Is there a prohibition for using a Windows Group account (with users) and mapping them to a credential in SQL Server.
I was able to make this work with an Windows Login Account and I believe this will work well with SQL Accounts.
Running the following:
ALTER LOGIN [DOMAIN\GROUP_NAME] FROM WINDOWS
ADD CREDENTIAL [credentialname];
GO
I get the following error:
Cannot use parameter CREDENTIAL for a Windows login. error 15080
Adding a credential to a Login is used to give a Windows identity to a SQL Login for interacting with external resources, typically in CLR code or Linked Servers.
CREDENTIAL = credential_name The name of a credential to be mapped to
a SQL Server login. The credential must already exist in the server.
For more information, see Credentials. A credential cannot be mapped
to the sa login.
ALTER LOGIN
It's not intended, documented, or supported for Windows Logins of any kind, and doesn't actually work.
Related
The authentication mode is "Mixed" for my SQL Server 2016.
I'm using SSMS to run cross-server queries.
I've checked the user account & have ensured that the account has proper authority. I can use a different account and run cross-server queries as expected. The account has proper authority to the databases in question and it has authority to them. I've tried everything I've seen on the internet searches I've done and no luck. The account can login using SSMS.
My linked server properties are:
The account's login properties are:
Has anyone else seen this & have a resolution?
** EDIT: rebooting the target server fixed the issue
When creating a linked server you choose the authentication mechanism by which the remote connection will be made. If you select the fourth option (pictured), the remote login must be a Sql Server authenticated login. It cannot be a windows login.
The only way to connect through a linked server using windows authentication is to forward the credentials of the login on the local server. There is no option to specify a windows username and password.
Indeed, there is no way, ever, to specify a password when connecting to a Sql Server with windows credentials, since the whole point of windows credentials is that you're already authenticated. That happened when you logged in to windows in the morning*
You can only (and must always) specify a password if you are using Sql Server authentication.
What seems to be going on in your case is that the linked server may have been created with the wrong security options. This is just easier to explain with an image:
* More precisely, a connection will be made using the account that the client is running under. If you start SSMS using a "runas /user ..." command, then the windows credentials used to connect to servers will be the credentials specified in runas
Do you know whether a SQL Server connection can be authenticated via Windows Authentication but using a not exclusively the Windows Identity/Windows User Name but also a DB login name?
That is, could an SQL Server database have a login that is mapped to a Windows ID so that when you request a database connection you can specify a user name but yet SQL Server knows to look at the Windows authentication ID and validate the login?
could an SQL Server database have a login that is mapped to a Windows ID so that when you request a database connection you can specify a user name but yet SQL Server knows to look at the Windows authentication ID and validate the login?
No. When you connect with Windows Integrated Authentication you'll be connected as a Windows Login, and for each database you execute statements as the user mapped to that Windows Login (or as dbo if the login is a member of the sysadmin server-level role or the Windows Login is the owner of the database).
You can grant that Windows Login or mapped user the privilege to impersonate some other login or user, but it requires a separate command to perform the impersonation (execute as user='someuser'.
I have an domain admin user group and I have added it to SQL Server security. My account is added to the group. But I am not able to log in to SQL Server.
If I add my domain account individually to SQL Server, I can login using my Windows account. Can I login into SQL Server via a user group so I do not have to add the each individual account?
Yes, you can. All that is required is to add the windows ad group to whatever role is appropriate to your configuration.
SQL Server supports three types of logins:
A local Windows user account or trusted domain account. SQL Server
relies on Windows to authenticate the Windows user accounts.
Windows group. Granting access to a Windows group grants access to
all Windows user logins that are members of the group.
SQL Server login. SQL Server stores both the username and a hash of
the password in the master database, by using internal authentication
methods to verify login attempts.
Read more here MSDN SQL Authentication
And this article has step by step with screen shots: Step By Step
You can use Windows Authentication Mode, first you need to make sure that the user's identity is verified by Windows then SQL Server validates the account name and password using the Windows principal token in the operating system.
Read more: https://msdn.microsoft.com/en-us/library/ms144284.aspx
I do not remember the serverauthentication password, so I am using windows authentication. I am not able to do anything.
You need to fulfill the following requirements:
you must be a member of Local Administrators group on the computer where the SQL Server is running.
The SQL Server service must be run under the LocalSystem account.
In this case, when connecting using Windows Authentication, you can check if you have any permissions (check the Logins sub-section of the Security section in the SSMS. If the NT AUTHORITY\SYSTEM is shown there, you can add the needed database. Otherwise you need to bethink the sysadmin login & password.
I'm trying to connect to a local SQL Server database but it gives me this error:
Login failed for user 'DOMAIN\Username'.
When I open SQL server and look in the Security\Logins folder then I do see the user DOMAIN\Username. This is also the user that I use to login into Windows with.
My connection string looks like this:
<add name="ServerConfiguration"
connectionString="server=localhost; database=BN_Configuration;
Integrated Security=false; User ID=DOMAIN\Username; Password=123456;"
providerName="System.Data.SqlClient" />
Anyone any idea why I can't login with these credentials?
--
Note I wish to authenticate with a user that exists in the SQL Server database. So I do NOT want to do Windows authentication with Integrated Security set to false.
It looks like you are using a Windows credential as SQL Server credential. Try integrated security = true, and not to specify user ID and password.
In your connection string Integrated Security=false is saying user ID and password are specified in the connection for an account that exists in SQL Server but is NOT a domain user. When Integrated Security=true, the current Windows account credentials are used for authentication. If it's an application it will use the user who is currently logged in, and for a web application it all depends on how your application pool is set up.
You are mixing up the definitions by saying ``Integrated Security=false` but passing domain credentials which is not possible.
Using a domain account
Set Integrated Security=true
Remove the user id and password sections.
Map the domain account in SQL Server making sure to set Windows authentication
If it's a web application, make sure your application pool is set to run under that domain account.
Using a SQL Server Account
Set Integrated Security=false
Create a SQL login, making sure it uses SQL Server authentication
Set the User ID and Password properties of your connection string to be the same details you created above.
Note: Final point, make sure the user also has access to the database you are connecting to (in your case BN_Configuration).