2

I have a MS SQL server DOMAIN\DB running under a domain service account DOMAIN\svc_sql. If I run a script accessing a file in a network share from another server DOMAIN\CLIENT connecting to DOMAIN\DB using SSMS authenticated by my domain account DOMAIN\user, I got this error

Cannot bulk load because the file "\\FILE_SHARE\file.json" could not be opened. Operating system error code 5(Access is denied.).

Both of DOMAIN\svc_sql and DOMAIN\user have access to this file. Also, this problem does not occur if I RDP and SSMS with my DOMAIN\user into DOMAIN\DB.

From what I found, this might be something regarding double-hop issue and delegation.

My SPN seems to be correct:

C:\Users\user>setspn -L DOMAIN\svc_sql
Registered ServicePrincipalNames for CN=svc_sql,DC=DOMAIN,DC=pvt:
        MSSQLSvc/DB.DOMAIN.pvt:1433
        MSSQLSvc/DB.DOMAIN.pvt

I tried to set the service account DOMAIN\svc_sql to be trusted for delegation of any services and reboot DOMAIN\DB, but it still does not work.

PS C:\Users\user> Get-ADUser svc_sql -Properties TrustedForDelegation,TrustedToAuthForDelegation

....
TrustedForDelegation       : True
TrustedToAuthForDelegation : False
UserPrincipalName          : svc_sql@DOMAIN
2
  • 2
    If you assume it's a kerberos issue, you can always double check with the Microsoft Kerberos Configuration manager, this gives a clear overview of SPN/Delegation issues. microsoft.com/en-us/download/details.aspx?id=39046 Jan 11 at 6:51
  • Thank you. This tool helps to visualize a lot. Come down resolution is to I have to add specific file server with cifs.
    – Teacup
    Jan 11 at 16:00

1 Answer 1

2

It seems that you have to set constrained delegation of the cifs protocol.

enter image description here

1
  • In the wild world of Microsoft, this fixed it. I have to add my file server with cifs
    – Teacup
    Jan 11 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.