SQL Server ODBC connection with Kerberos/AD Authentication - sql-server

I have SQL Server that uses Kerberos authentication on my company's network. I am trying to setup a Linux system to be able to access that SQL Server using pyodbc. I am new to Kerberos, but have been able to get my Linux (Ubuntu 16.04) box working with Kerberos... Atleast thats what I think. I can do kinit <username> and it recognizes my username and password.
What do I do next?
If I do this:
sqlcmd -S MyDatabase.corp.com
I get this:
sqlcmd: Error: Microsoft ODBC Driver 11 for SQL Server : Cannot generate SSPI context.
Sqlcmd: Error: Microsoft ODBC Driver 11 for SQL Server : SSPI Provider: Cannot find KDC for realm "COMPANYNET.CORP.COM".
I am pretty sure I am just not doing the next step but I haven't found a good source to tell me what to do next. Any help is much appreciated... Thanks!

After much headache and annoying a lot of people at my company I got this to finally work.
Had to get a Service Account setup on the Domain
Had to get a krb5.keytab file made by an AD Admin
Had to setup Kerberos with the correct Domain in my /etc/krb5.conf file
Had to have SPNs set for the target SQL Server (This seems to be the actual cause of the above error message)
Ensure proper permissions set Service Account on SQL Server.
Once above was set I can do:
kinit -k <SERVICE ACCOUNT NAME>
sqlcmd -E -S MyDatabase.corp.com

Related

sqlcmd - problem to connect with sql credentials

I have a SQL database service in Azure with a server name dummyserver.database.windows.net.
I have also a database dummyDB with user dummyuser.
I can connect there providing above parameters and credentials with Azure Data Studio and other DB tools.
But when I try to do the same tith sqlcmd i get an error:
sqlcmd -S dummyserver.database.windows.net
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : MAX_PROVS: The system cannot contact a domain controller to service the authentication request. Please try again later.
.
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Cannot generate SSPI context.
I went through https://learn.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver16
but haven't found any way to connect using login/password
In my case it is not even login issue because I don't get to this point yet.
My error is earlier.
Any hint what is wrong?

Login failed when I trying to connect to a SQL Server using sqlcmd (from Ubuntu command line)?

I am finding some problem trying to connect to a SQL Server instance from an Ubuntu machine using sqlcmd. The SQL server instance run on another server that is an always on MS-SQL Server cluster.
So I installed sqlcmd as explained here: https://learn.microsoft.com/it-it/sql/linux/sql-server-linux-setup-tools?view=sql-server-ver15#ubuntu
The SQL server seems to be reachable because I can successfully connect to the 1433 port of its IP via Telnet.
Then I tried to connect to one of my database on this server, in this way:
./sqlcmd -S MY-IP-ADDRESS -d ESB_WSO2_USER_DB -U datacenter\\wso2DBAdmin
Where:
ESB_WSO2_USER_DB is the DB name
datacenter\wso2DBAdmin is the domain\username
It ask me the password, I insert the password (pretty sure that the credential should be ok) but I am obtaining this error message:
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Login failed
for user 'datacenter\wso2DBAdmin'..
Assuming that username and password are correct: what could be the problem? Is it something that could be related to my sqlcmd installation (maybe some missconfiguration), or the driver? or something related to my connection string? or something related to the SQL Server database?

Unable to connect to Sybase 15.0.3 Server using Isql

I have installed Sybase ASE 15.0.3 on Read Hat Linux. ASE server is up and running. However, i am not able to connect to the server via iSql.
[sybase#ip-********* install]$ isql -SCLGETCLD -Usa -Pnull
Unable to retrieve localized message for ID 4
CT-LIBRARY error:
ct__string_extended_encryption: user api layer: internal common library error: Client password encryption fails.
I am using the default password null for sa. I have not set any password for Sa during the installation process.
I have tried looking into the interfaces file and it'looks good. Looked out for the libraries sybase/15/OCS-15_0/lib3p/sybcsi and they are good with right permissions in place.
Not really sure if i am missing something. Any inputs regarding the issue would be greatly appreciated.

