Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a cross domain situation where the SQL Server 2008 R2 server sits in one domain and the client in another. There is a one-way trust between the domains. The SQL Server runs on a domain account. The domain account used on the client has been granted "Allowed To Authenticate" on the SQL Server machine and has been granted "Access this machine from the network" in the local machine policy on the SQL Server machine.

SSMS on the client connects just fine. However, when trying to connect with Embarcadero Change Manager, which uses the Microsoft JBDC driver, this exception is passed back to the client from the SQL Server:

SSPI handshake failed with error code 0x80090308, state 14 while establishing a connection with integrated security, the connection has been closed. Reason: AcceptSecurityContect failed. The Windows error code indicates the cause of the failure.


Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

My best guess is that there is some quirk with the Micorsoft JDBC driver causing this. The network traffic is not clear text so I can't readily see what's being sent over to the SQL Server.

share|improve this question
This sounds like an issue with Kerberos authentication, which is pretty deep subject. Have you read anything about Kerberos authentication and SQL Server? – Max Vernon Nov 12 '13 at 19:01
I know a lot about kerberos since its been a major problem getting these database servers to authenticate users who hit them from the application tier. kerberos is in use and SPNs are set up and working. The accounts that run the application tier have the necessary delegation and are working. You would think that getting a tool to hit the database directly, without even the double hop, on a database that already has kerberos set up and working, would be cake... NOT! – tlum Nov 12 '13 at 19:41
However, this is the first time I'm trying to go across the domain and I believe this my not be possible without a two-way trust, I only have a one-way trust. Need to confirm this. – tlum Nov 12 '13 at 19:44
Kerberos is so much fun. – Max Vernon Nov 12 '13 at 22:17
@MaxVernon, any good place to start kerberos authentication and sql server – Biju jose Nov 18 '13 at 3:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.