Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

We've got a client that we're going to allow to use one of our applications. Staff on site regularly connect to our network via VPN. The .Net application that connects to the SQL Server uses integrated security. The laptops they use are members of our domain.

The client has requested use of the application as well. So we gave them a network account and the ability to create a VPN session on our network. I gave that account a login on the SQL server with the same rights as our own staff.

The problem is that when they try to use the application they get the following error: The login is from an untrusted domain and cannot be used with Windows authentication.

I'm guessing that since they are using a computer that is not on our domain, it doesn't matter that they are using a login with the VPN that is. So, what is the best way to address this problem? I'd rather not switch over to SQL authentication for this small application.

share|improve this question
    
Hi - if you want to migrate this over to security.stackexchange.com you should get some useful answers. –  Rory Alsop May 10 '11 at 20:39
    
So, the word I'm getting from network folks is that because of the way that cisco works this is probably not going to work. SQL authentication it is. –  RThomas May 11 '11 at 15:51
    
problem fixed using sql authentication? –  Coder Hawk May 12 '11 at 6:48
    
Yes, I switched to sql authentication after network guy helped me understand how the server sees the incoming VPN user and realized it wasn't going to work they way I wanted it to. –  RThomas May 12 '11 at 17:52

1 Answer 1

up vote 1 down vote accepted

If the client computer isn't on the same domain as the SQL Server, and if there's no trusts set up between the client computer's domain and the SQL Server's domain, you can't use integrated authentication.

share|improve this answer
    
I hesitate to mark your answer as correct for the simple fact that I want to hold on a little longer to the time when my "street cred" on this forum was higher than yours... but alas, it'll happen soon enough I guess. –  RThomas May 27 '11 at 19:58
    
@lazyDBA - HAHAHA, nice. –  Brent Ozar Jun 8 '11 at 16:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.