[Victor Luna (victorlunam)]

Summary

On Linux and macOS, -E (trusted connection) previously fell back to NTLM and failed with Login failed for user ''. It now uses the go-mssqldb krb5 authenticator with the ticket obtained from kinit.

Fixes #468
Related: #595

Approach

Following the direction discussed in #468, there are no new flags. Configuration comes from environment variables:

• KRB5_CONFIG (default /etc/krb5.conf)
• KRB5CCNAME (default /tmp/krb5cc_<uid>). A FILE: prefix is stripped, because the driver reads the cache path literally and only checks the misspelled KRBCCNAME.

Windows keeps SSPI. Behaviour is unchanged when -E is not used.

Clear errors are returned for unsupported cache types (API:, KCM:, KEYRING:, DIR:) and for a missing default cache.

Limitation

gokrb5 only reads FILE: credential caches. The macOS default API: cache and the KCM:/KEYRING: defaults on Fedora/RHEL therefore need kinit -c FILE:... or KRB5CCNAME pointing at a file cache. Clients that use native GSSAPI (for example the vscode-mssql extension, see its KERBEROS_HELP.md) do not have this limitation. This is documented in the README.

Localization

The two new error messages go through the localizer, and the catalogs are regenerated with GOOS=windows go generate ./... in internal/translations so Windows-only strings are preserved. gotext extracts every string in the scanned packages, so the regeneration also picks up two strings that already exist on main but were missing from the catalog ("Do not strip the "mssql: " prefix from error messages" and the ASCII table format option). No existing entries or translations are removed; the new entries fall back to English until translated.

Dependencies

go.mod adds gokrb5/v8 and its dependencies as indirect requirements, pulled in by go-mssqldb/integratedauth/krb5. The additional older /go.mod-only lines in go.sum are part of that module graph: go mod tidy produces them, and go list -m all fails with "missing go.sum entry" without them.

Testing

• Unit tests for cache path resolution and connection-string parameters.
• Manually verified on macOS against SQL Server 2014 SP3 in an Active Directory domain: sys.dm_exec_connections.auth_scheme returns KERBEROS. The missing-ticket and unsupported-cache error paths were also checked.
• golangci-lint run --new-from-rev=main reports no new issues on darwin, linux and windows; go test ./... against SQL Server 2022 in Docker shows no failures beyond those already present on main.

[Copilot]

🟡 Changes recommended

Kerberos setup failures can silently leave the previous connection active, risking queries against the wrong server, while explicit SQL password authentication can incorrectly trigger Kerberos setup.

2 open issues

• Report Kerberos setup errors when reconnecting fails · New
• Skip Kerberos parameters for SQL password authentication · New

What changed in this PR

This PR adds Kerberos ticket-cache authentication for sqlcmd -E on Linux and macOS, addressing the trusted-connection failures described in #468 and #595 while preserving Windows SSPI behavior.

Changes:

• Configure Kerberos through environment variables without adding flags.
• Add cache validation, connection-string tests, and Kerberos dependencies.
• Document setup and file-cache limitations on Linux and macOS.

File	Description
README.md	Documents Kerberos configuration and supported cache types.
pkg/​sqlcmd/​sqlcmd.go	Applies Kerberos settings to trusted connections.
pkg/​sqlcmd/​kerberos.go	Registers Kerberos authentication and resolves configuration and cache paths.
pkg/​sqlcmd/​kerberos_test.go	Tests cache handling, connection parameters, and provider registration.
go.sum	Adds checksums for Kerberos-related dependencies.
go.mod	Declares indirect dependencies required by Kerberos authentication.

_{Review effort: Balanced}

[Victor Luna (victorlunam)]

@microsoft-github-policy-service agree company="AccountTECH"

[Copilot]

🔵 Needs a closer look

The new Kerberos error messages lack required translation artifacts, causing them to fall back to English regardless of SQLCMD_LANG.

1 open issue

• Report Kerberos setup errors when reconnecting fails

1 previously missed issue

In code that hasn't changed since last review

Regenerate and commit missing translation artifacts

pkg/​sqlcmd/​kerberos.go:57

Please regenerate and commit the translation artifacts for this error and the missing-cache error at line 65, as required by the repository's localization guidance. Without those entries, the new messages remain outside the translation catalog and fall back to English regardless of SQLCMD_LANG. Use the Windows generation path described in the PR and check that existing platform-specific strings are preserved.

1 resolved since last review

• Skip Kerberos parameters for SQL password authentication

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the change adding Kerberos authentication on Linux and macOS.

No open issues 🎉

2 resolved since last review

• Report Kerberos setup errors when reconnecting fails
• Skip Kerberos parameters for SQL password authentication

1 file not reviewed

• internal/translations/catalog.go: Generated file

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the Kerberos authentication change.

No open issues 🎉

1 file not reviewed

• internal/translations/catalog.go: Generated file

_{Review effort: Balanced}