Hoping to pick the brains of those more knowledgeable than me. I've been trying to set up a SQL Server 2019 instance on Linux; specifically on AWS using AMI amzn2-x86_64-SQL_2019_Standard-2019.11.12
I've followed the steps to connect the instance to our domain, and am able to successfully login using my domain credentials. sssd.conf below:
[sssd]
domains = [domain name]
config_file_version = 2
services = nss, pam
[domain/[domain name]
ad_server = [FQDN of Domain Controller]
ad_domain = [domain name]
krb5_realm = [DOMAIN NAME]
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
I've followed all the steps on the MSDN documentation on how to set up Windows Authentiation:
But whenever I try to login to the SQL Server using my domain credentials I receive the following error:
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication..
And in the mssql-server logs (using systemctl status mssql-server -l) I see the following:
Apr 22 04:47:04 [SERVER NAME.DOMAIN NAME] sqlservr[3243]: 2020-04-22 04:47:04.24 Logon Error: 17806, Severity: 20, State: 14.
Apr 22 04:47:04 [SERVER NAME.DOMAIN NAME] sqlservr[3243]: 2020-04-22 04:47:04.24 Logon SSPI handshake failed with error code 0x80090304, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The operating system error code indicates the cause of failure.
The Local Security Authority cannot be contacted [CLIENT: [IP ADDRESS]]
Apr 22 04:47:04 [SERVER NAME.DOMAIN NAME] sqlservr[3243]: 2020-04-22 04:47:04.25 Logon Error: 18452, Severity: 14, State: 1.
Apr 22 04:47:04 [SERVER NAME.DOMAIN NAME] sqlservr[3243]: 2020-04-22 04:47:04.25 Logon Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. [CLIENT: [IP ADDRESS]]
The error would suggest an issue contacting the Local Security Authority, so I've double checked my krb5.conf file and don't see any obvious issues:
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
# default_realm = EXAMPLE.COM
default_ccache_name = KEYRING:persistent:%{uid}
udp_preference_limit=0
default_realm = [DOMAIN NAME]
[realms]
# EXAMPLE.COM = {
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# }
[DOMAIN NAME] = {
kdc = [Domain Controller 1 FQDN]:88
kdc = [Domain Controller 2 FQDN]:88
kdc = [Domain Controller 3 FQDN]:88
}
[domain_realm]
# .example.com = EXAMPLE.COM
# example.com = EXAMPLE.COM
[DOMAIN NAME] = [DOMAIN NAME]
.[DOMAIN NAME] = [DOMAIN NAME]
And the fact that I can login using my AD credentials to me suggests there's no overarching issue contacting the domain controllers.
Any tips or pointers would be greatly appreciated on where to go next with this!
