Repository navigation
ActiveDirectoryDefault authentication fails on 1.7.1 (regression) #597
Description
Describe the bug
Upgrading from 1.6.0 to 1.7.1 causes ActiveDirectoryDefault authentication to fail and sometimes produces a segfault.
Exception message: mssql_python.exceptions.OperationalError: Driver Error: Invalid authorization specification; DDBC Error: [Microsoft][SQL Server]Login failed for user '<token-identified principal>'.
Stack trace:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
conn = mssql_python.connect(
"SERVER=<SQL-SERVER-ADDRESS>;"
...<2 lines>...
"Encrypt=yes;",
)
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\mssql_python\db_connection.py", line 55, in connect
conn = Connection(
connection_str,
...<4 lines>...
**kwargs,
)
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\mssql_python\connection.py", line 378, in __init__
_raise_connection_error(e)
~~~~~~~~~~~~~~~~~~~~~~~^^^
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\mssql_python\connection.py", line 89, in _raise_connection_error
raise exc from None
Here's the traceback for when a segfault happens. I can't trigger the segfault reliably though.
Windows fatal exception: access violation
Current thread 0x00008d80 (most recent call first):
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\mssql_python\connection.py", line 374 in __init__
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\mssql_python\db_connection.py", line 55 in connect
File "C:\Users\tsong\repo\pam\src\pam\sql\connections.py", line 34 in sql_conn
File "C:\Users\tsong\AppData\Roaming\uv\python\cpython-3.13-windows-x86_64-none\Lib\contextlib.py", line 141 in __enter__
File "C:\Users\tsong\repo\pam\src\pam\sql\write_db.py", line 90 in df_bcp_sql
File "C:\Users\tsong\repo\pam\tests\test_write_db.py", line 128 in test_bulk_copy
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\python.py", line 166 in pytest_pyfunc_call
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_callers.py", line 121 in _multicall
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_manager.py", line 120 in _hookexec
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_hooks.py", line 512 in __call__
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\python.py", line 1720 in runtest
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\runner.py", line 179 in pytest_runtest_call
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_callers.py", line 121 in _multicall
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_manager.py", line 120 in _hookexec
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_hooks.py", line 512 in __call__
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\runner.py", line 245 in <lambda>
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\runner.py", line 353 in from_call
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\runner.py", line 244 in call_and_report
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\runner.py", line 137 in runtestprotocol
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\runner.py", line 118 in pytest_runtest_protocol
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_callers.py", line 121 in _multicall
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_manager.py", line 120 in _hookexec
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_hooks.py", line 512 in __call__
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\main.py", line 396 in pytest_runtestloop
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_callers.py", line 121 in _multicall
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_manager.py", line 120 in _hookexec
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_hooks.py", line 512 in __call__
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\main.py", line 372 in _main
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\main.py", line 318 in wrap_session
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\main.py", line 365 in pytest_cmdline_main
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_callers.py", line 121 in _multicall
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_manager.py", line 120 in _hookexec
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\pluggy\_hooks.py", line 512 in __call__
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\config\__init__.py", line 199 in main
File "C:\Users\tsong\repo\pam\.venv\Lib\site-packages\_pytest\config\__init__.py", line 223 in console_main
File "C:\Users\tsong\repo\pam\.venv\Scripts\pytest.exe\__main__.py", line 10 in <module>
File "<frozen runpy>", line 88 in _run_code
File "<frozen runpy>", line 198 in _run_module_as_main
Segmentation fault
To reproduce
import mssql_python
conn = mssql_python.connect(
"SERVER=<SQL-SERVER-ADDRESS>;"
"DATABASE=TEMPDB;"
"Authentication=ActiveDirectoryDefault;"
"Encrypt=yes;"
)
cursor = conn.cursor()
cursor.execute("SELECT 1")
print(cursor.fetchone())Expected behavior
Connection succeeds and query executes.
Further technical details
Python version: 3.13.13
SQL Server version: Azure SQL Managed Instance (locked to 2022)
Operating system: Windows 11
Additional context
Using ActiveDirectoryIntegrated works fine, but this prevents us from using bulk copy. My guess is this problem is related to releasing the GIL. I tried setting mssql_python.pooling(enabled=False), but that did not help.
Authentication also fails when I skip the Authentication=ActiveDirectoryDefault parameter entirely and use attrs_before to pass in the token directly. This method works on v1.6.0.
import mssql_python
from azure.identity import DefaultAzureCredential
SQL_COPT_SS_ACCESS_TOKEN = 1256 # per msodbcsql.h
azure_cred = DefaultAzureCredential()
token = azure_cred.get_token("https://database.windows.net/.default").token
b_token = token.encode("UTF-16-LE")
conn_arg = struct.pack(f"<I{len(b_token)}s", len(b_token), b_token)
conn = mssql_python.connect(
"SERVER=<SQL-SERVER-ADDRESS>;"
"DATABASE=TEMPDB;"
"Encrypt=yes;",
attrs_before={SQL_COPT_SS_ACCESS_TOKEN: conn_arg},
)
Activity
github-actions commentedon May 21, 2026
Hi Taehoon Song (@taehoon-song), thank you for opening this issue!
Our team will review it shortly. We aim to triage all new issues within 24-48 hours and get back to you.
If you have additional information to share, please feel free to update the issue.
Thank you for your patience!
saurabh500 commentedon May 21, 2026
Duplicate of #594
RELEASE: 1.8.0 (#605)