Sonarqube 5.2 SQLServer connection

Since Sonarqube 5.2 is released, the jTDS JDBC driver is no longer supported. We used this driver to connect to our SQLServer instance, but we'll have to switch to the Microsoft SQLServer driver. We're running Sonarqube on Ubuntu and use an Active Directory account to connect to the SQLServer database. Because we're running on Ubuntu we can't use integrated security, so the credentials have to be supplied in the JDBC configuration for Sonarqube. This would result in the following properties:
sonar.jdbc.url=jdbc:sqlserver://sqlserverhost.my.domain.com:1433;databaseName=sonar;selectMethod=cursor
sonar.jdbc.username=someuser
sonar.jdbc.password=somepassword
This results in SQLServer in a "Login Failed" with the message "Could not find a login matching the name provided."
The next thing I tried was to connect with a username containing the domain, resulting in these properties:
sonar.jdbc.url=jdbc:sqlserver://sqlserverhost.my.domain.com:1433;databaseName=sonar;selectMethod=cursor
sonar.jdbc.username=DOMAIN\\someuser
sonar.jdbc.password=somepassword
This however also results in a "Login Failed" in SQLServer, the message here is "Attempting to use an NT account name with SQL Server Authentication."
What am I missing?
UPDATE:
The Sonarqube log can be found here: http://pastebin.com/AGB9bTQG
I can think of one thing which is different from the jTDS connection url:
the jTDS connection url contained ";domain=my.domain.com", which the Microsoft SQLServer driver doesn't seem to support. Therefore I tried the DOMAIN\someuser setup which SQLServer refused.
The driver is completely different from the jtds driver. In order to use it, you'll need to specify the authenticationScheme=JavaKerberos parameter (please refer to https://msdn.microsoft.com/en-us/library/gg558122(v=sql.110).aspx and http://blogs.msdn.com/b/psssql/archive/2015/01/09/jdbc-this-driver-is-not-configured-for-integrated-authentication.aspx)
The problem here is that your Linux machine is most likely not in the same domain, so you'll need to configure kerberos on your Linux machine too. Your best bet would really be mixed mode.
The connection string format has changed. No more :1443 or selectMethod
sonar.jdbc.url=jdbc:sqlserver://sqlserverhost.my.domain.com;databaseName=sonar
The connection string setting needs to be in the format:
sonar.jbc.url=jdbc:sqlserver://{server}:{port #};databaseName={db name}
e.g.
sonar.jbc.url=jdbc:sqlserver://localhost:36549;databaseName=Sonar
Check in SQL Server Configuration Manager that TCP/IP protocol is enabled and to find the port number for the SQL instance you want to connect to. Note that the database name in the connection string is case sensitive and must match what appears in SSMS.
Re: Windows Auth to SQL Server - you need to either use a SQL Server Auth user, or comment out sonar.jdbc.username and sonar.jdbc.password so that the SonarQube makes the connection under the credentials of the user running the SonarQube service; I don't think it supports impersonation.
Our solution was to have a SQL Server account created with permission to the database and use that instead of using the AD/Windows account.

SQL Server 2008 - Login failed. The login is from an untrusted domain and cannot be used with Windows authentication

I've just installed SQL Server 2008 Developer edition and I'm trying to connect using SQLCMD.exe, but I get the following error:
H:\>sqlcmd.exe -S ".\SQL2008"
Msg 18452, Level 14, State 1, Server DEVBOX\SQL2008, Line 1
Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.
The SQL Server instance is configured to use SQL Server and Windows Authentication mode. If I specify -U sa then I can log in successfully, but I'd like to use windows authentication. Connecting using SSMS with windows authentication seems to work fine.
I had this issue and it was because the machine running the application isnt trusted for delegation on the domain by active directory. If it is a .net app running under an application pool identity DOMAIN_application.environment for example.. the identity can't make calls out to SQL unless the machine is trusted.
You're not passing any credentials to sqlcmd.exe
So it's trying to authenticate you using the Windows Login credentials, but you mustn't have your SQL Server setup to accept those credentials...
When you were installing it, you would have had to supply a Server Admin password (for the sa account)
Try...
sqlcmd.exe -U sa -P YOUR_PASSWORD -S ".\SQL2008"
for reference,
theres more details here...
In my case, this error was caused by renaming my client machine. I used a new name longer than 13 characters (despite the warning), which resulted in the NETBIOS name being truncated and being different from the full machine name. Once I re-renamed the client to a shorter name, the error went away.
Just tried this:
H:>"C:\Program Files\Microsoft SQL Server\90\Tools\Binn\sqlcmd.exe" -S ".\SQL2008"
1>
and it works.. (I have the Microsoft SQL Server\100\Tools\Binn directory in my path).
Still not sure why the SQL Server 2008 version of SQLCMD doesn't work though..
Your error is quite literally saying "you're trying to use Windows Authentication, but your login isn't from a trusted domain". Which is odd, because you're connecting to the local machine.
Perhaps you're logged into Windows using a local account rather than a domain account? Ensure that you're logging in with a domain account that is also a SQL Server principal on your SQL2008 instance.
Do you specify a user name and password to log on? What exactly is your complete command line?
If you're running on your own box, you can either specify a username/password, or use the -E parameter to log on with your Windows credentials (if those are permitted in your SQL server installation).
Marc
I was getting this error too, although my issue was that I kept switching between two corporate networks via my Virtual Machine, with different access credentials. I had to run the command prompt:
ipconfig /renew
After this my network issues were resolved and I could connect once again to SQL.
Just found this thread and posted an alternative answer (copied below) here:
https://stackoverflow.com/a/37853766/1948625
Specifically on this question, if the dot "." used in the -S value of the command line means the same as 127.0.0.1, then it could be the same issue as the connection string of the other question. Use the hostname instead, or check your hosts file.
Old question, and my symptoms are slightly different, but same error. My connection string was correct (Integrated security, and I don't provide user and pwd) with data source set to 127.0.0.1. It worked fine for years.
But recently I added a line in the static host file for testing purposes (C:\Windows\System32\drivers\etc\hosts)
127.0.0.1 www.blablatestsite.com
Removing this line and the error is gone.
I got a clue from this article (https://support.microsoft.com/en-gb/kb/896861) which talks about hostnames and loopback.
Other possible fix (if you need to keep that line in the hosts file) is to use the hostname (like MYSERVER01) instead of 127.0.0.1 in the data source of the connection string.

Resources