title: HashiCorp Root DB Credential Rotation with SQL Server
body: <p>I am trying to use this new feature in the 0.10 version of HashiCorp Vault that allows you to rotate the root credentials supplied to the database secret engine. Using SQL Server as my database I can't get this to work.</p>
  <p>Doing <code>vault write -force database/rotate-root/mssql</code> throws this error:</p>
  <blockquote>
  <p>Error writing data to database/rotate-root/mssql: Error making API request.</p>
  <p>URL: PUT <a href="http://0.0.0.0:8200/v1/database/rotate-root/mssql" rel="nofollow noreferrer">http://0.0.0.0:8200/v1/database/rotate-root/mssql</a>
  Code: 500. Errors:</p>
  <ul>
  <li><p>1 error occurred:</p>
  </li>
  <li><p>mssql: Cannot alter the login '%!s(MISSING)', because it does not exist or you do not have permission.</p>
  </li>
  </ul>
  </blockquote>
  <p>Doing <code>vault read database/config/mssql</code> returns:</p>
  <pre><code>Key                                   Value
  ---                                   -----
  allowed_roles                         [* imagine]
  connection_details                    map[connection_url:sqlserver://{{username}}:{{password}}@sql:1433 username:vaultrolecreator]
  plugin_name                           mssql-database-plugin
  root_credentials_rotate_statements    []
  </code></pre>
  <p>Wonder if you are supposed to supply your own rotate statements. Everything else I want to do works perfectly and these tests are done using the vault root token.</p>
  <p>The original plugin info was done using this statement:</p>
  <pre><code>vault write database/config/mssql \
    plugin_name=&quot;mssql-database-plugin&quot; \
    connection_url=&quot;sqlserver://{{username}}:{{password}}@sql:1433&quot; \
    allowed_roles=&quot;*, imagine&quot; \
    username=&quot;vaultrolecreator&quot; \
    password=&quot;UnSafePass&quot;`
  </code></pre>