer struct {

View on GitHub (pinned to 01a9643f14)